Re: [secdir] SecDir review of draft-ietf-sipcore-sip-websocket-08

[Iñaki Baz Castillo <[e-mail]>]

2013/4/15 Yaron Sheffer <[e-mail]>:
> Hi again,
>
> Yes, I agree with your plan for moving forward. A few remaining comments:
>
> - Unless I missed something, you only talked about authentication of the
> client, and did not mention authentication of the server to the client. From
> the point of view of the client (and customer?) this is just as important.

Nothing prevents a SIP WebSocket client to request authentication for
an incoming request. Is it OK if the draft also mentions it in the
appropriate section?



> - Unfortunately we rarely have usable client auth with TLS. I wish we had
> something better than client certificates. In fact there are some
> implementations of RFC 5054 out there, and it would be great if you could
> accommodate them as well.

Great. Would it be ok by mentioning such a security mechanism it in
the Security section?



> - I would advise you take the draft back to the WG to have these changes
> more thoroughly reviewed. I would be more than happy to review the new
> draft, too.

Thanks a lot. We will publish a new revision with the requested improvements.



--
Iñaki Baz Castillo
<[e-mail]>