RE: [Sip] End-to-end security for DTLS-SRTP (FW: I-DAction:draft-fischer-sip-e2e-sec-media-00.txt)

["Dan Wing" <[e-mail]>]

I like this draft, and it solves a very real problem:  providing identity for
SIP requests that traverse B2BUAs and traverse SBCs.

-d

> -----Original Message-----
> From: Fischer, Kai [mailto:[e-mail]] 
> Sent: Wednesday, January 23, 2008 1:34 AM
> To: [e-mail]
> Subject: [Sip] End-to-end security for DTLS-SRTP (FW: 
> I-DAction:draft-fischer-sip-e2e-sec-media-00.txt)
> 
> Hi,
> I have submitted a draft proposing a solution to secure a DTLS-SRTP
> handshake and hence SRTP end-to-end (in terms of end-domain to
> end-domain). As discussed during the last IETF meetings and 
> analyzed by
> Dan's Identity-Media draft, current solutions like SIP Identity do not
> protect the authenticity of the fingerprint end-to-end in certain
> inter-domain scenarios. For example, a modification of SDP 
> m-/c-lines or
> the From header field by intermediaries breaks the SIP-Identity or
> Identity-Media signature and causes a re-signing by a domain different
> to the originating one. The draft proposes a solution for 
> such scenarios
> without the need to re-sign during domain traversal and which 
> preserves
> the original identity information.
> 
> I appreciate your comments and opinions to the draft and the proposed
> solution.
> 
> Kai
> 
> 
> > -----Original Message-----
> > From: [e-mail] [mailto:[e-mail]] 
> > Sent: Mittwoch, 23. Januar 2008 10:20
> > To: [e-mail]
> > Subject: I-D Action:draft-fischer-sip-e2e-sec-media-00.txt 
> > 
> > A New Internet-Draft is available from the on-line 
> > Internet-Drafts directories.
> > 
> > 	Title           : End-to-End Security for DTLS-SRTP
> > 	Author(s)       : K. Fischer
> > 	Filename        : draft-fischer-sip-e2e-sec-media-00.txt
> > 	Pages           : 14
> > 	Date            : 2008-01-23
> > 
> > The end-to-end security properties of DTLS-SRTP depend on the
> > authenticity of the certificate fingerprint exchanged in the
> > signalling channel.  In current approaches the authenticity is
> > protected by SIP-Identity or SIP-Identity-Media.  These types of
> > signatures are broken if intermediaries like Session Border
> > Controllers in other domains change specific information of the SIP
> > header or the SIP body.  The end-to-end security property 
> between the
> > originating and terminating domain is lost if these intermediaries
> > re-sign the SIP message and create a new identity signature using
> > their own domain credentials.
> > 
> > This document defines a new signature type 'Fingerprint-Identity'
> > which is exchanged in the signalling channel.  Fingerprint-Identity
> > covers only those elements of a SIP message necessary to 
> authenticate
> > the certificate fingerprint and to secure media end-to-end.  It is
> > independent from SIP-Identity and SIP-Identity-Media and can be
> > applied in parallel to them.
> > 
> > A URL for this Internet-Draft is:
> > http://www.ietf.org/internet-drafts/draft-fischer-sip-e2e-sec-
> > media-00.txt
> > 
> > To remove yourself from the I-D Announcement list, send a message to
> > [e-mail] with the word unsubscribe in 
> > the body of 
> > the message.
> > You can also visit 
> https://www1.ietf.org/mailman/listinfo/I-D-announce
> > to change your subscription settings.
> > 
> > Internet-Drafts are also available by anonymous FTP. Login with the 
> > username "anonymous" and a password of your e-mail address. After 
> > logging in, type "cd internet-drafts" and then
> > 	"get draft-fischer-sip-e2e-sec-media-00.txt".
> > 
> > A list of Internet-Drafts directories can be found in
> > http://www.ietf.org/shadow.html
> > or ftp://ftp.ietf.org/ietf/1shadow-sites.txt
> > 
> > Internet-Drafts can also be obtained by e-mail.
> > 
> > Send a message to:
> > 	[e-mail].
> > In the body type:
> > 	"FILE /internet-drafts/draft-fischer-sip-e2e-sec-media-00.txt".
> > 
> > NOTE:   The mail server at ietf.org can return the document in
> > 	MIME-encoded form by using the "mpack" utility.  To use this
> > 	feature, insert the command "ENCODING mime" before the "FILE"
> > 	command.  To decode the response(s), you will need "munpack" or
> > 	a MIME-compliant mail reader.  Different MIME-compliant 
> > mail readers
> > 	exhibit different behavior, especially when dealing with
> > 	"multipart" MIME messages (i.e. documents which have been split
> > 	up into multiple messages), so check your local documentation on
> > 	how to manipulate these messages.
> > 
> > Below is the data which will enable a MIME compliant mail reader
> > implementation to automatically retrieve the ASCII version of the
> > Internet-Draft.
> > 
> 



_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [e-mail] for questions on current sip
Use [e-mail] for new developments on the application of sip