Subject: [pkix] Request for input on draft-ietf-sip-certs

From: "Polk, William T." <[email-masked]>
Date: Thu, 15 Oct 2009 17:00:27 -0400

Folks,

A RAI area document that is related to PKIX, draft-ietf-sip-certs-09, recently completed IETF Last Call.  There were no issues raised in Last Call, but I am concerned that the document may have been overlooked.  It turns out that early versions of this document were reviewed by a previous security AD, but it is not clear if the pkix wg ever reviewed it.  I asked the sponsoring AD (Robert Sparks) to pull the document off the last telechat agenda so that I would have time to canvas the pkix wg members for their opinion...

The document in question is available at

      http://tools.ietf.org/html/draft-ietf-sip-certs-09

The basic architectural building block is a self-signed certificate, but certificates issued by trusted third parties are also supported.  In addition, the architecture leverages normal SIP constructs to distribute credentials (i.e., private keys) to devices so that all SIP devices associated with a particular user can share the same certificate.

IMHO, the self-signed certificate and credential distribution mechanisms provide a significant incremental improvement in SIP security, and provide a reasonable transition strategy to promote use of certificates for SIP security.  I also believe that using certificates issued by trusted third parties can provide a more robust level of security for SIP applications.  However, I have concerns that the mechanisms for use with certificates from trusted third parties are under-specified.

Since the document has already completed IETF Last Call, and the sponsoring AD has deferred the document one cycle already, I am not requesting a formal wg review but rather am inviting individual opinions.  I would appreciate any feedback by COB Tuesday October 20 so that I can incorporate your thoughts into my ballot position in time for the October 22 telechat.

Thanks,

Tim Polk