RE: [Sip] Reviewers for the sec-agree draft

["Sanjoy Sen"<[e-mail]>]

James,

The use of 'sipfrag' (draft-sparks-sip-mimetypes-03 or whatever is the
latest version) is assumed. But, I agree that it should be explicitly stated
for clarity.

Sanjoy

> -----Original Message-----
> From: James Undery [mailto:[e-mail]]
> Sent: Tuesday, May 21, 2002 9:01 AM
> To: Gonzalo Camarillo; sip
> Cc: Jari Arkko (LMF); Vesa Torvinen (LMF)
> Subject: RE: [Sip] Reviewers for the sec-agree draft
> 
> 
> Hi,
> 
> I'll have to admit myself of being guilty of not reading drafts
> recently. But I'd note digest-integrity needs to be dropped as it
> protects the body of messages only. If it can't be dropped a 
> lpidf like
> extension would be required 
> (http://www.jdrosen.net/papers/draft-rosenberg-impp-lpidf-00.txt) to
> place your headers in the body.
> 
> James
> 
> > -----Original Message-----
> > From: Gonzalo Camarillo [mailto:[e-mail]]
> > Sent: 21 May 2002 11:02
> > To: sip
> > Cc: Allison Mankin; Jari Arkko (LMF); Vesa Torvinen (LMF)
> > Subject: [Sip] Reviewers for the sec-agree draft
> > 
> > 
> > Hello folks,
> > 
> > we need SIP people willing to have a look at the new version 
> > (01) of the
> > sec-agree draft (released one week and a half ago).
> > 
> > http://standards.ericsson.net/gonzalo/papers/draft-ietf-sip-se
> > c-agree-01.txt
> > 
> > As you proabbly know, the previous version (00) had some 
> problems that
> > were discovered during the iterim meeting in Vegas. The discovery of
> > problems (such as a broken SIP syntax) at that point of time 
> > (after the
> > WGLC had finished) indicates that nobody in the SIP WG 
> > bothered to read
> > the document.
> > 
> > I am not saying that this draft is so interesting that everyone will
> > enjoy reading it, but we would need at least a couple of 
> > reviewers that
> > are familiar with SIP and have the energy to review the document. We
> > cannot let the SIP WG send documents to the IESG that have 
> > major flaws!
> > 
> > 
> > Here you have a brief summary of the changes we introduced 
> to the new
> > version of the draft (01):
> > 
> > The syntax has been fixed. Now it is allowed to have 
> > different security
> > mechanisms listed (separated by commas or in different lines). The
> > previous draft used commas to separate security mechanism 
> tokens. That
> > made the header field non-SIP compliant.
> > 
> > The scope has been narrowed down. Before, the draft tried to 
> > solve every
> > security negotiation problem that could be found in a SIP 
> network. Now
> > the draft only tries to resolve the security negotiation 
> > between a host
> > and its next SIP hop (e.g., UA and the outbound proxy).
> > 
> > 
> > The negotiation works as follows. The UA sends a SIP message 
> > (typically
> > OPTIONS) to its outbound proxy listing its security 
> > capabilities (e.g.,
> > TLS and IPSec). The outbound proxy sends a response with its own
> > capabilities (it is important that the list in the server 
> is static).
> > With this information, client and server initiate the 
> > security mechanims
> > (e.g., initiate a TLS conection).
> > 
> > When the client sends another SIP message to the outbound 
> proxy, this
> > time using the TLS connection, it includes a header field 
> > that contains
> > the list obtained previously from the server. This way, the 
> server can
> > check whether a MitM changes the list in order to perform a bid-down
> > attack.
> > 
> > Of course, this security negotiation mechanism requires that all the
> > security mechanisms advertised provide integrity 
> protection, at least.
> > 
> > Thank you,
> > 
> > Gonzalo
> > -- 
> > Gonzalo Camarillo         Phone :  [phone]
> > Oy L M Ericsson Ab        Mobile:  [phone]
> > Telecom R&D               Fax   :  [phone]
> > FIN-02420 Jorvas          Email :  [e-mail]
> > Finland                   http://www.hut.fi/~gonzalo
> > 
> > _______________________________________________
> > Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
> > This list is for NEW development of the core SIP Protocol
> > Use [e-mail] for questions on current sip
> > Use [e-mail] for new developments on the application of sip
> > 
> 
> _______________________________________________
> Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
> This list is for NEW development of the core SIP Protocol
> Use [e-mail] for questions on current sip
> Use [e-mail] for new developments on the application of sip
>