Re: [secdir] SecDir review of draft-ietf-sipcore-sip-websocket-08

[Yaron Sheffer <[e-mail]>]

Authentication of incoming requests is important, but I was talking 
about something else: how does the client know that it is talking to the 
right server, e.g. when performing registration (I do hope there's a 
secure way to do it).

Best,
	Yaron

On 2013-04-15 18:38, Iñaki Baz Castillo wrote:
> 2013/4/15 Yaron Sheffer <[e-mail]>:
>> Hi again,
>>
>> Yes, I agree with your plan for moving forward. A few remaining comments:
>>
>> - Unless I missed something, you only talked about authentication of the
>> client, and did not mention authentication of the server to the client. From
>> the point of view of the client (and customer?) this is just as important.
>
> Nothing prevents a SIP WebSocket client to request authentication for
> an incoming request. Is it OK if the draft also mentions it in the
> appropriate section?
>
>
>
>> - Unfortunately we rarely have usable client auth with TLS. I wish we had
>> something better than client certificates. In fact there are some
>> implementations of RFC 5054 out there, and it would be great if you could
>> accommodate them as well.
>
> Great. Would it be ok by mentioning such a security mechanism it in
> the Security section?
>
>
>
>> - I would advise you take the draft back to the WG to have these changes
>> more thoroughly reviewed. I would be more than happy to review the new
>> draft, too.
>
> Thanks a lot. We will publish a new revision with the requested improvements.
>
>
>
> --
> Iñaki Baz Castillo
> <[e-mail]>
>