Subject: [Sip] new version: Security Mechanism Agreement for SIP Sessions

From: "Vesa Torvinen (LMF)" <[email-masked]>
Date: Tue, 23 Apr 2002 10:35:04 +0200

Hi, 

We have submitted a new version of SIP Security Agreement draft
(ex draft-arkko-sip-sec-agree-01, now draft-ietf-sip-sec-agree-00). 

We have changed quite many details in the draft (including the 
syntax, usage of option tags, etc), and added more text on behaviors 
expected from SIP entities using the extension. We hope this version 
will now better fulfill the needs of both IETF and 3GPP. 

If you want to see the draft before it is officially available, go to: 

http://standards.ericsson.net/sip/drafts/draft-ietf-sip-sec-agree-00.txt

The abstract of the draft: 

SIP has a number of security mechanisms for hop-by-hop and end-to-end
protection. Some of the security mechanisms have been built in to the
SIP protocol, such as HTTP authentication or secure attachments. In
these mechanisms there are even alternative algorithms and parameters.
Currently it isn't possible to select which security mechanisms to use
over a connection. In particular, even if some mechanisms such as
OPTIONS were used to make this selection, the selection would be vul
nerable against the Bidding-Down attack.  This document defines a
header for negotiating the security mechanisms within SIP. A SIP
entity applying this mechanism must always require some minimum secu
rity (i.e. integrity protection) from all communicating parties in
order to secure the negotiation, but the negotiation can agree on
which specific minimum security is used.

All comments are most welcome! 

Vesa 

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip