Re: [sipcore] No WebSocket level authentication scenario [was RE: I-D Action: draft-ietf-sipcore-sip-websocket-09.txt]

[Paul Kyzivat <[e-mail]>]

Partha,

Again, I'm not the one to answer. I'm just the chair, not the author.

	Thanks,
	Paul

On 6/24/13 8:47 PM, Parthasarathi R wrote:
> Paul,
>
> In case it is not mandatory to use authentication, the following statement
> in Sec 7 of the draft is not correct:
>
> "  If no authentication is done at WebSocket level then SIP Digest
>     authentication is required for every SIP request coming over the
>     WebSocket connection."
>
> Please let me know your comment on the same.
>
> Thanks
> Partha
>
>> -----Original Message-----
>> From: [e-mail] [mailto:[e-mail]] On
>> Behalf Of Paul Kyzivat
>> Sent: Thursday, June 20, 2013 9:37 PM
>> To: [e-mail]
>> Subject: Re: [sipcore] No WebSocket level authentication scenario [was
>> RE: I-D Action: draft-ietf-sipcore-sip-websocket-09.txt]
>>
>> On 6/19/13 8:06 AM, DRAGE, Keith (Keith) wrote:
>>> I would not use RFC 3261 as justification for what should, or should
>> not, be said about authentication. The current RFC 3261 would probably
>> fail a security directorate review if it was attempted to be approved
>> as an RFC now.
>>>
>>> (I'd also point out that for any security consideration of RFC 3261,
>> one should also read RFC 5630.)
>>>
>>> So I would suggest you conduct an independent security evaluation of
>> what is needed.
>>
>> I think we are in the midst of one with Stephen Farrell.
>>
>>> For the use case you give:
>>>
>>>> A website (a shop) offers a widget in which the visitor can click
>> and
>>>> made a SIP call (+WebRTC) that will end in the callcenter of the
>>>> company, answered by an agent that will inform the user about the
>>>> product he is interested in. Why do we require WWW or SIP
>>>> authentication in this scenario?
>>>
>>> I'd suggest that the issue to be discussed is what happens when the
>> action described results in a transaction of some form to a third party
>> (in the SIP case a call). The visitor then includes information that
>> will be relayed to the third party. Who does the third party rely on to
>> ensure that information is authentically given by the visitor.
>>
>> I'm inclined to support Iñaki, that authentication of any sort
>> shouldn't
>> be Mandatory to *Use*.  Individual applications can decide when they
>> have uses that require authentication and when they don't.
>>
>> 	Thanks,
>> 	Paul
>>
>>> Regards
>>>
>>> Keith
>>>
>>>
>>>
>>>> -----Original Message-----
>>>> From: [e-mail] [mailto:[e-mail]] On
>> Behalf
>>>> Of Iñaki Baz Castillo
>>>> Sent: 19 June 2013 12:32
>>>> To: Saúl Ibarra Corretgé
>>>> Cc: SIPCORE (Session Initiation Protocol Core) WG; Parthasarathi R
>>>> Subject: Re: [sipcore] No WebSocket level authentication scenario
>> [was RE:
>>>> I-D Action: draft-ietf-sipcore-sip-websocket-09.txt]
>>>>
>>>> 2013/6/19 Saúl Ibarra Corretgé <[e-mail]>:
>>>>> Why is authentication a MUST? Lets assume that I'm using UDP and my
>>>> proxy establishes a WS connection with a foreign domain's proxy
>> because of
>>>> NAPTR and my proxy supports acting as a WS client. It obviously
>> won't be
>>>> able to authenticate. If this scenario supposed to be covered?
>>>>
>>>> Honestly I agree. I cannot find in RFC 3261 (or other RFCs) a
>>>> normative statement mandating authentication, regardless the request
>>>> comes from a UA.
>>>>
>>>> In another thread we are discussing about MTI authentication
>>>> mechanisms that must be implemented by SIP WS Clients and Servers.
>>>> IMHO that is correct, but mandating SIP authentication or WWW
>>>> authentication for ALL the scenarios seem innapropriate for me. I
>> come
>>>> back to an use case:
>>>>
>>>> A website (a shop) offers a widget in which the visitor can click
>> and
>>>> made a SIP call (+WebRTC) that will end in the callcenter of the
>>>> company, answered by an agent that will inform the user about the
>>>> product he is interested in. Why do we require WWW or SIP
>>>> authentication in this scenario?
>>>>
>>>> If WG agrees with this, I will remove the normative statements in
>>>> "Authentication" section, and instead address the MTI authentication
>>>> mechanisms.
>>>>
>>>>
>>>> --
>>>> Iñaki Baz Castillo
>>>> <[e-mail]>
>>>> _______________________________________________
>>>> sipcore mailing list
>>>> [e-mail]
>>>> https://www.ietf.org/mailman/listinfo/sipcore
>>> _______________________________________________
>>> sipcore mailing list
>>> [e-mail]
>>> https://www.ietf.org/mailman/listinfo/sipcore
>>>
>>
>> _______________________________________________
>> sipcore mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/sipcore
>
>