Re: [dispatch] E2E Secure Messaging for SIP/SIMPLE

[Christer Holmberg <[e-mail]>]

Hi,

A few initial comments:

Q1:

The text says:

"This document discusses the use of S/MIME with SIP based messaging.²


However, the document also covers MSRP, and I don¹t know if that counts as
³SIP based². Perhaps it would be better to explicitly say ³SIP based
messaging and MSRP², ³SIP- and MSRP based messaging², or something?


Q2:

While section 4 describes the applicability of S/MIME, I think it would be
good to mention in section 1 and/or 3 exactly what encryption you are
talking about (i.e., encryption of bodies/content).


Q3:

Section 3 says:

"encryption across a session of messages"


What does that mean?


Thanks!

Regards,

Christer



On 31/10/17 20:47, "dispatch on behalf of Ben Campbell"
<[e-mail] on behalf of [e-mail]> wrote:

>(strictly as an individual)
>
>Hi everyone,
>
>Russ and I submitted a draft [1] on the use of S/MIME for the SIP MESSAGE
>method and for MSRP. It mainly offers clarifications of the S/MIME
>guidance in RFCs 3261, 3428, and 4975, but it also makes a few updates.
>
>The main use case we have in mind is for where organizations want to send
>secure notifications to their users. For example, financial organizations
>send transaction notices, organizations send password update notices, 2FA
>notices, etc. Much of that is currently done over various mobile
>messaging systems (SMS, etc). Most of that is done with no e2e
>authentication or integrity protection. We¹d like to enable at least
>end-to-end signed messaging for SIP based mobile messaging systems.
>
>We would appreciate it if people would take a look, and send your
>comments.
>
>[1] https://tools.ietf.org/html/draft-campbell-sip-messaging-smime-00
>
>Thanks!
>
>Ben.