RE: [Sip] Reviewers for the sec-agree draft

> -----Original Message-----
> From: Vesa Torvinen (LMF) [mailto:Vesa.Torvinen@lmf.ericsson.se]
> Sent: 21 May 2002 15:26
> To: James Undery
> Cc: Jari Arkko (LMF); Gonzalo Camarillo Gonzalez (LMF); sip
> Subject: RE: [Sip] Reviewers for the sec-agree draft
> 
> 
> Text in section 3.5 is supposed to address this issue: 
> 
> "If digest-integrity is chosen, the 494 (Security Agreement Required)
> response will contain an HTTP authentication challenge. The client
> MUST use the qos parameter possibly together with some variant of

The word possibly above worries me, it'd also be nice to make the
mechanism explicit e.g. 'sipfrags' as Sanjoy suggested.

> MIME tunneling so that the Security-Verify header field in the
> request is integrity protected in the MIME body. Note that digest
> alone would not fulfill the minimum security requirements of this
> specification."
> 
> We didn't want to specify how to use 'digest-integrity' exactly 
> because this draft is related to negotiation - not individual 
> mechanisms. Neither did we want to drop the mechanism from the 
> list because someone can implement it using existing standards 
> (e.g. MIME, B2BUA, etc). 

I think a small amount of usage is required e.g. S/MIME protection MUST
include any Security-* headers present. (This is mainly implicit at the
moment.)

James

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use sip-implementors@cs.columbia.edu for questions on current sip
Use sipping@ietf.org for new developments on the application of sip