Re: [dispatch] Fwd: New Version Notification for draft-johansson-dispatch-dane-sip-00.txt

2 jan 2014 kl. 19:34 skrev Rifaat Shekh-Yusef <rifaat.ietf@gmail.com>:

> Hi Olle,
> 
>        >Can we improve upon MD5 digest authentication?
> 
> Take a look at the following HTTPAuth WG document:
> https://datatracker.ietf.org/doc/draft-ietf-httpauth-digest/
> 
> I have been working on this for some time, with SIP in mind. This started as an attempt to update RFC2617, and now it is a different document that will obsolete RFC2617.
> The document updates 3 aspects of RFC2617:
> 1. Algorithms agility: use of SHA2
> 2. Internationalization
> 3. Username hashing
> 
> I am planning on writing a document to update the digest algorithms for SIP.
That's great. I will take a look at this.  Thank you!

Since this work is on the way - maybe we have enough to start a SIP security wg?

/O
> 
> Regards,
>  Rifaat
> 
> 
> 
> On Thu, Jan 2, 2014 at 5:16 AM, Olle E. Johansson <oej@edvina.net> wrote:
> Hi!
> I have renamed my draft and resubmitted it again. Adding DNSsec/DANE support to SIP is not a bad idea in my point of view.
> 
> If the view gets larger we might want to focus a bit more on security aspects of SIP in the RAI area. There are many issues to look at. Why isn't S/MIME deployed, how do we get more TLS - if that's what we want? Can we improve upon MD5 digest authentication? Do we want to fix SIP identity that many claim is broken? Is it possible to set up sessions with end2end security?
> 
> Happy New Year!
> 
> /O
> 
> 
> 
> Begin forwarded message:
> >
> > A new version of I-D, draft-johansson-dispatch-dane-sip-00.txt
> > has been successfully submitted by Olle E. Johansson and posted to the
> > IETF repository.
> >
> > Name:         draft-johansson-dispatch-dane-sip
> > Revision:     00
> > Title:                TLS sessions in SIP using DNS-based Authentication of Named Entities (DANE) TLSA records
> > Document date:        2014-01-02
> > Group:                Individual Submission
> > Pages:                9
> > URL:            http://www.ietf.org/internet-drafts/draft-johansson-dispatch-dane-sip-00.txt
> > Status:         https://datatracker.ietf.org/doc/draft-johansson-dispatch-dane-sip/
> > Htmlized:       http://tools.ietf.org/html/draft-johansson-dispatch-dane-sip-00
> >
> >
> > Abstract:
> >   Use of TLS in the SIP protocol is defined in multiple documents,
> >   starting with RFC 3261.  The actual verification that happens when
> >   setting up a SIP TLS connection to a SIP server based on a SIP URI is
> >   described in detail in RFC 5922 - SIP Domain Certificates.
> >
> >   In this document, an alternative method is defined, using DNS-Based
> >   Authentication of Named Entities (DANE).  By looking up TLSA DNS
> >   records and using DNSsec protection of the required queries,
> >   including lookups for NAPTR and SRV records, a SIP Client can verify
> >   the identity of the TLS SIP server in a different way, matching on
> >   the SRV host name in the X.509 PKIX certificate instead of the SIP
> >   domain.  This provides more scalability in hosting solutions and make
> >   it easier to use standard CA certificates (if needed at all).
> >
> >   This document updates RFC 5922.
> >
> >
> 
> _______________________________________________
> dispatch mailing list
> dispatch@ietf.org
> https://www.ietf.org/mailman/listinfo/dispatch
> 

---
* Olle E Johansson - oej@edvina.net
* Cell phone +46 70 593 68 51, Office +46 8 96 40 20, Sweden