Re: [dispatch] SASL Authentication for SIP

[Eric Rescorla <[e-mail]>]

On Mon, Oct 17, 2022 at 12:52 AM Rick van Rein <[e-mail]> wrote:

> Hello,
>
> > I'm not really following this. Users authenticate to domains with
> passwords
> > (at least sometimes) but I would expect inter-domain authentication to be
> > done with TLS mutual auth.
>
> Ah, yes.  TLS is transport protection, usually between the proxies of
> a domain.  It does not allow end-to-end authentication between the
> parties.  Also, any encryption or key derivation that might be based on
> the end-to-end assurance is lost for the end points.  (The proxy may be
> operated by an external party.)
>

The general assumption has been that any end-to-end authentication
will be done by digitally signing the SIP messages. Probably the most
plausible at the moment is to base it on STIR/Passport. It's not
clear to me why SASL would help here.

> Also, my sense is that authentication is not the primary barrier to
> > inter-domain calling.
>
> Of course there are more issues; IPv4/IPv6, MTU, and probably more.
>

I don't think the issues are primarily technical at all, but whether the
carriers
want to do this.


> More or less. It's hard to see the IETF doing successful work in this
> space
> > if providers aren't interested.
>
> This is reasonable, but it does yield a catch-22 situation.  Can you
> explain how this is commonly resolved?
>
> I can see how a very large vendor would simply push their ideas out,
> and not all technical ideas should be standardised.  OTOH, there is a
> need to have standards before adoption can occur.
>

What one usually sees is that there is some unofficial discussion between
interested parties to get a general sense of the solution space and build
up interest. That's what happened in (for instance) MLS, PPM, etc.
Sometimes the IETF will create a mailing list for that discussion, though
I've also seen it happen in other fora.

-Ekr