[Speermint] draft-niccolini-speermint-voipthreats-05
Cullen Jennings <fluffy@cisco.com> Sat, 15 November 2008 01:51 UTC
Return-Path: <speermint-bounces@ietf.org>
X-Original-To: speermint-archive@megatron.ietf.org
Delivered-To: ietfarch-speermint-archive@core3.amsl.com
Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 416803A6ABB; Fri, 14 Nov 2008 17:51:59 -0800 (PST)
X-Original-To: speermint@core3.amsl.com
Delivered-To: speermint@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 355A83A6A57 for <speermint@core3.amsl.com>; Fri, 14 Nov 2008 17:51:58 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -106.599
X-Spam-Level:
X-Spam-Status: No, score=-106.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LiMqSRzr7qGF for <speermint@core3.amsl.com>; Fri, 14 Nov 2008 17:51:57 -0800 (PST)
Received: from sj-iport-6.cisco.com (sj-iport-6.cisco.com [171.71.176.117]) by core3.amsl.com (Postfix) with ESMTP id 610873A6A67 for <speermint@ietf.org>; Fri, 14 Nov 2008 17:51:57 -0800 (PST)
X-IronPort-AV: E=Sophos;i="4.33,607,1220227200"; d="scan'208";a="195184492"
Received: from sj-dkim-4.cisco.com ([171.71.179.196]) by sj-iport-6.cisco.com with ESMTP; 15 Nov 2008 01:51:57 +0000
Received: from sj-core-3.cisco.com (sj-core-3.cisco.com [171.68.223.137]) by sj-dkim-4.cisco.com (8.12.11/8.12.11) with ESMTP id mAF1pv3T031653 for <speermint@ietf.org>; Fri, 14 Nov 2008 17:51:57 -0800
Received: from [192.168.4.177] (rcdn-fluffy-8711.cisco.com [10.99.9.18]) by sj-core-3.cisco.com (8.13.8/8.13.8) with ESMTP id mAF1puJQ000816 for <speermint@ietf.org>; Sat, 15 Nov 2008 01:51:57 GMT
Message-Id: <59A6E721-C106-4CDF-9A53-8E801BBB323B@cisco.com>
From: Cullen Jennings <fluffy@cisco.com>
To: speermint@ietf.org
Impp: xmpp:cullenfluffyjennings@jabber.org
Mime-Version: 1.0 (Apple Message framework v929.2)
Date: Fri, 14 Nov 2008 18:51:54 -0700
X-Mailer: Apple Mail (2.929.2)
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; l=728; t=1226713917; x=1227577917; c=relaxed/simple; s=sjdkim4002; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=cisco.com; i=fluffy@cisco.com; z=From:=20Cullen=20Jennings=20<fluffy@cisco.com> |Subject:=20draft-niccolini-speermint-voipthreats-05 |Sender:=20; bh=FDNPxws7v2tfRGnucSsrLSCRxNgHAWRCcu358N2ClLs=; b=t2b6gT5CZhw7wfKtJAHyIe61f9pADjERnR0TuHKPaAAro47C3CMRBn2BD3 NvFnNzIPxyI7UwV89Bw+zKgNqjxJWEan6BQ9jehey5OuuYSaZMKiDVwqrA2v iiLnUkzzo5;
Authentication-Results: sj-dkim-4; header.From=fluffy@cisco.com; dkim=pass ( sig from cisco.com/sjdkim4002 verified; );
Subject: [Speermint] draft-niccolini-speermint-voipthreats-05
X-BeenThere: speermint@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Mailing list for the speermint working group <speermint.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/speermint>, <mailto:speermint-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/pipermail/speermint>
List-Post: <mailto:speermint@ietf.org>
List-Help: <mailto:speermint-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/speermint>, <mailto:speermint-request@ietf.org?subject=subscribe>
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset="us-ascii"; Format="flowed"; DelSp="yes"
Sender: speermint-bounces@ietf.org
Errors-To: speermint-bounces@ietf.org
Two trivial comments ....
Section 2.3.1 password cracking.
I understand how seeing a single digest transaction allows an offline
dictionary attack on weak passwords but why how do you come to the
conclusion
challenge-response authentication mechanism of
SIP is not secure if the attacker is able to eavesdrop a
sufficient number of SIP authentication messages exchanged
between
a SIP server and a SIP client.
Section 4.8 - you mention here an assumption about a PKI
infrastructure being in place. I think it would be better to mention
that where you discuss the usage of TLS because is it the same one
either way.
Cullen in my individual contributor role
_______________________________________________
Speermint mailing list
Speermint@ietf.org
https://www.ietf.org/mailman/listinfo/speermint
- [Speermint] draft-niccolini-speermint-voipthreats… Cullen Jennings