Subject: [Sip] Are we having an Identity crisis?

From: Dean Willis <[email-masked]>
Date: Sat, 19 Jul 2008 02:34:20 -0500

We seem to have some disagreement as to whether we have any issues  
with SIP Identity, aka RFC 4474, which defines a certificate-based  
authentication service for authentication and partial integrity  
protection of SIP messages.

Some people seem to think the existing approach is complete and  
satisfies all the use cases that we believe to be real.

Others believe that the SBC re-signing use case is either bogus or  
requires too much crypto work on the SBC to be useful.

Others ask "Just exactly how is it you think RFC 4474 is supposed to  
work with a transit SBC that is in neither the originating nor  
terminating domain and that has no contractual trust agreement with  
either?"

I think we have SOME sort of problem, else we wouldn't have nearly a  
dozen related drafts kicking around the archives. But as I said, we  
lack universal agreement on the existence of such a problem, and we  
certainly lack consensus on use cases that illustrate the problem.

So it seems to me that before we launch into solutions to the problem  
(which the SIP working group isn't chartered to do), that we should  
develop a consensus on what the problem is and what requirements we  
would place on a solution.

Is this something we can do?

 From a "charter" perspective, I believe it is.

Our charter says:

-------------
Specific deliverables toward these goals include:

1. Mechanisms for secure expression of identity in requests and
responses.

2. Mechanism to securely request services delivery by non-terminal
elements ("end-to-middle").

3. Guidelines for use of existing security mechanisms such as TLS,
IPsec, and certificates.

4. Guidelines for the use of descriptive techniques such as SAML
(Security Association Markup Language) with SIP.

5. Draft standard versions of SIP and critical supporting
specifications.
--------------

RFC 4474 certainly does nothing for identity in responses, so it  
doesn't meet the requirement of our charter. so work on responses is  
clearly in the scope of the charter. And note that the charter doesn't  
say "A mechanism" but "mechanisms", so revising RFC 4474 or  
documenting an alternative is arguably within the scope of our charter.

Is developing the requirements for #1 above something we can actually  
accomplish with a strong consensus? I hope so.

But do we have the political will to achieve such a consensus? That's  
what I'd like to hear from you.

--
Dean
_______________________________________________
Sip mailing list  https://www.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: Cullen Jennings <[email-masked]>
Date: Sun, 20 Jul 2008 09:57:35 -0700

> clearly in the scope of the charter. And note that the charter  
> doesn't say "A mechanism" but "mechanisms", so revising RFC 4474 or  
> Is developing the requirements for #1 above something we can  
> actually accomplish with a strong consensus? I hope so.

This part of the charter was written to cover the work in RFC 4474 and  
RFC 4916.

As folks figure out what is the problem that Dean wants to solve  
around Identity and what solutions are possible, we can figure out if  
it should happen in SIP, SIPPING, or a new WG and adjust charters  
accordingly.

Cullen <as RAI AD>

---

From: "Elwell, John" <[email-masked]>
Date: Mon, 21 Jul 2008 13:44:52 +0100

Dean,

Agreed, and several of the recent drafts focus on defining the problem,
rather than a solution.

John 

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On 
> Behalf Of Dean Willis
> Sent: 19 July 2008 08:34
> To: SIP IETF
> Subject: [Sip] Are we having an Identity crisis?
> 
> 
> actually

---

From: Eric Burger <[email-masked]>
Date: Wed, 23 Jul 2008 12:33:40 -0400

I vote for the latter: form an Identity Work Group.  That will (1)  
attract security folks whom would not be interested in INFO, (2)  
attract privacy folks who would not be interested in Connection Reuse,  
and (3) help SIP finish.

On Jul 20, 2008, at 12:57 PM, Cullen Jennings wrote:

>> doesn't meet the requirement of our charter. so work on responses  
>> is clearly in the scope of the charter. And note that the charter  
> This part of the charter was written to cover the work in RFC 4474  
> and RFC 4916.
>
> around Identity and what solutions are possible, we can figure out  
> if it should happen in SIP, SIPPING, or a new WG and adjust charters  
> accordingly.
>
>
> Cullen <as RAI AD>
>

---

From: "Dan York" <[email-masked]>
Date: Wed, 23 Jul 2008 16:42:57 +0000

Eric,

I like the idea of an Identity Working Group because it would attract others who, like you said, don't care as much about some of the SIP connection issues. However, given that "identity" is such a loaded term these days on the Internet, I think we need to be clear that this is about *SIP* identity and not about general Internet identity issues. Otherwise we could easily wind up off in the land of web identity, OpenID, etc.

I even have a name for you... How about something like:

CIRCUS - Communication Identity & Relationships Using SIP

:-)

Dan
-- 
Dan York, CISSP, Director of Emerging Communication Technology
Office of the CTO    Voxeo Corporation     [email-masked]
Phone: +1-407-455-5859  Skype: danyork  http://www.voxeo.com
Blogs: http://blogs.voxeo.com  http://www.disruptivetelephony.com

Bring your web applications to the phone.
Find out how at http://evolution.voxeo.com

-----Original Message-----
From: Eric Burger <[email-masked]>

Date: Wed, 23 Jul 2008 12:33:40 
To: Cullen Jennings<[email-masked]>
Cc: SIP IETF<[email-masked]>
Subject: Re: [Sip] Are we having an Identity crisis?