[Sip] DISCUSS on Service Route Discovery

The cool new ID tracker:

https://datatracker.ietf.org/public/pidtracker.cgi

shows that we have an IESG "Discuss" on the Service Route Discovery
draft:

http://www.ietf.org/internet-drafts/draft-ietf-sip-scvrtdisco-02.txt

which is currently in the "IESG Evaluation" phase of IETF Last Call.

The specific issues raised are:

---------------
The Security Considerations section is confusing, and (I think) wrong.

The first paragraph speaks of proxies modifying things.  This is indeed 
a threat.  But the end of that paragraph and the next speak of using 
transport security between proxies.  That does nothing against this 
threat -- the problem occurs from misbehavior by the authorized proxy.  
Transport security protects against MITM attacks, not nasty endpoints.

The note at the end of the second paragrap, suggesting S/MIME, is the 
correct answer against this threat.  Transport-level security might be 
useful against other threats.

I suspect that fixing the first sentence of Section 7 to speak of MITMs 
instead of proxies will clear up the confusion; the issue of 
misbehaving proxies can be described briefly in the second paragraph.

I'm also concerned that there's no mandatory-to-implement specified (or 
is S/MIME support required of Registrars elsewhere?).  If not, there 
should be some text somewhere mandating implementation of it, though 
(of course) not necessarily use; the current "SHOULD" language is 
sufficient.
---------------

The first problem is that we have intermingled MITM and misbehaving
proxies. This can be easily rectified, I think, as suggested in the 
DISCUSS.

The second concern seems to be more interesting. Is it reasonable to
mandate that registrars implementing the Service-Route header field also
MUST implement S/MIME? This doesn't say they have to USE it, just that
they must IMPLEMENT it. 

My personal feeling is that implementing this in a registrar is fairly
straightforward, and even the key management is easy, so it "does no
harm" to include as a MUST.

What do you think?

-- 
Dean Willis <dean.willis@softarmor.com>
_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use sip-implementors@cs.columbia.edu for questions on current sip
Use sipping@ietf.org for new developments on the application of sip