Re: [secdir] secdir review of draft-ietf-sipping-sip-offeranswer-14.txt
Juergen Schoenwaelder <j.schoenwaelder@jacobs-university.de> Thu, 28 April 2011 11:40 UTC
Return-Path: <j.schoenwaelder@jacobs-university.de>
X-Original-To: secdir@ietfa.amsl.com
Delivered-To: secdir@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A8965E06B6; Thu, 28 Apr 2011 04:40:43 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -103.151
X-Spam-Level:
X-Spam-Status: No, score=-103.151 tagged_above=-999 required=5 tests=[AWL=0.098, BAYES_00=-2.599, HELO_EQ_DE=0.35, RCVD_IN_DNSWL_LOW=-1, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sqFDkBMj7cc1; Thu, 28 Apr 2011 04:40:42 -0700 (PDT)
Received: from hermes.jacobs-university.de (hermes.jacobs-university.de [212.201.44.23]) by ietfa.amsl.com (Postfix) with ESMTP id 62046E068D; Thu, 28 Apr 2011 04:40:42 -0700 (PDT)
Received: from localhost (demetrius3.jacobs-university.de [212.201.44.48]) by hermes.jacobs-university.de (Postfix) with ESMTP id BCB1B20C04; Thu, 28 Apr 2011 13:40:41 +0200 (CEST)
X-Virus-Scanned: amavisd-new at jacobs-university.de
Received: from hermes.jacobs-university.de ([212.201.44.23]) by localhost (demetrius3.jacobs-university.de [212.201.44.32]) (amavisd-new, port 10024) with ESMTP id XJEbniSsJg0w; Thu, 28 Apr 2011 13:40:41 +0200 (CEST)
Received: from elstar.local (elstar.jacobs.jacobs-university.de [10.50.231.133]) by hermes.jacobs-university.de (Postfix) with ESMTP id ACA7320C12; Thu, 28 Apr 2011 13:40:40 +0200 (CEST)
Received: by elstar.local (Postfix, from userid 501) id 7A3221835A25; Thu, 28 Apr 2011 13:40:38 +0200 (CEST)
Date: Thu, 28 Apr 2011 13:40:38 +0200
From: Juergen Schoenwaelder <j.schoenwaelder@jacobs-university.de>
To: Paul Kyzivat <pkyzivat@cisco.com>
Message-ID: <20110428114038.GB1926@elstar.local>
Mail-Followup-To: Paul Kyzivat <pkyzivat@cisco.com>, iesg@ietf.org, secdir@ietf.org, draft-ietf-sipping-sip-offeranswer.all@tools.ietf.org, presnick@qualcomm.com
References: <20110422114517.GA2512@elstar.local> <4DB8B27D.1090100@cisco.com>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
In-Reply-To: <4DB8B27D.1090100@cisco.com>
User-Agent: Mutt/1.5.21 (2010-09-15)
Cc: presnick@qualcomm.com, iesg@ietf.org, draft-ietf-sipping-sip-offeranswer.all@tools.ietf.org, secdir@ietf.org
Subject: Re: [secdir] secdir review of draft-ietf-sipping-sip-offeranswer-14.txt
X-BeenThere: secdir@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
Reply-To: Juergen Schoenwaelder <j.schoenwaelder@jacobs-university.de>
List-Id: Security Area Directorate <secdir.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/secdir>, <mailto:secdir-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/secdir>
List-Post: <mailto:secdir@ietf.org>
List-Help: <mailto:secdir-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/secdir>, <mailto:secdir-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 28 Apr 2011 11:40:43 -0000
On Wed, Apr 27, 2011 at 08:19:09PM -0400, Paul Kyzivat wrote: > >However, these references raise a procedural question. It seems all > >these relevant specifications are on the standards track while this > >clarification, which tries to handle situations that can lead to > >"failed or degraded calls", is submitted as an Informational document. > >Should this not be standards track, formerly updating the relevant > >RFCs? I see in the IESG writeup that this has been discussed before, > >the proposed move to publish this as Informational still sounds > >surprising to me as an outsider. If there is consensus to resolve the > >ambiguities as described in the document, then why not via a > >standards-track action? Or is the idea that this resolution simply > >can be ignored or that something very different might be invented? > >That latter would more speak for Experimental then. > > We have been around this track several times. We decided this > approach was the most appropriate one for these issues. The > following message is part of one of the more recent threads on the > topic. > > http://www.ietf.org/mail-archive/web/rai/current/msg00833.html I followed the URL but all I could see was that this question was raised and discussed before. I still miss the convincing argument why this should be Informational and not standards-track or Experimental. Perhaps you have another pointer where this becomes clear? > >Getting back to security considerations, if the intention is not to > >require implementations to follow the disambiguation described in the > >document (that is not moving to standards-track), can malware exploit > >the fact that the underlying RFCs allow for ambiguities to cause > >"failed or degraded calls"? > > The participants in the SIP offer/answer exchange presumably *want* > the exchange to succeed. If not, there are a multitude of things > they can do to make the call fail or degrade. This sounds a bit like "a not well behaving client has other ways to cause damage, so we do not have to worry much about this way to cause damage", which I find not a very convincing approach. Anyway, I am probably a bit picky here since this document is intended to be informational, so any standards compliant implementation can ignore this specification and hence use standards track compliant mechanisms to cause failed or degraded calls. > SIP already provides mechanisms to protect the offer/answer exchange > from tampering by 3rd parties. For instance: > > Enhancements for Authenticated Identity Management > in the Session Initiation Protocol (SIP) > http://tools.ietf.org/html/rfc4474 > > Section 26.3.2 Security Solutions of RFC 3261 > http://datatracker.ietf.org/doc/rfc3261/ > > If the participants choose to ignore those mechanisms, then again > there are many things that a third party can do to degrade the call. Then this should probably be mentioned in the Security Considerations. Right now, there is no reference to RFC 4474 at all. So if that one is relevant to prevent tampering by 3rd parties, I would rather have this spelled out and a reference included. /js -- Juergen Schoenwaelder Jacobs University Bremen gGmbH Phone: +49 421 200 3587 Campus Ring 1, 28759 Bremen, Germany Fax: +49 421 200 3103 <http://www.jacobs-university.de/>
- [secdir] secdir review of draft-ietf-sipping-sip-… Juergen Schoenwaelder
- Re: [secdir] secdir review of draft-ietf-sipping-… Juergen Schoenwaelder
- Re: [secdir] secdir review of draft-ietf-sipping-… Paul Kyzivat