RE: [Sip] Reviewers for the sec-agree draft

["Vesa Torvinen (LMF)" <[e-mail]>]

Text in section 3.5 is supposed to address this issue: 

"If digest-integrity is chosen, the 494 (Security Agreement Required)
response will contain an HTTP authentication challenge. The client
MUST use the qos parameter possibly together with some variant of
MIME tunneling so that the Security-Verify header field in the
request is integrity protected in the MIME body. Note that digest
alone would not fulfill the minimum security requirements of this
specification."

We didn't want to specify how to use 'digest-integrity' exactly 
because this draft is related to negotiation - not individual 
mechanisms. Neither did we want to drop the mechanism from the 
list because someone can implement it using existing standards 
(e.g. MIME, B2BUA, etc). 

Vesa 

-----Original Message-----
From: James Undery [mailto:[e-mail]]
Sent: 21. toukokuuta 2002 17:01
To: Gonzalo Camarillo; sip
Cc: Jari Arkko (LMF); Vesa Torvinen (LMF)
Subject: RE: [Sip] Reviewers for the sec-agree draft


Hi,

I'll have to admit myself of being guilty of not reading drafts
recently. But I'd note digest-integrity needs to be dropped as it
protects the body of messages only. If it can't be dropped a lpidf like
extension would be required 
(http://www.jdrosen.net/papers/draft-rosenberg-impp-lpidf-00.txt) to
place your headers in the body.

James

> -----Original Message-----
> From: Gonzalo Camarillo [mailto:[e-mail]]
> Sent: 21 May 2002 11:02
> To: sip
> Cc: Allison Mankin; Jari Arkko (LMF); Vesa Torvinen (LMF)
> Subject: [Sip] Reviewers for the sec-agree draft
> 
> 
> Hello folks,
> 
> we need SIP people willing to have a look at the new version 
> (01) of the
> sec-agree draft (released one week and a half ago).
> 
> http://standards.ericsson.net/gonzalo/papers/draft-ietf-sip-se
> c-agree-01.txt
> 
> As you proabbly know, the previous version (00) had some problems that
> were discovered during the iterim meeting in Vegas. The discovery of
> problems (such as a broken SIP syntax) at that point of time 
> (after the
> WGLC had finished) indicates that nobody in the SIP WG 
> bothered to read
> the document.
> 
> I am not saying that this draft is so interesting that everyone will
> enjoy reading it, but we would need at least a couple of 
> reviewers that
> are familiar with SIP and have the energy to review the document. We
> cannot let the SIP WG send documents to the IESG that have 
> major flaws!
> 
> 
> Here you have a brief summary of the changes we introduced to the new
> version of the draft (01):
> 
> The syntax has been fixed. Now it is allowed to have 
> different security
> mechanisms listed (separated by commas or in different lines). The
> previous draft used commas to separate security mechanism tokens. That
> made the header field non-SIP compliant.
> 
> The scope has been narrowed down. Before, the draft tried to 
> solve every
> security negotiation problem that could be found in a SIP network. Now
> the draft only tries to resolve the security negotiation 
> between a host
> and its next SIP hop (e.g., UA and the outbound proxy).
> 
> 
> The negotiation works as follows. The UA sends a SIP message 
> (typically
> OPTIONS) to its outbound proxy listing its security 
> capabilities (e.g.,
> TLS and IPSec). The outbound proxy sends a response with its own
> capabilities (it is important that the list in the server is static).
> With this information, client and server initiate the 
> security mechanims
> (e.g., initiate a TLS conection).
> 
> When the client sends another SIP message to the outbound proxy, this
> time using the TLS connection, it includes a header field 
> that contains
> the list obtained previously from the server. This way, the server can
> check whether a MitM changes the list in order to perform a bid-down
> attack.
> 
> Of course, this security negotiation mechanism requires that all the
> security mechanisms advertised provide integrity protection, at least.
> 
> Thank you,
> 
> Gonzalo
> -- 
> Gonzalo Camarillo         Phone :  [phone]
> Oy L M Ericsson Ab        Mobile:  [phone]
> Telecom R&D               Fax   :  [phone]
> FIN-02420 Jorvas          Email :  [e-mail]
> Finland                   http://www.hut.fi/~gonzalo
> 
> _______________________________________________
> Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
> This list is for NEW development of the core SIP Protocol
> Use [e-mail] for questions on current sip
> Use [e-mail] for new developments on the application of sip
> 

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [e-mail] for questions on current sip
Use [e-mail] for new developments on the application of sip