Re: [sipcore] SASL Authentication for SIP

[Rick van Rein <[e-mail]>]

Hello Olle,

Thanks for explaining.

> For inter-domain trust there’s been a few attempts, SIP identity was one
> that is now replaced by the work in stir/shaken that focus a lot on
> old-fashioned telephone numbers and the problems related with that.

Since SASL is in most protocols, we built a general Realm Crossover
implementation for it in draft-vanrein-diameter-sasl -- this works on
existing protocols that use SASL.  There are a few more that benefit
from having this added to them.  This is how I wrote the SIP-SASL
draft as an isolated addition of SASL authentication to SIP.

By creating SIP setup with Wireguard, I am hoping to benefit from
Realm Crossover, thus allowing anyone to setup a VPN to anyone.

> There’s no SIP police. At least I can’t say if there is one or not. ;-)
> [...] But if you want other implementers
> to pick up your work, you want to convince us to work with you
> and get an RFC published. The outcome may be different 
> from your original idea, but that is quite often a good thing.

Makes sense, thanks for showing the balance of concerns.

> You start with the solution. I may have missed it, but I don’t
> see a definition of the problem you are trying to solve.

 - Realm Crossover across protocols
 - No changes to the majority of protocols
 - Decent integration with a few protocols that cannot use SASL yet
 - ...
 - VPN setup with Wireguard, using SIP/SDP

> I need to read your document in more detail to understand,
> but reading this, I don’t see how SASL is the solution to
> what you describe here.

The real trick is the integration with pretty much all other
protocols.

SASL is helpful because some mechanisms can derive a key
that was not shown on the wire (not even as ECDH) and so
are not vulnarable to quantum computer attacks.  Mixing
such keys in with an ECDH exchange is a good mechanism to
protect from future problems or retrospective decryption.
This is useful for a VPN, as well as for telephony.

> Do you want to use SIP offer/answer to set up a 
> peer 2 peer VPN using wireguard? Like we currently
> use it to set up RTP streams between user agents?

Yes; not over RTP/AVP but over udp, using SDP like

    v=0
    o=- 4280564478 1563511013 IN IP6 2001:db8:666::666
    s=-
    c=IN IP6 2001:db8:666::666
    t=0 0
    m=application 0 udp vnd.wireguard
    a=fmtp:vnd.wireguard pubkey=;prefix=2001:db8:456:1::/64;pskmth=none
    a=sendrecv

I have this working for localhost tunnels; code, man page:

https://gitlab.com/0cpm/subliminal/-/blob/master/src/wgsip.c
https://gitlab.com/0cpm/subliminal/-/blob/master/doc/man/wgsip.1

The "pskmth" would be a PSK exchange method name, to be filled
with a key derivation method, like manual keys and SASL.

(I never know how much to tell upfront, tastes differ, sorry
 if that triggers questions.)


Cheers,
 -Rick