RE: AW: [Sipping] FYI: RADIUS & SIP

> The utility of SIM cards has been recognized for Internet-side 
> authentication like EAP-SIM based WLAN roaming, in particular 
> as there is an existing billing and authentication machinery
> which one can plug into from the Internet side. However, SIM
> cards could also be used in a strictly Internet-only service
> provider context as well.

Having something like SIM cards in SIP phones is a good idea.
However, the GSM SIM card security mechanisms are obscure and
have been broken. The flaws are not a show stopper for GSM,
but I doubt that is a good idea to reuse broken algorithms.

> Plus, SIM-based authentication could be used as a bootstrap
> mechanism for X.509 certficate distribution and therefore for
> TLS mutual authentication.
> 
I support this, but I fear ISIMs will be cheaper as they are
already standardized and will be promoted by the UMTS providers.

> There is a draft for SIP authentication with Authentication and Key 
> Agreement (AKA, 
> http://www.ietf.org/internet-drafts/draft-torvinen-http-digest-aka-v2-00.txt
you mean informational RfC 3310?

--
Wolfgang Beck
T-Systems Nova GmbH 

_______________________________________________
Sipping mailing list  https://www1.ietf.org/mailman/listinfo/sipping
This list is for NEW development of the application of SIP
Use sip-implementors@cs.columbia.edu for questions on current sip
Use sip@ietf.org for new developments of core SIP