Re: [sipcore] SIP Federation, authentication and interoperability with WebRTC

This email list is for discussions of work in the IETF on core SIP, mostly extensions and bug fixes for SIP.  It’s not a general SIP discussion forum.  But, to answer your questions:

> On May 5, 2020, at 4:45 AM, Filippos Vasilakis <vasilakisfil@gmail.com> wrote:
> 
> Hello everyone,
> 
> I first sent this email to sip-implementers mailing list as I was pointed out by @sobomax and @oej, but that mailing list told me that the things I ask are more related to this group, so here I am.
> 
> I started looking into SIP over the past months because I find it quite interesting protocol. I have went through various RFCs and technical documents and I have some questions that might be naive, but due to lack of experience I need some guidance and clarifications. Also, I hope I am in the right place asking those questions.
> 
> 1) What's the status of SIP Federation? It seems like there is no official standard in there, but do we need it in order to achieve it ? The Secure Telephone Identity Revisited IETF group [0] has done some amazing work over the past years regarding SIP authentication (especially from the callee side). Is that enough for having secure SIP Federation, or are there missing pieces in the puzzle?
Depends on what you mean by “Federation”.  Reliable authentication <> federation but it’s a piece. As deployed, SIP either uses telephone numbers (or extensions) as identity, or SIP URIs within a domain.  Stir addresses authentication for telephone numbers.  It certainly can also be used to secure identity with other forms of SIP URIs.  What else do you think you need for federation?  Of course SIP is successfully used in IMS networks which power virtually all of the worldwide mobile networks, and it’s also used in most VoIP, cable and enterprise phone systems.  
> 
> 2) The WebRTC seems like it's taking a completely different road regarding federation [1]. There, it seems like the signaling protocol (which is not defined yet, but SIP is a major candidate), is used only for passing over the user identities, and then the actual federation checks take place inside the browser. I guess that's needed in case you don't trust the site you are sitting on, like a poker site, but still need to communicate with your friends, and verify that these are your friends, whose identity might belong to a completely different server/domain from yours and different from the poker site you are sitting on. Actually that scenario is explained by [1]. But still, that's quite different with SIP, so how is SIP interoperability is going to work with that? Has anyone give a thought? Feels super important to me that these 2 don't divert.
As deployed, virtually all WebRTC is within a single domain.  There just aren’t any large cross domain instances.  There is work in something called “IVC” that is trying to encourage cross domain video conferencing, which would use telephone numbers as identities, and thus can also use stir.  But there is no work on federation between WebRTC domains.  
> 
> 3) Olle Johannson, in a talk in Kamailio conference, said that SIP still hasn't solved the end-to-end encryption and integrity, mostly because, at some point the route might go through a non TLS connection. Well that's not an easy problem to solve, but I think that [0] has solved most of that (the integrity part), or am I wrong ? I mean, sure the SIP request might be come with the headers stripped off, but that's something that the callee SIP server shouldn't trust much. If it has the necessary headers though (the passport), then the caller should be who says it is. Of course the encryption is still remaining open, but is this solvable at all? Anyone working on that that ?
The end to end problem comes about because SIP signaling is hop by hop.  If you use TLS on every hop, that’s good but a) the endpoints don’t know if that happened or not, and (b) that isn’t end-to-end encryption.  There was early work that used S/MIME which would be end-to-end, but it was never implemented.  We aren't currently motivated to deal with that.

> 
> 4) How people do authentication mostly in SIP, when some kind of federation is needed? Is RFCs from [0] a common practice now? Is DANE (which from what I understand depends on DNSSEC) something that is used at all ? Something else ?
stir is being implemented widely in some places (the United States PSTN for example).  It’s being implemented to stop robocalling, but it’s also going to stop things like SWATing.  There isn’t much else going on.  No one I know uses DANE with SIP except accidentally, and while secure DNS is always desirable, it’s only a small part of authenticating sip.

> 
> I guess I fired too many questions, but I would love to get back some clarifications.
Those are mine.  You should probably drop sipcore from any reply you have to this.

Brian
sipcore co-chair
> 
> [0] https://datatracker.ietf.org/wg/stir/documents/ <https://datatracker.ietf.org/wg/stir/documents/>
> [1] https://tools.ietf.org/html/draft-ietf-rtcweb-security-arch-20 <https://tools.ietf.org/html/draft-ietf-rtcweb-security-arch-20>
> [2] https://www.youtube.com/watch?v=FO1N6gEjxUo <https://www.youtube.com/watch?v=FO1N6gEjxUo>
> _______________________________________________
> sipcore mailing list
> sipcore@ietf.org
> https://www.ietf.org/mailman/listinfo/sipcore