IETF Logo Mail Archive

Re: [sipcore] I-D Action: draft-ietf-sipcore-sip-token-authnz-02.txt

Roman Shpount <roman@telurix.com> Tue, 09 July 2019 18:28 UTC

Return-Path: <roman@telurix.com>
X-Original-To: sipcore@ietfa.amsl.com
Delivered-To: sipcore@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D54561209F0 for <sipcore@ietfa.amsl.com>; Tue, 9 Jul 2019 11:28:13 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -0.592
X-Spam-Level:
X-Spam-Status: No, score=-0.592 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, PDS_NO_HELO_DNS=1.295, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, T_SPF_PERMERROR=0.01, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=telurix-com.20150623.gappssmtp.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YTd-iiJKfinM for <sipcore@ietfa.amsl.com>; Tue, 9 Jul 2019 11:28:13 -0700 (PDT)
Received: from mail-pl1-x633.google.com (mail-pl1-x633.google.com [IPv6:2607:f8b0:4864:20::633]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E8F671209FB for <sipcore@ietf.org>; Tue, 9 Jul 2019 11:28:04 -0700 (PDT)
Received: by mail-pl1-x633.google.com with SMTP id ay6so10516706plb.9 for <sipcore@ietf.org>; Tue, 09 Jul 2019 11:28:04 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=telurix-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=L6hUfcOmd4z925Gi5B2eMrMUna7eMcVTQcV9ZBUF+Ds=; b=CC2ad+cjfB0jc8DnEY1YpqWG/sgdYNM5RCtfLy4vyZJIku3Nn3XsFyNcvDD2Eead7V bcyRLH+xn9CLkobTMaU37cJQWEXG68LkTEd+cJaLXaEPI7PdQZtqamYma2jGzviMe1Kk 6Fo8c07GrNnF28o9BTU/dUBoA5amvm/8Oo8jG/UYsCX8LOHFpxESJnS8BvsskMBQEYoT 8zVUTrO5doYsPqthpFuVord03cNtvHwe2iMhG5kEesV/6pky/ttq1nbrPoncm/slQ46Y SuyisjMbUkuPttBy2bEnpG2dDABdYqKjzyPVZlLLGxbZ5vMtpTtjPVBUnNwrIyhP+J6h 5iOw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=L6hUfcOmd4z925Gi5B2eMrMUna7eMcVTQcV9ZBUF+Ds=; b=Br0KD+0s6HPIM1n/cz6EK3otx6sZxx1tKW4VqR8kEa1EpxjhTj5Sd7Sxq7Xv3GgOGr //PBOBvgBcHoNiKw9iYFAWkssVtEaSp2qMxFfDSAA2ZmMCGlo5YIgQl/Nhu4Q/szoLGk A9G05NFaqNj0+c8OqnBCWgotEP79ItdOdt9TzF7PX5lmp/TKHF/EOai9ZC9LrSTKqU5r hh2s9Tj3Lteobq70CyPrBsrCVPyGZMDlohji8BuGmjWZhG/nu6FBzzPgHgJCg2RRl5FQ oxNVgOhYXwIJhgE/MNvqujNWPylw1xEtGM8LB6DRbYHNJKopAE5PrHpvkbxuYlJ/nK3O dylQ==
X-Gm-Message-State: APjAAAXaVnOzxjP5pPZ7iygiuSIV5nNZf1Hv6Q1r0EhnVAOkPiwhmENy 3jQ57abbK2E/ksXHYHYJtGMVLkwLf24=
X-Google-Smtp-Source: APXvYqy2GrPK5TK9F/4TKVT4yMU0UPOMJLswDcapFOz1JZ5wzGSCmkGCb6I570KfMKNr/MLjpaG5GA==
X-Received: by 2002:a17:902:2a29:: with SMTP id i38mr33996464plb.46.1562696883950; Tue, 09 Jul 2019 11:28:03 -0700 (PDT)
Received: from mail-pg1-f169.google.com (mail-pg1-f169.google.com. [209.85.215.169]) by smtp.gmail.com with ESMTPSA id k6sm22118940pfi.12.2019.07.09.11.28.02 for <sipcore@ietf.org> (version=TLS1_3 cipher=AEAD-AES128-GCM-SHA256 bits=128/128); Tue, 09 Jul 2019 11:28:02 -0700 (PDT)
Received: by mail-pg1-f169.google.com with SMTP id g15so9875885pgi.4 for <sipcore@ietf.org>; Tue, 09 Jul 2019 11:28:02 -0700 (PDT)
X-Received: by 2002:a65:55c2:: with SMTP id k2mr32145443pgs.217.1562696881923; Tue, 09 Jul 2019 11:28:01 -0700 (PDT)
MIME-Version: 1.0
References: <156249821133.14592.1211919336596009446@ietfa.amsl.com> <CAGL6epLsP_UfZMAcFLsORrR05Enu-vp=jnkgUFuKSttQm8swAw@mail.gmail.com> <c8d5c42e-ab21-80e8-3189-c8592dd02d3a@alum.mit.edu> <HE1PR07MB3161C55955B2FCED2C0F6A9993F60@HE1PR07MB3161.eurprd07.prod.outlook.com> <68ed93ae-57df-6bc7-774b-47959417abda@alum.mit.edu> <HE1PR07MB3161D46B4A44FC7E789ADDB893F10@HE1PR07MB3161.eurprd07.prod.outlook.com> <4a9787e5-b5e2-bc08-0fa0-fae6bd44148d@alum.mit.edu> <527F4C39-F065-4335-A939-6D443F1801E7@ericsson.com>
In-Reply-To: <527F4C39-F065-4335-A939-6D443F1801E7@ericsson.com>
From: Roman Shpount <roman@telurix.com>
Date: Tue, 09 Jul 2019 14:27:51 -0400
X-Gmail-Original-Message-ID: <CAD5OKxuK_2+JcbGvo6LNeRbCYXWXQmhKQPNUzoZvZEOupPWyjw@mail.gmail.com>
Message-ID: <CAD5OKxuK_2+JcbGvo6LNeRbCYXWXQmhKQPNUzoZvZEOupPWyjw@mail.gmail.com>
To: Christer Holmberg <christer.holmberg@ericsson.com>
Cc: Paul Kyzivat <pkyzivat@alum.mit.edu>, "sipcore@ietf.org" <sipcore@ietf.org>
Content-Type: multipart/alternative; boundary="00000000000089ec93058d43b829"
Archived-At: <https://mailarchive.ietf.org/arch/msg/sipcore/ntxS-NBPXKg48UGbP77vvADWmnI>
Subject: Re: [sipcore] I-D Action: draft-ietf-sipcore-sip-token-authnz-02.txt
X-BeenThere: sipcore@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: SIP Core Working Group <sipcore.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/sipcore>, <mailto:sipcore-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/sipcore/>
List-Post: <mailto:sipcore@ietf.org>
List-Help: <mailto:sipcore-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/sipcore>, <mailto:sipcore-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 09 Jul 2019 18:28:14 -0000

On Tue, Jul 9, 2019 at 11:43 AM Christer Holmberg <
christer.holmberg@ericsson.com> wrote:

> As far as I know, OAuth for SIP has only been used for REGISTER requests,
> between the UA and the registrar. I have never heard about anyone using it
> for non-REGISTER authentication, and I wonder whether we even need to cover
> it in the draft. We could limit the scope the REGISTER requests. Then, if
> anyone ever needs OAuth for non-REGISTER requests, a separate draft can be
> written.
>
>
Really? Normally, for a secure solution, every SIP request, including
requests sent by UA in dialog established from the server to the registered
end point must be authenticated. OAuth for REGISTRER requests only is kind
of useless since it does not allow UA to send any messages to the server
without some additional authentication mechanism.

Best Regards,
_____________
Roman Shpount

v2.23.0 | Report a Bug | By Email