Re: [Stox] SIPS URIs and SIP/XMPP gateways - WAS: review: stox-core-04

[Peter Saint-Andre <[e-mail]>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 9/27/13 10:14 AM, Peter Saint-Andre wrote:
> On 9/27/13 7:46 AM, Robert Sparks wrote:
>> (Adding Jon)
> 
>> Peter - is there nothing in XMPP that lets a client say "I want 
>> this to use secure transports only - have it fail rather than
>> use an insecure transport anywhere along its delivery path?"
> 
> No. That doesn't mean we don't need it (although in general people 
> have thought we *wouldn't* need it if we could just define an 
> end-to-end encryption method that solve all the relevant use
> cases).
> 
>> That's the primary property you should discuss. Without putting
>> a lot of thinking into it, I suspect that if you _don't_ have a
>> way to express that available (which is what I'm taking away from
>> your last sentence), the right guidance in the document is to
>> refuse to gateway a SIP request that expresses that requirement.
> 
> Indeed, that seems correct.
> 
> Thanks for the guidance.

Here is proposed text:

   As specified in Section 26.4.4 of [RFC3261], a To header or a
   Request-URI containing a SIPS URI is used to indicate that all hops
   in a communication path need to be protected using Transport Layer
   Security [RFC5246].  Because XMPP lacks a way to signal that all hops
   need to be encrypted, if the To header or Request-URI of a SIP
   message is a SIPS URI then the SIP-to-XMPP gateway MUST NOT translate
   the SIP message into an XMPP stanza and MUST NOT route it to the
   destination XMPP server.

Peter

- -- 
Peter Saint-Andre
https://stpeter.im/


-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.19 (Darwin)
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iQIcBAEBAgAGBQJSSNotAAoJEOoGpJErxa2pAbMQALNKvkSDQLr5yj/4GBaR0qep
AMI3pFQ9DdjYPQHaNt/OZRJ22K0XfSbRTEHPRsuld1r2vmMLKRoCh6dxc35TGCYw
5DyolpraQfPE+3zBvlLONtisIbTxNeha20taL6Sbb67pnLJ8xPArn/yHY56Pwq30
PRcffweaNEBlIB26nGiEKshTn/zdmhls59lW6tM+1NuO0DsYdydtO8Ikm4PjLFST
GoEihN06Uttw3Jgt08kl1q6fsy3GAjsUaikItjijuKGhQG598YQTE7SbKqxo5mwX
h5FT+mdTsGO9lPvPg/+MqMAcXFZOHFbixHMNK/kHmDnnDBbq3EOyDj7Jtn5RuSbw
OSgz0vXtmJnCrWkMHMmZtJdS9ixYu3/FEbolagjGte2Ug+1atO8kJPn0zXgZsMk2
qg3eK2SpRjWrT7aB8mC9Pquj0YSL6KXUDW4G7it16XGd0mome0FqdNjBWXmnBEfK
5C7vGTXbp9xswLPki/ga3i9dM1scSnKOsL16MaTOysAyNZAelcwB7Xgds5AJGN5g
qJ/sLpzTagC1njDulceHHnTYqS9gnkeR1lBcnBsuS6baDtWBcHDfI8vdpu5qQm8k
1QTDnkFjTBeij3PF1SCcP8M2bIYJhwnaaC0Vp8SmygvgaWiD4ttJinC6PlBuY9MQ
guqUK2QaJI+SvnADH69K
=aHme
-----END PGP SIGNATURE-----