Re: [Sip] New I-D on RFC4474 and phone numbers

["Elwell, John" <[e-mail]>]

Jonathan,

I agree with a lot of what this says. A few comments:

1. "Unfortunately, this problem is a FUNDAMENTAL PROPERTY OF PHONE
   NUMBERS.  No specifications or efforts on the part of IETF can fix
   this problem.  Phone numbers are fundamentally NOT scoped to a
   domain, and attempts to represent them in any other form are
   ultimately futile from an identification perspective."
But on the other hand, you can at least see what domain the request came
from, and if you trust that domain, this might be of value. The
particular value of the user part of the SIP URI may not be some
important, in some scenarios, as the domain part. This seems to be
acknowledged later when it talks about the "second model".

2. "However, in the second model, intermediate domains do not resign
   requests.  Furthermore, UA's utilize white lists and black lists of
   domains that are known to be trustworthy (or not).  Today, such lists
   do exist and are provided for email spam.  One can imagine a UA
   contacting such a service periodically, or upon an incoming call, to
   verify the signing domain against the list."
Or maybe the user is expecting a call from a particular domain (e.g.,
his bank) or answers the call and the caller announces that he/she is
from the bank. Of maybe the user has called his bank and uses
connected-identity to ensure that he really is connected to his bank.
These all seems to be situations akin to the second model with some
practical benefit.

3. "Thus, DTLS-SRTP still provides better security than Sdescriptions.
   However, when used with phone numbers, it is by no means ideal.  Most
   importantly, it does NOT provide guarantees that intermediaries have
   not been able to intercept and decrypt the media."
Not true. If you use DTLS-SRTP with RFC 4474 and an E.164 number in the
SIP URI, it DOES provide a guarantee that intermediaries between the
domain in the SIP URI and the UAS are unable to intercept and decrypt
media. This seems to be of value in some situations.

John



> -----Original Message-----
> From: [e-mail] [mailto:[e-mail]] On 
> Behalf Of Jonathan Rosenberg
> Sent: 18 February 2008 05:07
> To: IETF SIP List
> Subject: [Sip] New I-D on RFC4474 and phone numbers
> 
> I just submitted:
> http://www.ietf.org/internet-drafts/draft-rosenberg-sip-rfc447
> 4-concerns-00.txt
> 
> This is basically a discussion on the security properties of rfc4474 
> with phone numbers, and a comparison to rfc3325 in this case. Also a 
> discussion on what happens to dtls-srtp.
> 
> Comments welcome.
> 
> -Jonathan R.
> -- 
> Jonathan D. Rosenberg, Ph.D.                   499 Thornall St.
> Cisco Fellow                                   Edison, NJ 08837
> Cisco, Voice Technology Group
> [e-mail]
> http://www.jdrosen.net                         PHONE: [phone]
> http://www.cisco.com
> _______________________________________________
> Sip mailing list  http://www.ietf.org/mailman/listinfo/sip
> This list is for NEW development of the core SIP Protocol
> Use [e-mail] for questions on current sip
> Use [e-mail] for new developments on the application of sip
> 
_______________________________________________
Sip mailing list  http://www.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [e-mail] for questions on current sip
Use [e-mail] for new developments on the application of sip