[TLS] Re: [MMUSIC] Re: comedia-tls: proposed change for certificate identities

Colin Perkins <csp@csperkins.org> wrote:
> On 30 Jan 2006, at 13:22, Jonathan Lennox wrote:
> > On Sunday, January 29 2006, "Sam Hartman" wrote:
> >> What about hop-by-hop authenticated with each hop integrity
> >> protected.
> >> IMHO in many environments, this presents acceptable man-in-the-middle
> >> risk.  I think that it may present significantly easier to deal with
> >> usability issues so I think it should at least be allowed if not
> >> encouraged.
> >
> > This will certainly be the most common way of securing SDP, I think
> > -- this
> > describes how sips, i.e. sip over hop-by-hop TLS, works.  You're
> > vulnerable
> > to a broken or subverted sip proxy server, but otherwise you're safe.
> >
> > If there's consensus that it's acceptable to allow this mode, I can
> > add
> > language allowing it.  However, I think this is a big enough change
> > I'd like
> > to hear positive consensus for it; this should get something more
> > than just
> > consent-by-silence from the working group.
> 
> There was a comment from Hadriel Kaplan supporting this change, but
> this is a big enough issue that I'd like more feedback before we go
> forward. Any comments from other members of the working group (or
> from the security ADs)?

This seems like the right approach to me.

-Ekr

_______________________________________________
TLS mailing list
TLS@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls