Re: [sipcore] No WebSocket level authentication scenario [was RE: I-D Action: draft-ietf-sipcore-sip-websocket-09.txt]

I would not use RFC 3261 as justification for what should, or should not, be said about authentication. The current RFC 3261 would probably fail a security directorate review if it was attempted to be approved as an RFC now.

(I'd also point out that for any security consideration of RFC 3261, one should also read RFC 5630.)

So I would suggest you conduct an independent security evaluation of what is needed.

For the use case you give:

> A website (a shop) offers a widget in which the visitor can click and
> made a SIP call (+WebRTC) that will end in the callcenter of the
> company, answered by an agent that will inform the user about the
> product he is interested in. Why do we require WWW or SIP
> authentication in this scenario?

I'd suggest that the issue to be discussed is what happens when the action described results in a transaction of some form to a third party (in the SIP case a call). The visitor then includes information that will be relayed to the third party. Who does the third party rely on to ensure that information is authentically given by the visitor.

Regards

Keith

> -----Original Message-----
> From: sipcore-bounces@ietf.org [mailto:sipcore-bounces@ietf.org] On Behalf
> Of Iñaki Baz Castillo
> Sent: 19 June 2013 12:32
> To: Saúl Ibarra Corretgé
> Cc: SIPCORE (Session Initiation Protocol Core) WG; Parthasarathi R
> Subject: Re: [sipcore] No WebSocket level authentication scenario [was RE:
> I-D Action: draft-ietf-sipcore-sip-websocket-09.txt]
> 
> 2013/6/19 Saúl Ibarra Corretgé <saul@ag-projects.com>:
> > Why is authentication a MUST? Lets assume that I'm using UDP and my
> proxy establishes a WS connection with a foreign domain's proxy because of
> NAPTR and my proxy supports acting as a WS client. It obviously won't be
> able to authenticate. If this scenario supposed to be covered?
> 
> Honestly I agree. I cannot find in RFC 3261 (or other RFCs) a
> normative statement mandating authentication, regardless the request
> comes from a UA.
> 
> In another thread we are discussing about MTI authentication
> mechanisms that must be implemented by SIP WS Clients and Servers.
> IMHO that is correct, but mandating SIP authentication or WWW
> authentication for ALL the scenarios seem innapropriate for me. I come
> back to an use case:
> 
> A website (a shop) offers a widget in which the visitor can click and
> made a SIP call (+WebRTC) that will end in the callcenter of the
> company, answered by an agent that will inform the user about the
> product he is interested in. Why do we require WWW or SIP
> authentication in this scenario?
> 
> If WG agrees with this, I will remove the normative statements in
> "Authentication" section, and instead address the MTI authentication
> mechanisms.
> 
> 
> --
> Iñaki Baz Castillo
> <ibc@aliax.net>
> _______________________________________________
> sipcore mailing list
> sipcore@ietf.org
> https://www.ietf.org/mailman/listinfo/sipcore