Subject: [TLS] Client/Server TLS is equivalent to Client/Server TCP

From: Nabil HAMZI <[email-masked]>
Date: Thu, 7 Aug 2008 14:39:15 +0200

Hello !

I have a question about TCP and TLS. I want to know if the client TCP is necessary the client TLS and the same thing about the server.

Because i want to make up SIP on TLS and there is a problem : i need that the server can start a connection, in other word i need that the server SIP become a client TLS.

So i dont know if it works but supose :
1) the server send a SIP request to the client on the port 5060
2) the client check the port and it conclude that it s SIP, and it was configured to start a TLS session for doing SIP so it send a ClientHello
3) and the TLS begins.

It is correct or not ??

_________________________________________________________________
Retouchez, classez et partagez vos photos gratuitement avec le logiciel Galerie de Photos !
http://www.windowslive.fr/galerie/

_______________________________________________
TLS mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/tls

---

From: Eric Rescorla <[email-masked]>
Date: Thu, 07 Aug 2008 06:18:21 -0700

At Thu, 7 Aug 2008 14:39:15 +0200,
Nabil HAMZI wrote:
> 
> Hello !
> 
> I have a question about TCP and TLS. I want to know if the client
> TCP is necessary the client TLS and the same thing about the server.

No, it's not required, but you need a convention for any given
protocol.

> Because i want to make up SIP on TLS and there is a problem : i need
> that the server can start a connection, in other word i need that
> the server SIP become a client TLS.
> 

Why would you want this behavior? I'm quite familiar with the 
SIP security situation in in all the cases I'm familiar with
you (at least) want the server authenticated.

-Ekr

---

From: "Bentkofsky, Michael" <[email-masked]>
Date: Thu, 7 Aug 2008 12:24:57 -0400

Having worked on SIP implementations using TLS, I've never heard of such
a protocol as you describe. Typically SIP listens on port 5060 (TCP
and/or UDP) and 5061 for TLS. 
 
If your goal is to discover whether the server can start a TCP
connection, you wouldn't need such a protocol where you send a SIP
message followed by an attempted TLS session negotiation -- just connect
to the service port typically 5061. If you are trying to discover
whether a server can communicate SIP over TLS, there is some work done
in this area under RFC 3263.
 
Alternatively consider a protocol where the client sends a SIP request
over TCP to port 5060 and the server can send a redirection response to
port 5061 using a sips URL. 

________________________________

	From: [email-masked] [mailto:[email-masked]] On
Behalf Of Nabil HAMZI
	Sent: Thursday, August 07, 2008 8:39 AM
	To: [email-masked]
	Subject: [TLS] Client/Server TLS is equivalent to Client/Server
TCP

	Hello !
	
	I have a question about TCP and TLS. I want to know if the
client TCP is necessary the client TLS and the same thing about the
server.
	
	Because i want to make up SIP on TLS and there is a problem : i
need that the server can start a connection, in other word i need that
the server SIP become a client TLS.
	
	So i dont know if it works but supose :
	1) the server send a SIP request to the client on the port 5060
	2) the client check the port and it conclude that it s SIP, and
it was configured to start a TLS session for doing SIP so it send a
ClientHello
	3) and the TLS begins.

	It is correct or not ??