Re: [stir] current draft charter

[Hadriel Kaplan <[e-mail]>]

On Jun 17, 2013, at 1:32 AM, Dave Crocker <[e-mail]> wrote:

>> I addressed that in my last mail. The "guy being validated" provides a
>> pointer to the cert, yes, but whether or not you trust that cert is a fact
>> about your relationship to the CA that issued it.
> 
> Then what is the point in having the pointer, rather than letting the validator decide where to get the cert from?
> I suspect the answer is that it's a search efficiency hack, rather than a required mechanism, helping to find a knowledgeable CA amongst potentially thousands.

No, for 4474 he was talking about the cert belonging to the SIP-identity hash signer, not the CA that signed that cert as the trusted root/issuer.  For example if you receive a message with the From of '[e-mail]', then foo.com needs to tell you where to get its cert to prove it is foo.com that signed the SIP From of '[e-mail]'.  As the verifier, you have no direct relationship with foo.com, nor know which trusted CA foo.com uses.  So foo.com stores its cert at some web server, which it tells you to get the cert from with this URL.  If the URL was changed by an evil middleman to give you a different cert, then the cert won't be for 'foo.com' so verification correctly fails.

An alternative could have been to just have you automatically go to 'https://foo.com/sipcert' or some such thing, or have you look for some DNS record for foo.com to tell you where to get the cert.  But with the URL being sent in the message then foo.com could use different certs for different calls; for example if it uses different PBXs in multiple branch offices, it could give them each unique keys to sign the SIP messages with, without having to use separate domain names in its SIP From.

-hadriel