RE: [Sip] Requesting feedback on draft-dotson-sip-certificate-auth-01

Hi Steve,

having certificates for user registration over multiple hops on a
registrar seems an interesting approach. The possibility to have a local
authentication service on the user agent would help here, but in most
scenarios, the user agent itself will not possess the domain certificate
according to RFC4474.

Two comments to the transport of credentials. You mentioned that SIP
identity itself does not provide for certificate transport. We are
currently working on an update of a draft targeting a BCP for credential
transport in SIP using SIP identity
(http://www.ietf.org/internet-drafts/draft-fries-sip-identity-usage-bcp-
00.txt). Our draft also mentions the usage of SIP SAML to transport an
assertion or a reference to an assertion, which may be interesting in
your scenario as well. A SAML assertion could be provided by a local
server, which in turn may be used to register the UA. 

Ciao
    Steffen

________________________________

	From: Steve Dotson [mailto:S.Dotson@CableLabs.com] 
	Sent: Tuesday, November 21, 2006 6:35 PM
	To: IETF SIP List
	Subject: [Sip] Requesting feedback on
draft-dotson-sip-certificate-auth-01

	Some industries and organizations have invested in PKI, and thus
have certificates available for authentication. We would like to
leverage those credentials for SIP authentication. Using certificates
instead of UICCs or other credentials is attractive for certain
deployment models.
http://www.ietf.org/internet-drafts/draft-dotson-sip-certificate-auth-01
.txt describes some requirements related to this issue, as well as a
review of previous and related work. We have received good feedback
offline from authors of related work which were incorporated into the
latest draft.

	Thanks,

	Steve.