Re: [sipcore] No WebSocket level authentication scenario [was RE: I-D Action: draft-ietf-sipcore-sip-websocket-09.txt]

Paul,

In case it is not mandatory to use authentication, the following statement
in Sec 7 of the draft is not correct:

"  If no authentication is done at WebSocket level then SIP Digest
   authentication is required for every SIP request coming over the
   WebSocket connection."

Please let me know your comment on the same.

Thanks
Partha

> -----Original Message-----
> From: sipcore-bounces@ietf.org [mailto:sipcore-bounces@ietf.org] On
> Behalf Of Paul Kyzivat
> Sent: Thursday, June 20, 2013 9:37 PM
> To: sipcore@ietf.org
> Subject: Re: [sipcore] No WebSocket level authentication scenario [was
> RE: I-D Action: draft-ietf-sipcore-sip-websocket-09.txt]
> 
> On 6/19/13 8:06 AM, DRAGE, Keith (Keith) wrote:
> > I would not use RFC 3261 as justification for what should, or should
> not, be said about authentication. The current RFC 3261 would probably
> fail a security directorate review if it was attempted to be approved
> as an RFC now.
> >
> > (I'd also point out that for any security consideration of RFC 3261,
> one should also read RFC 5630.)
> >
> > So I would suggest you conduct an independent security evaluation of
> what is needed.
> 
> I think we are in the midst of one with Stephen Farrell.
> 
> > For the use case you give:
> >
> >> A website (a shop) offers a widget in which the visitor can click
> and
> >> made a SIP call (+WebRTC) that will end in the callcenter of the
> >> company, answered by an agent that will inform the user about the
> >> product he is interested in. Why do we require WWW or SIP
> >> authentication in this scenario?
> >
> > I'd suggest that the issue to be discussed is what happens when the
> action described results in a transaction of some form to a third party
> (in the SIP case a call). The visitor then includes information that
> will be relayed to the third party. Who does the third party rely on to
> ensure that information is authentically given by the visitor.
> 
> I'm inclined to support Iñaki, that authentication of any sort
> shouldn't
> be Mandatory to *Use*.  Individual applications can decide when they
> have uses that require authentication and when they don't.
> 
> 	Thanks,
> 	Paul
> 
> > Regards
> >
> > Keith
> >
> >
> >
> >> -----Original Message-----
> >> From: sipcore-bounces@ietf.org [mailto:sipcore-bounces@ietf.org] On
> Behalf
> >> Of Iñaki Baz Castillo
> >> Sent: 19 June 2013 12:32
> >> To: Saúl Ibarra Corretgé
> >> Cc: SIPCORE (Session Initiation Protocol Core) WG; Parthasarathi R
> >> Subject: Re: [sipcore] No WebSocket level authentication scenario
> [was RE:
> >> I-D Action: draft-ietf-sipcore-sip-websocket-09.txt]
> >>
> >> 2013/6/19 Saúl Ibarra Corretgé <saul@ag-projects.com>:
> >>> Why is authentication a MUST? Lets assume that I'm using UDP and my
> >> proxy establishes a WS connection with a foreign domain's proxy
> because of
> >> NAPTR and my proxy supports acting as a WS client. It obviously
> won't be
> >> able to authenticate. If this scenario supposed to be covered?
> >>
> >> Honestly I agree. I cannot find in RFC 3261 (or other RFCs) a
> >> normative statement mandating authentication, regardless the request
> >> comes from a UA.
> >>
> >> In another thread we are discussing about MTI authentication
> >> mechanisms that must be implemented by SIP WS Clients and Servers.
> >> IMHO that is correct, but mandating SIP authentication or WWW
> >> authentication for ALL the scenarios seem innapropriate for me. I
> come
> >> back to an use case:
> >>
> >> A website (a shop) offers a widget in which the visitor can click
> and
> >> made a SIP call (+WebRTC) that will end in the callcenter of the
> >> company, answered by an agent that will inform the user about the
> >> product he is interested in. Why do we require WWW or SIP
> >> authentication in this scenario?
> >>
> >> If WG agrees with this, I will remove the normative statements in
> >> "Authentication" section, and instead address the MTI authentication
> >> mechanisms.
> >>
> >>
> >> --
> >> Iñaki Baz Castillo
> >> <ibc@aliax.net>
> >> _______________________________________________
> >> sipcore mailing list
> >> sipcore@ietf.org
> >> https://www.ietf.org/mailman/listinfo/sipcore
> > _______________________________________________
> > sipcore mailing list
> > sipcore@ietf.org
> > https://www.ietf.org/mailman/listinfo/sipcore
> >
> 
> _______________________________________________
> sipcore mailing list
> sipcore@ietf.org
> https://www.ietf.org/mailman/listinfo/sipcore