Re: [secdir] Security review of draft-ietf-cuss-sip-uui-isdn-08

["DRAGE, Keith (Keith)" <[e-mail]>]

Our proposal is to delete the offending sentence in the first paragraph of the security considerations. We spent some time trying to work out why this sentence was written in the first place, and it goes back to the very early days of the author draft. We could not remember. The text makes more sense without this sentence.

Keith 

> -----Original Message-----
> From: Hilarie Orman [mailto:[e-mail]] 
> Sent: 11 May 2014 19:18
> To: [e-mail]; [e-mail]; 
> [e-mail]
> Subject: Security review of draft-ietf-cuss-sip-uui-isdn-08
> 
> Security review of draft-ietf-cuss-sip-uui-isdn-08 
> Interworking ISDN Call Control User Information with SIP
> 
> Do not be alarmed.  I have reviewed this document as part of 
> the security directorate's ongoing effort to review all IETF 
> documents being processed by the IESG.  These comments were 
> written primarily for the benefit of the security area 
> directors.  Document editors and WG chairs should treat these 
> comments just like any other last call comments.
> 
> This document defines a usage (a new package) of the SIP 
> User-to-User header field to enable interworking with ISDN 
> services transporting the ITU-T DSS1 User-user information 
> data element and is limited to the ISDN UUS1 implicit 
> supplementary service.  Because the element may contain 
> information related to user privacy, one should consider the 
> impact of transmitting it in this context.
> 
> The document begins by noting the the User-to-User header 
> field is defined in "A Mechanism for Transporting User to 
> User Call Control Information in SIP" 
> (draft-ietf-cuss-sip-uui-16).  That document notes security 
> requirements deriving from an earlier document, RFC6567 SIP 
> UUI Reqs, which states:
> 
>   The next three requirements capture the UUI security requirements.
>    REQ-13: The mechanism will allow integrity protection of the UUI.
>    ...
>    REQ-14: The mechanism will allow end-to-end privacy of the UUI.
>    ...
> 
>    REQ-15: The mechanism will allow both end-to-end and hop-by-hop
>    security models.
>    ...
> 
> The document under review and draft-ietf-cuss-sip-uui-16 note 
> that because ISDN offers only hop-by-hop security, the SIP 
> UAs must provide any necessary authenticity, integrity and 
> privacy protection for sensitive parts of the UUI.
> 
> It is not clear to me if the SIP endpoints are aware of 
> intermediary ISDNs, nor if they might be unaware of the ISDN 
> transit and thus misled into thinking that the SIP 
> infrastructure provided adequate security controls for the 
> protection of UUI data.
> 
> The document gives the guidance that "data that is used to 
> assist in selecting which SIP UA should respond to the call 
> would not be expected to carry any higher level of security 
> than a media feature tag".  I'm not sure how to interpret 
> that.  When should the "level of security" be expected to be 
> lower than a media feature tag?  Or does it mean something 
> else, like: (a) the data should not be more sensitive than 
> that in a media feature tag or (b) the data should be 
> protected (authenticity, integrity, privacy) to at least the 
> level of a media feature tag or (c) the UUI data and the 
> media feature tag data are so similar that they should have 
> the same level of protection?
> 
> That's my impression from reading over the security considerations.
> My apologies if I've missed the point.
> 
> Hilarie
> 
> 
> 
> 
> 
>