RE: [Sip] Reviewers for the sec-agree draft

["James Undery" <[e-mail]>]

Hi,

I'll have to admit myself of being guilty of not reading drafts
recently. But I'd note digest-integrity needs to be dropped as it
protects the body of messages only. If it can't be dropped a lpidf like
extension would be required 
(http://www.jdrosen.net/papers/draft-rosenberg-impp-lpidf-00.txt) to
place your headers in the body.

James

> -----Original Message-----
> From: Gonzalo Camarillo [mailto:[e-mail]]
> Sent: 21 May 2002 11:02
> To: sip
> Cc: Allison Mankin; Jari Arkko (LMF); Vesa Torvinen (LMF)
> Subject: [Sip] Reviewers for the sec-agree draft
> 
> 
> Hello folks,
> 
> we need SIP people willing to have a look at the new version 
> (01) of the
> sec-agree draft (released one week and a half ago).
> 
> http://standards.ericsson.net/gonzalo/papers/draft-ietf-sip-se
> c-agree-01.txt
> 
> As you proabbly know, the previous version (00) had some problems that
> were discovered during the iterim meeting in Vegas. The discovery of
> problems (such as a broken SIP syntax) at that point of time 
> (after the
> WGLC had finished) indicates that nobody in the SIP WG 
> bothered to read
> the document.
> 
> I am not saying that this draft is so interesting that everyone will
> enjoy reading it, but we would need at least a couple of 
> reviewers that
> are familiar with SIP and have the energy to review the document. We
> cannot let the SIP WG send documents to the IESG that have 
> major flaws!
> 
> 
> Here you have a brief summary of the changes we introduced to the new
> version of the draft (01):
> 
> The syntax has been fixed. Now it is allowed to have 
> different security
> mechanisms listed (separated by commas or in different lines). The
> previous draft used commas to separate security mechanism tokens. That
> made the header field non-SIP compliant.
> 
> The scope has been narrowed down. Before, the draft tried to 
> solve every
> security negotiation problem that could be found in a SIP network. Now
> the draft only tries to resolve the security negotiation 
> between a host
> and its next SIP hop (e.g., UA and the outbound proxy).
> 
> 
> The negotiation works as follows. The UA sends a SIP message 
> (typically
> OPTIONS) to its outbound proxy listing its security 
> capabilities (e.g.,
> TLS and IPSec). The outbound proxy sends a response with its own
> capabilities (it is important that the list in the server is static).
> With this information, client and server initiate the 
> security mechanims
> (e.g., initiate a TLS conection).
> 
> When the client sends another SIP message to the outbound proxy, this
> time using the TLS connection, it includes a header field 
> that contains
> the list obtained previously from the server. This way, the server can
> check whether a MitM changes the list in order to perform a bid-down
> attack.
> 
> Of course, this security negotiation mechanism requires that all the
> security mechanisms advertised provide integrity protection, at least.
> 
> Thank you,
> 
> Gonzalo
> -- 
> Gonzalo Camarillo         Phone :  [phone]
> Oy L M Ericsson Ab        Mobile:  [phone]
> Telecom R&D               Fax   :  [phone]
> FIN-02420 Jorvas          Email :  [e-mail]
> Finland                   http://www.hut.fi/~gonzalo
> 
> _______________________________________________
> Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
> This list is for NEW development of the core SIP Protocol
> Use [e-mail] for questions on current sip
> Use [e-mail] for new developments on the application of sip
> 

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [e-mail] for questions on current sip
Use [e-mail] for new developments on the application of sip