Re: [Stox] SIPS URIs and SIP/XMPP gateways - WAS: review: stox-core-04

[Robert Sparks <[e-mail]>]

On 9/29/13 8:55 PM, Peter Saint-Andre wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On 9/27/13 10:14 AM, Peter Saint-Andre wrote:
>> On 9/27/13 7:46 AM, Robert Sparks wrote:
>>> (Adding Jon)
>>> Peter - is there nothing in XMPP that lets a client say "I want
>>> this to use secure transports only - have it fail rather than
>>> use an insecure transport anywhere along its delivery path?"
>> No. That doesn't mean we don't need it (although in general people
>> have thought we *wouldn't* need it if we could just define an
>> end-to-end encryption method that solve all the relevant use
>> cases).
>>
>>> That's the primary property you should discuss. Without putting
>>> a lot of thinking into it, I suspect that if you _don't_ have a
>>> way to express that available (which is what I'm taking away from
>>> your last sentence), the right guidance in the document is to
>>> refuse to gateway a SIP request that expresses that requirement.
>> Indeed, that seems correct.
>>
>> Thanks for the guidance.
> Here is proposed text:
>
>     As specified in Section 26.4.4 of [RFC3261], a To header or a
>     Request-URI containing a SIPS URI is used to indicate that all hops
>     in a communication path need to be protected using Transport Layer
>     Security [RFC5246].  Because XMPP lacks a way to signal that all hops
>     need to be encrypted, if the To header or Request-URI of a SIP
>     message is a SIPS URI then the SIP-to-XMPP gateway MUST NOT translate
>     the SIP message into an XMPP stanza and MUST NOT route it to the
>     destination XMPP server.
wfm. You might also talk about not using sips when going XMPP->SIP.
If you haven't found it already, see also RFC5630.

RjS
>
> Peter
>
> - -- 
> Peter Saint-Andre
> https://stpeter.im/
>
>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG/MacGPG2 v2.0.19 (Darwin)
> Comment: GPGTools - http://gpgtools.org
> Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
>
> iQIcBAEBAgAGBQJSSNotAAoJEOoGpJErxa2pAbMQALNKvkSDQLr5yj/4GBaR0qep
> AMI3pFQ9DdjYPQHaNt/OZRJ22K0XfSbRTEHPRsuld1r2vmMLKRoCh6dxc35TGCYw
> 5DyolpraQfPE+3zBvlLONtisIbTxNeha20taL6Sbb67pnLJ8xPArn/yHY56Pwq30
> PRcffweaNEBlIB26nGiEKshTn/zdmhls59lW6tM+1NuO0DsYdydtO8Ikm4PjLFST
> GoEihN06Uttw3Jgt08kl1q6fsy3GAjsUaikItjijuKGhQG598YQTE7SbKqxo5mwX
> h5FT+mdTsGO9lPvPg/+MqMAcXFZOHFbixHMNK/kHmDnnDBbq3EOyDj7Jtn5RuSbw
> OSgz0vXtmJnCrWkMHMmZtJdS9ixYu3/FEbolagjGte2Ug+1atO8kJPn0zXgZsMk2
> qg3eK2SpRjWrT7aB8mC9Pquj0YSL6KXUDW4G7it16XGd0mome0FqdNjBWXmnBEfK
> 5C7vGTXbp9xswLPki/ga3i9dM1scSnKOsL16MaTOysAyNZAelcwB7Xgds5AJGN5g
> qJ/sLpzTagC1njDulceHHnTYqS9gnkeR1lBcnBsuS6baDtWBcHDfI8vdpu5qQm8k
> 1QTDnkFjTBeij3PF1SCcP8M2bIYJhwnaaC0Vp8SmygvgaWiD4ttJinC6PlBuY9MQ
> guqUK2QaJI+SvnADH69K
> =aHme
> -----END PGP SIGNATURE-----