Re: [sipcore] No WebSocket level authentication scenario [was RE: I-D Action: draft-ietf-sipcore-sip-websocket-09.txt]

Thanks a lot Keith, it's clear. I will address it in next revision.

2013/6/19 DRAGE, Keith (Keith) <keith.drage@alcatel-lucent.com>:
> I would not use RFC 3261 as justification for what should, or should not, be said about authentication. The current RFC 3261 would probably fail a security directorate review if it was attempted to be approved as an RFC now.
>
> (I'd also point out that for any security consideration of RFC 3261, one should also read RFC 5630.)
>
> So I would suggest you conduct an independent security evaluation of what is needed.
>
> For the use case you give:
>
>> A website (a shop) offers a widget in which the visitor can click and
>> made a SIP call (+WebRTC) that will end in the callcenter of the
>> company, answered by an agent that will inform the user about the
>> product he is interested in. Why do we require WWW or SIP
>> authentication in this scenario?
>
> I'd suggest that the issue to be discussed is what happens when the action described results in a transaction of some form to a third party (in the SIP case a call). The visitor then includes information that will be relayed to the third party. Who does the third party rely on to ensure that information is authentically given by the visitor.
>
> Regards
>
> Keith
>
>
>
>> -----Original Message-----
>> From: sipcore-bounces@ietf.org [mailto:sipcore-bounces@ietf.org] On Behalf
>> Of Iñaki Baz Castillo
>> Sent: 19 June 2013 12:32
>> To: Saúl Ibarra Corretgé
>> Cc: SIPCORE (Session Initiation Protocol Core) WG; Parthasarathi R
>> Subject: Re: [sipcore] No WebSocket level authentication scenario [was RE:
>> I-D Action: draft-ietf-sipcore-sip-websocket-09.txt]
>>
>> 2013/6/19 Saúl Ibarra Corretgé <saul@ag-projects.com>:
>> > Why is authentication a MUST? Lets assume that I'm using UDP and my
>> proxy establishes a WS connection with a foreign domain's proxy because of
>> NAPTR and my proxy supports acting as a WS client. It obviously won't be
>> able to authenticate. If this scenario supposed to be covered?
>>
>> Honestly I agree. I cannot find in RFC 3261 (or other RFCs) a
>> normative statement mandating authentication, regardless the request
>> comes from a UA.
>>
>> In another thread we are discussing about MTI authentication
>> mechanisms that must be implemented by SIP WS Clients and Servers.
>> IMHO that is correct, but mandating SIP authentication or WWW
>> authentication for ALL the scenarios seem innapropriate for me. I come
>> back to an use case:
>>
>> A website (a shop) offers a widget in which the visitor can click and
>> made a SIP call (+WebRTC) that will end in the callcenter of the
>> company, answered by an agent that will inform the user about the
>> product he is interested in. Why do we require WWW or SIP
>> authentication in this scenario?
>>
>> If WG agrees with this, I will remove the normative statements in
>> "Authentication" section, and instead address the MTI authentication
>> mechanisms.
>>
>>
>> --
>> Iñaki Baz Castillo
>> <ibc@aliax.net>
>> _______________________________________________
>> sipcore mailing list
>> sipcore@ietf.org
>> https://www.ietf.org/mailman/listinfo/sipcore

-- 
Iñaki Baz Castillo
<ibc@aliax.net>