RE: [Sip] draft-ietf-sip-sips-03.txt: Closing of Opened issues

["Samir Srivastava" <[e-mail]>]

Hi,

The refernece draft mentions in the section 4 that SIPS can be used with
DTLS.

Whereas 3261 has tied SIPS to SIP over TLS.

While 3261 mentions in section 4, page 10

"An example would be sips:[e-mail].  A call
   made to a SIPS URI guarantees that secure, encrypted transport
   (namely TLS) is used to carry all SIP messages from the caller to the
   domain of the callee"

"3261/ Section 19.1 SIP and SIPS Uniform Resource Indicators"  states

"A SIPS URI specifies that the resource be contacted securely.  This
   means, in particular, that TLS is to be used between the UAC and the
   domain that owns the URI."

So my objection was with reference to 3261, which your draft attempt to
clarify what SIPS means. The above text specifically states TLS only. So
it will be better to clarify the above. And give reference to the
mentioned draft.

Also on the related note on the defintion of transport parameter of the
referenced draft
   transport         =  "UDP" / "TCP" / "TLS" / "SCTP" / "TLS-SCTP"
                        "DTLS-DCCP" / "DTLS-UDP"
                        / other-transport


Transport attempts to put DTLS-DCCP but there is no separate DCCP . And
a related question why cannot we have TLS-TCP instead of implicitly
meaning that. Is it just the backward compatibility to 3261.

I would rather have a parameter 

Secure-Protocol = TLS/DTLS/ etc 
Transport = TCP/UDP/DCCP/SCTP/ ...
Instead of clubbing them together and having all permutations .. Bad
modeling.

Now I have still my biggest burning question. If IPSEC tunnel exists
between two SIP addressable entities, we have encryption twice. What
kind of application will shape in future (I don't have idea), where they
might want to tunnel all traffic through a single IPSEC tunnel. Don't we
need some more secure awareness in the application protocol SIP.

Thx
Samir

>-----Original Message-----
>From: Audet, Francois (SC100:3055) 
>Sent: Thursday, April 26, 2007 2:29 PM
>To: Dean Willis; Juha Heinanen
>Cc: [e-mail]
>Subject: RE: [Sip] draft-ietf-sip-sips-03.txt: Closing of Opened issues
>
> 
>> > tell me, why is tls (instead of tcp) needed in via when uri
>> scheme is
>> > sips?  cannot tls/tcp be concluded if transport is tcp and
>> uri scheme
>> > is sips.
>> 
>> I've always wondered about this one myself. What about TLS/SCTP and 
>> DTLS, which might serve as transports for SIPS?
>
>VIA already supports SCTP, TLS-SCTP. And the draft provides 
>the references to RFC 4168 that defines it.
>
>DTLS is defined in
>http://tools.ietf.org/wg/sip/draft-jennings-sip-dtls-03.txt.
>
>On the question of "why we are using VIA in the first place?" 
>instead or replying to where the request came from, well, I 
>don't know. It wasn't me who wrote RFC 3261. This is a widely 
>known characteristic described in RFC 3581.
>
>It's completly out of scope of this draft. 
>
>
>
>
>
>
>_______________________________________________
>Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
>This list is for NEW development of the core SIP Protocol Use 
>[e-mail] for questions on current sip 
>Use [e-mail] for new developments on the application of sip
>


_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [e-mail] for questions on current sip
Use [e-mail] for new developments on the application of sip