IETF Logo Mail Archive

Re: [sipcore] I-D Action: draft-ietf-sipcore-sip-token-authnz-02.txt

Christer Holmberg <christer.holmberg@ericsson.com> Tue, 09 July 2019 16:35 UTC

Return-Path: <christer.holmberg@ericsson.com>
X-Original-To: sipcore@ietfa.amsl.com
Delivered-To: sipcore@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D3309120026 for <sipcore@ietfa.amsl.com>; Tue, 9 Jul 2019 09:35:49 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.002
X-Spam-Level:
X-Spam-Status: No, score=-2.002 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3n-Be-SwhsLN for <sipcore@ietfa.amsl.com>; Tue, 9 Jul 2019 09:35:46 -0700 (PDT)
Received: from EUR03-DB5-obe.outbound.protection.outlook.com (mail-db5eur03on0610.outbound.protection.outlook.com [IPv6:2a01:111:f400:fe0a::610]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 89D4C120292 for <sipcore@ietf.org>; Tue, 9 Jul 2019 09:35:45 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=HlqFzwunvXpdIFe2m/lyjKPQRnj/89NfaIB2IX5/eEd/130lhNMSW2eDyuVgR2o2XbAy4tLhRVum3bxOoCOeE6YbJC37eN2e8Dvg5Diq8t1Ae5f1qxvagHlFhi6pWKQttZr3/xSmNxbxN029O5pG8BbR+XYTMfdd8WOzvB2idd4a73UlC0dw1wwjBWDOBGgV++9+cN82ldk/ahY4LPOnJbFHNAe+BvV/HCgMqDCTPV+gCOEMGJXelxyxchK7pV0rqcTbuGkMa3ImM3jiE3VC0oDob2FPAwB3Szqu3yO6D2L5Dziwi88Nb/ingXAAkiUrPttQzn0HSUoDG1+HTdDO7Q==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=8/FQ5aefnFbZhQoTLDP01AUQwzU/rDIZwgBG3/MvsuE=; b=WR4e5RTBAOHBcaMcudtqj5W2dJbF/ZDM924Rn1KljzHzu0eB2DN27a/5Vt7MJEtoMaLRPx4P8Hd5itvVh+8mrIo1CbwxOaqlDeVcE4cvvHMARNtJZnsBcYptH3/Uaz1R2FQtoiLBLdHG2jM3fzt6m/qs5iRbYGVSnMHbl1daPcUVNp7tj9BWJEHbZXO15ychlRzQtOSV76Ed/opvkMbucy1cS0GdUGX1wYVA45YBiM2Yjt757fV03na59jTY++dHPMim3REIutBjMivNFJojzuQlyRVqXbpGmHhSU/0dAwvBcyXzQLzif3iSrU0F9nTxLBBzn8axklS3dg9s/Vqn8g==
ARC-Authentication-Results: i=1; mx.microsoft.com 1;spf=pass smtp.mailfrom=ericsson.com;dmarc=pass action=none header.from=ericsson.com;dkim=pass header.d=ericsson.com;arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=8/FQ5aefnFbZhQoTLDP01AUQwzU/rDIZwgBG3/MvsuE=; b=lxgDwr/MX3/6mlQayHAqJG4FqDmDpZLJFcIw080yB811OUbB2TC76ngFmlhWD92eW42KCHDA1LQD/mOLhMNz6WHh/TupV8J1025IvBab68wIotV/b8WLQGnThx0K90b13E/VkCxE3MkFlqLfTt5KEEPqHv7ADQxca4GwoF0oRmk=
Received: from HE1PR07MB3161.eurprd07.prod.outlook.com (10.170.245.23) by HE1PR07MB4393.eurprd07.prod.outlook.com (20.176.167.30) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2073.8; Tue, 9 Jul 2019 16:35:43 +0000
Received: from HE1PR07MB3161.eurprd07.prod.outlook.com ([fe80::5050:a3a9:be80:cf43]) by HE1PR07MB3161.eurprd07.prod.outlook.com ([fe80::5050:a3a9:be80:cf43%5]) with mapi id 15.20.2073.008; Tue, 9 Jul 2019 16:35:43 +0000
From: Christer Holmberg <christer.holmberg@ericsson.com>
To: Rifaat Shekh-Yusef <rifaat.ietf@gmail.com>
CC: Paul Kyzivat <pkyzivat@alum.mit.edu>, "sipcore@ietf.org" <sipcore@ietf.org>
Thread-Topic: [sipcore] I-D Action: draft-ietf-sipcore-sip-token-authnz-02.txt
Thread-Index: AQHVNLWxruT/m/C2REGBvr04oIfCDqa/Al8AgAHwRACAACa0QIAAOvWAgACKbgCAAH00gIAARqSA///Zi4CAADV0AA==
Date: Tue, 09 Jul 2019 16:35:43 +0000
Message-ID: <850D0BC0-1068-4A13-9CEE-7751097171CA@ericsson.com>
References: <156249821133.14592.1211919336596009446@ietfa.amsl.com> <CAGL6epLsP_UfZMAcFLsORrR05Enu-vp=jnkgUFuKSttQm8swAw@mail.gmail.com> <c8d5c42e-ab21-80e8-3189-c8592dd02d3a@alum.mit.edu> <HE1PR07MB3161C55955B2FCED2C0F6A9993F60@HE1PR07MB3161.eurprd07.prod.outlook.com> <68ed93ae-57df-6bc7-774b-47959417abda@alum.mit.edu> <HE1PR07MB3161D46B4A44FC7E789ADDB893F10@HE1PR07MB3161.eurprd07.prod.outlook.com> <4a9787e5-b5e2-bc08-0fa0-fae6bd44148d@alum.mit.edu> <527F4C39-F065-4335-A939-6D443F1801E7@ericsson.com> <CAGL6epJH_YHXKA_EMXm008Bfu6KOfyTRY7a5D7s1C+_hywXYzQ@mail.gmail.com>
In-Reply-To: <CAGL6epJH_YHXKA_EMXm008Bfu6KOfyTRY7a5D7s1C+_hywXYzQ@mail.gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
user-agent: Microsoft-MacOutlook/10.1a.0.190609
authentication-results: spf=none (sender IP is ) smtp.mailfrom=christer.holmberg@ericsson.com;
x-originating-ip: [89.166.49.243]
x-ms-publictraffictype: Email
x-ms-office365-filtering-correlation-id: 12d98dbd-c2ed-4aa8-7880-08d7048b7c93
x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:HE1PR07MB4393;
x-ms-traffictypediagnostic: HE1PR07MB4393:
x-microsoft-antispam-prvs: <HE1PR07MB4393742B453B0DF7EA3DD58493F10@HE1PR07MB4393.eurprd07.prod.outlook.com>
x-ms-oob-tlc-oobclassifiers: OLM:9508;
x-forefront-prvs: 0093C80C01
x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(4636009)(396003)(136003)(39860400002)(376002)(346002)(366004)(189003)(199004)(5660300002)(36756003)(33656002)(66476007)(7736002)(66446008)(64756008)(66556008)(305945005)(73956011)(66946007)(6246003)(76116006)(14444005)(256004)(99286004)(478600001)(4326008)(2906002)(446003)(11346002)(2616005)(68736007)(44832011)(476003)(6916009)(86362001)(76176011)(25786009)(53936002)(81156014)(8676002)(186003)(102836004)(26005)(6506007)(4744005)(6436002)(81166006)(6512007)(229853002)(8936002)(14454004)(58126008)(316002)(6116002)(3846002)(486006)(6486002)(71200400001)(66066001)(71190400001)(54906003); DIR:OUT; SFP:1101; SCL:1; SRVR:HE1PR07MB4393; H:HE1PR07MB3161.eurprd07.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1;
received-spf: None (protection.outlook.com: ericsson.com does not designate permitted sender hosts)
x-ms-exchange-senderadcheck: 1
x-microsoft-antispam-message-info: gfsncJrZxLBcYBSkk9v0XWymDzVnAMwoe5NqRKWQ/xjdtd/f0vDn+myGaCM0c7BpcZLHIMvw3SgOxLQAPQ663/61hwuzijsIPGtRacRiNdohLKFxAluWr5Pyl5IUVFgJFwZCkydlI2I+g5IQ0AMc8bJx/rMOW6RbiNMrvgu1fM6u7xSYGmFhJ9ORTWjbyt/gYfDcSpscYzLla3lwiK7wOS44hnQa6mJ6YIsSSZmmFAMnkqjeKF8x/5jWM1uJ1Hlv70pikRUYJleMbDPAv8G5jia4aGOOFhHXb7nN9zGMPWoiSDzx5pZAbPNhGuCKjGDLgGgegrkt7hYe2SUqC4Em23CkzIMQUfXs1/ckfGvA0oii8rPT8VjChZwjIeXCc7iGZq+aEU0YkJTvNidupPWnU+KKxNHKhGp07heGRDPdedE=
Content-Type: text/plain; charset="utf-8"
Content-ID: <7526C82A24DAA44D8C2F59A068334BF8@eurprd07.prod.outlook.com>
Content-Transfer-Encoding: base64
MIME-Version: 1.0
X-OriginatorOrg: ericsson.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 12d98dbd-c2ed-4aa8-7880-08d7048b7c93
X-MS-Exchange-CrossTenant-originalarrivaltime: 09 Jul 2019 16:35:43.2379 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: christer.holmberg@ericsson.com
X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR07MB4393
Archived-At: <https://mailarchive.ietf.org/arch/msg/sipcore/Xswf4KvSNjllM0O2S6G0IB5WwY4>
Subject: Re: [sipcore] I-D Action: draft-ietf-sipcore-sip-token-authnz-02.txt
X-BeenThere: sipcore@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: SIP Core Working Group <sipcore.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/sipcore>, <mailto:sipcore-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/sipcore/>
List-Post: <mailto:sipcore@ietf.org>
List-Help: <mailto:sipcore-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/sipcore>, <mailto:sipcore-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 09 Jul 2019 16:35:50 -0000

Hi,

>>>> As I said in another reply, if you by default place a REGISTER token in a non-REGISTER request the token may reach the remote peer, which could be a security concern.
>>>    
>>>    I would like to hear more about this. Is there something about the token 
>>>    that reveals stuff that might not be suitable to expose to everyone? I 
>>>    personally don't know. This seems like something that ought to be 
>>>    discussed in security considerations.
>>>
>> The token itself does not reveal anything,
> 
> That depends on the type of token.
> A JWT might contain data that must be protected for privacy reasons.
 
Correct. My mistake.

Regards,

Christer

v2.23.0 | Report a Bug | By Email