[Sipping] SIP, SRTP and MIKEY

["Steffen Fries" <[e-mail]>]

Hi,

I'm not quite sure, which working group fits best for this 
question, thus I'm posting this question here too. I already 
had a post in the the SIP WG but got only one reply. 

When SIP and SRTP are used in conjunction, an appropriate
key management is necessary for SRTP. Within the MSEC WG 
MIKEY has been defined, which is thought to be used (also) 
for SRTP. 

MIKEY and an related draft (draft-ietf-msec-MIKEY-DHHMAC-
01.txt) offer 4 different key management methods based on:
- pre-shared secrets
- public key encryption
- Diffie Hellman protected with signatures
- Diffie Hellman protected with pre-shared secrets

When MIKEY and SRTP are to be used in a SIP environment, 
what would be a suitable choice out of the four options?

I'm not sure if the pre-shared secret based methods are 
suitable, since this would assume, that all users who want to 
communicate need to exchange a shared secret before. Well, this 
could be done by puting a shared secret in the SIP message and 
securing this by S/MIME, but then MIKEY would be protected by 
symmetric methods, although asymmetric technology was used to 
secure the shared secret transport, namely S/MIME. One could 
also use the certificates and private keys to secure MIKEY 
right from the beginning. 

There might be scenarios where the symmetric case is 
appropriate, but I'm not sure if this is a rather general case.

Is MIKEY generally considered for key management in SIP or will 
this rather be done using draft-baugher-mmusic-sdpmediasec-
00.txt secured by S/MIME?

The usage of MIKEY and SRTP is especially interesting in 
conjunction with other multimedia protocols like H.323. Voice 
encryption and associated key management could be performed 
across the different signaling protocols.

Was there already a discussion related to this question, which 
I may be missed? 

Regards
        Steffen


_______________________________________________
Sipping mailing list  https://www1.ietf.org/mailman/listinfo/sipping
This list is for NEW development of the application of SIP
Use [e-mail] for questions on current sip
Use [e-mail] for new developments of core SIP