Re: [P2PSIP] HIP vs. TLS/DTLS/SRTP (was HIP pros and cons)

On Mon, 17 Dec 2007, Ali Fessi wrote:

Hi Ali,

(I think there were already response to your message from Philip also)

> For example, if you want to use a HIP overlay for P2PSIP lookup service, and 
> as soon as you find the Callee, you want to perform the subsequent SIP 
> signaling in a B2BUA mode and send your media streams directly using IP 
> routing. (although i know some people will say here you can use HIP. but i 
> think you don't want to use the HIP overlay for routing the media data)

You can use HIP :)

> In this case, you would use the HIP overlay for the lookup and will need to 
> use SRTP for protecting the media streams. and probably also TLS/DTLS for 
> protecting the B2B SIP signaling.
>
> I hope this was clear?

Not exactly.

> Another reason, is that there might a misunderstanding of the security 
> services provided by the HIP layer. e.g. some environments could use HIP for 
> the overlay and think they are safe, while HIP is configured to use null 
> encryption. So, this could lead to security holes quickly in practice.

If the application needs to know this, it can query this using a 
getsockopt or similar call:

http://www.ietf.org/internet-drafts/draft-ietf-btns-c-api-01.txt

> In general, i think it is a good practice if the security of the application 
> does not depend on the security provided by the lower layers (under layer 4).

Why?

> BTW, the 3GPP IMS, for example, uses its own authentication and 
> confidentiality mechanisms independantly of the access network, which is, i 
> think, wise.

What prevents the application from requesting a specific security service 
from the lower layers?

> Also, if you look at things how they work today, you don't want to establish 
> a VPN tunnel to a web server if you want to protect your HTTP traffic. You 
> would rather use TLS.

You are using VPN as a synonym for IPsec which is not entirely correct. 
VPN usually means that usually you have a gateway. In HIP there is usually 
no gateway (end-to-middle), but instead the traffic is end-to-end.

-- 
Miika Komu                                       http://www.iki.fi/miika/

_______________________________________________
P2PSIP mailing list
P2PSIP@ietf.org
https://www1.ietf.org/mailman/listinfo/p2psip