Re: [sipcore] New Version Notification for draft-ibc-sipcore-sip-websocket-00 (previously draft-ibc-rtcweb-sip-websocket-00)

[Gilad Shaham <[e-mail]>]

wss is used to secure a single hop, it does not ensure, at least based on
existing sip routing rules, that it will remain secure for the next hops.
My point is exactly this, it should be clear wss is not enough.

On Fri, Dec 2, 2011 at 8:57 PM, Avasarala, Ranjit <
[e-mail]> wrote:

> Hi Gilad
>
> Actually websockets have security option in wss:// option. Could that be
> used for ensuring security?
>
> Regards
> Ranjit
>
> -----Original Message-----
> From: [e-mail] [mailto:[e-mail]] On
> Behalf Of Gilad Shaham
> Sent: Friday, December 02, 2011 9:46 PM
> To: Victor Pascual Avila; SIPCORE (Session Initiation Protocol Core) WG
> Subject: Re: [sipcore] New Version Notification for
> draft-ibc-sipcore-sip-websocket-00 (previously
> draft-ibc-rtcweb-sip-websocket-00)
>
> Hi Victor,
>
> I followed the previous draft and read this one. I know that from the last
> draft you would like to refrain from sips issues, but I would expect it to
> be mentioned at the very least in the security section (13.1). If I'm
> reading the examples correctly they mean - use TLS for WebSocket, but from
> there forward use any transport, even unencrypted. I'm not sure everyone
> would realize that and personally, I don't see a problem sending sips to
> indicate it should be secure end-to-end as defined by RFC 5630.
>
> I'm also not so sure why the 'anonymous.invalid' strings are shown in this
> RFC for the Via and Contact headers. This usage is neither defined nor
> referenced anywhere other than the examples. If this specification doesn't
> mandate/recommend it I don't think it should be there, and if it does, it
> should be clearly defined (or reference another RFC that does).
>
> Hope it helps,
> Gilad
>
> -----Original Message-----
> From: Victor Pascual Avila
> Sent: Friday, December 02, 2011 5:33 PM
> To: SIPCORE (Session Initiation Protocol Core) WG
> Subject: Re: [sipcore] New Version Notification for
> draft-ibc-sipcore-sip-websocket-00 (previously
> draft-ibc-rtcweb-sip-websocket-00)
>
> The authors would appreciate any comments and suggestions on this new
> version.
>
> Many thanks in advance,
> -Victor
>
> On Sun, Nov 27, 2011 at 2:07 PM, Iñaki Baz Castillo <[e-mail]> wrote:
> > A new version of I-D, draft-ibc-sipcore-sip-websocket-00.txt has been
> > successfully submitted by Iñaki Baz Castillo and posted to the IETF
> > repository.
> >
> > Filename:        draft-ibc-sipcore-sip-websocket
> > Revision:        00
> > Title:           The WebSocket Protocol as a Transport for the Session
> > Initiation Protocol (SIP)
> > Creation date:   2011-11-24
> > WG ID:           Individual Submission
> > Number of pages: 27
> >
> > Abstract:
> >  This document specifies a WebSocket Sub-Protocol for a new transport
> > in SIP (Session Initiation Protocol).  The WebSocket protocol enables
> > two-way realtime communication between clients and servers.
> >
> >
> > http://www.ietf.org/id/draft-ibc-sipcore-sip-websocket-00.txt
> > http://tools.ietf.org/html/draft-ibc-sipcore-sip-websocket-00
> >
> >
> > This draft is a new revision of the previously named
> > draft-ibc-rtcweb-sip-websocket-00.
> >
> > Summary of main changes in this revision:
> >
> > - WebSocket background provided.
> > - Scope not limited to web-browsers.
> > - Outbound and GRUU usage described.
> > - DNS NAPTR/SRV considerations included.
> > - Added some clarifications and bug fixing.
> >
> >
> > As usual, your comments are most appreciated.
> >
> >
> > --
> > Iñaki Baz Castillo
> > <[e-mail]>
> > _______________________________________________
> > sipcore mailing list
> > [e-mail]
> > https://www.ietf.org/mailman/listinfo/sipcore
>
>
>
> --
> Victor Pascual Ávila
> _______________________________________________
> sipcore mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/sipcore
>
> _______________________________________________
> sipcore mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/sipcore
>