Re: [secdir] secdir review of draft-roach-sip-http-subscribe-06

[Adam Roach <[e-mail]>]

On 7/22/64 13:59, Jul 22, Tina TSOU wrote:
> 1) It is possible that the message/http NOTIFY message bodies may 
> contain sensitive information. This is related to the statement at the 
> end of the existing Security Considerations text that care should be 
> taken to apply the same controls over access to entity information to 
> SIP/SIPS subscribers as to users using other protocols. Additional 
> text in the Security Considerations section should point out that if 
> the NOTIFY requests may return sensitive information, that information 
> should be protected in transit by, for example, requiring that the 
> subscription use SIPS rather than SIP.
>
> 2) Along with this, some reference to RFC 5630 might be valuable, both 
> to indicate the limitations of SIPS and to indicate how it should be 
> implemented.

Thanks for catching this. I propose adding the following text to the 
Security section as a final paragraph:

    Similarly, if the HTTP resource is encrypted or integrity protected
    in transit -- for example, by using HTTP over TLS [12] -- then the
    SIP means of subscribing to the HTTP resource MUST also have
    appropriate encryption or integrity protection applied.  Examples of
    mechanisms for providing such protection include the use of the SIPS
    URI scheme [17], and the use of S/MIME bodies [13].


With the cited references:

    [12]  Rescorla, E., "HTTP Over TLS", RFC 2818, May 2000.

    [13]  Ramsdell, B., "Secure/Multipurpose Internet Mail Extensions
          (S/MIME) Version 3.1 Message Specification", RFC 3851,
          July 2004.

    [17]  Audet, F., "The Use of the SIPS URI Scheme in the Session
          Initiation Protocol (SIP)", RFC 5630, October 2009.


/a