From sip-bounces@ietf.org Fri Apr 1 10:22:14 2005 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA04197 for ; Fri, 1 Apr 2005 10:22:14 -0500 (EST) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DHO5o-0006BW-7T for sip-web-archive@ietf.org; Fri, 01 Apr 2005 10:29:52 -0500 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DHNvH-0008PF-Nw; Fri, 01 Apr 2005 10:18:59 -0500 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DHNvF-0008PA-Ay for sip@megatron.ietf.org; Fri, 01 Apr 2005 10:18:57 -0500 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA03837 for ; Fri, 1 Apr 2005 10:18:55 -0500 (EST) From: Mpierce1@aol.com Received: from imo-m21.mx.aol.com ([64.12.137.2]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DHO2Z-000657-Dv for sip@ietf.org; Fri, 01 Apr 2005 10:26:33 -0500 Received: from Mpierce1@aol.com by imo-m21.mx.aol.com (mail_out_v37_r5.33.) id 7.8.65815fa2 (18251); Fri, 1 Apr 2005 10:18:11 -0500 (EST) Message-ID: <8.65815fa2.2f7ec032@aol.com> Date: Fri, 1 Apr 2005 10:18:10 EST Subject: Re: [Sip] Comments on Resource-Priority -07 To: mdolly@att.com, sip@ietf.org, hgs@cs.columbia.edu, jmpolk@cisco.com MIME-Version: 1.0 X-Mailer: 7.0 for Windows sub 10503 X-Spam-Score: 0.7 (/) X-Scan-Signature: 538aad3a3c4f01d8b6a6477ca4248793 X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============1864656755==" Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org X-Spam-Score: 0.7 (/) X-Scan-Signature: fb6060cb60c0cea16e3f7219e40a0a81 --===============1864656755== Content-Type: multipart/alternative; boundary="part1_8.65815fa2.2f7ec032_boundary" --part1_8.65815fa2.2f7ec032_boundary Content-Type: text/plain; charset="US-ASCII" Content-Transfer-Encoding: 7bit In a message dated 3/31/2005 3:09:25 PM Eastern Standard Time, mdolly@att.com writes: > This draft defines the SIP behavior, and not the procedures for a given > call/session type. I believe your "problems" can be addressed in the DSN > procedures document. > Yes, that is exactly my point. The draft should only describe the SIP behavior, not the procedures within a specific network which are separate from the behavior of the header itself. Details of preemption algorithms (or others) are not appropriate for this draft. Any network using this header can define (and change) the preemption procedures as it wishes. It's hard to address this "problem" in a DSN procedures document, when it would have to explicitly contradict the "mandatory" things stated in the RFC. Mike --part1_8.65815fa2.2f7ec032_boundary Content-Type: text/html; charset="US-ASCII" Content-Transfer-Encoding: quoted-printable In a me= ssage dated 3/31/2005 3:09:25 PM Eastern Standard Time, mdolly@att.com write= s:


This draft defines the SIP beha= vior, and not the procedures for a given call/session type. I believe your "= problems" can be addressed in the DSN procedures document.


Yes, that is exactly my point. The draft should only describe the SIP behavi= or, not the procedures within a specific network which are separate from the= behavior of the header itself. Details of preemption algorithms (or others)= are not appropriate for this draft. Any network using this header can defin= e (and change) the preemption procedures as it wishes.

It's hard to address this "problem" in a DSN procedures document, when it wo= uld have to explicitly contradict the "mandatory" things stated in the RFC.<= BR>
Mike
--part1_8.65815fa2.2f7ec032_boundary-- --===============1864656755== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline Content-Transfer-Encoding: 7bit _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip --===============1864656755==-- From sip-bounces@ietf.org Mon Apr 4 03:06:20 2005 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA28944 for ; Mon, 4 Apr 2005 03:06:19 -0400 (EDT) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DILn4-0005fC-FN for sip-web-archive@ietf.org; Mon, 04 Apr 2005 03:14:30 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DILeO-0003Da-PT; Mon, 04 Apr 2005 03:05:32 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DILeM-0003DO-Gb for sip@megatron.ietf.org; Mon, 04 Apr 2005 03:05:30 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA28914 for ; Mon, 4 Apr 2005 03:05:29 -0400 (EDT) Received: from sj-iport-2-in.cisco.com ([171.71.176.71] helo=sj-iport-2.cisco.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DILmF-0005dw-Ve for sip@ietf.org; Mon, 04 Apr 2005 03:13:40 -0400 Received: from sj-core-2.cisco.com (171.71.177.254) by sj-iport-2.cisco.com with ESMTP; 04 Apr 2005 00:05:21 -0700 Received: from mira-sjc5-d.cisco.com (IDENT:mirapoint@mira-sjc5-d.cisco.com [171.71.163.28]) by sj-core-2.cisco.com (8.12.10/8.12.6) with ESMTP id j3475FgE006198; Mon, 4 Apr 2005 00:05:16 -0700 (PDT) Received: from [192.168.1.100] (che-vpn-cluster-1-255.cisco.com [10.86.240.255]) by mira-sjc5-d.cisco.com (MOS 3.4.6-GR) with ESMTP id AJC33105; Mon, 4 Apr 2005 00:05:17 -0700 (PDT) Message-ID: <4250E72D.3080202@cisco.com> Date: Mon, 04 Apr 2005 03:05:17 -0400 From: Jonathan Rosenberg User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7.3) Gecko/20040910 X-Accept-Language: en-us, en MIME-Version: 1.0 To: "Elwell, John" Subject: Re: [Sip] target dialog draft References: <50B1CBA96870A34799A506B2313F266705153FBC@ntht201e.siemenscomms.co.uk> In-Reply-To: <50B1CBA96870A34799A506B2313F266705153FBC@ntht201e.siemenscomms.co.uk> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Score: 0.0 (/) X-Scan-Signature: 52f7a77164458f8c7b36b66787c853da Content-Transfer-Encoding: 7bit Cc: IETF SIP List X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 92df29fa99cf13e554b84c8374345c17 Content-Transfer-Encoding: 7bit Elwell, John wrote: > Jonathan, > > Section 3: > "Typically this is the case when the dialog-initiating request would have > otherwise been sent over an existing dialog, but was not since this > specification allows the request to be sent on a new dialog instead." > This is a bit convoluted. The reason for not using the existing dialog is > that it would introduce problems with dialog reuse etc., as stated earlier > in the document. The mere existence of this target dialog spec is not in > itself sufficient reason for using a new dialog. OK, I reworded. > > In the next paragraph: > Change "sent out a dialog" to "sent outside a dialog". fixed. > > Join and Replaces headers have "to-tag" and "from-tag" with corresponding > text saying how these relate to the local tag and remote tag respectively at > the recipient. Would it not be a good idea to stick to the same parameter > names as Join and Replaces? Likewise the style of BNF is slightly different > from that used in Join and Replaces. Would alignment be sensible? I don't > have a strong opinion on these - just a suggestion. I don't like using those names since they are misleading; whether those identifiers represent the values of a to or from tag depend on whether the user sends or receives a request. However, the local and remote tags are fixed, as they explicitly point to values stored locally in the UA. You are correct though about the grammar style otherwise. I suspect it will confuse people, since the current grammar is more restrictive than Join; the parameter ordering is fixed. That is unusual for our parameters. So, I fixed this to look like the Join syntax. > > What use do you envisage for this new header in an UPDATE request (for which > it is marked optional in figure 4)? Hmm. I think thats a bug. It only makes sense for dialog initiating requests, and that excludes UPDATE. > > The title of figure 4 seems wrong. Oops. Copy-paste error. Thanks for your comments, Jonathan R. -- Jonathan D. Rosenberg, Ph.D. 600 Lanidex Plaza Director, Service Provider VoIP Architecture Parsippany, NJ 07054-2711 Cisco Systems jdrosen@cisco.com FAX: (973) 952-5050 http://www.jdrosen.net PHONE: (973) 952-5000 http://www.cisco.com _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Mon Apr 4 03:33:12 2005 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA01443 for ; Mon, 4 Apr 2005 03:33:12 -0400 (EDT) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DIMD4-0006h6-5k for sip-web-archive@ietf.org; Mon, 04 Apr 2005 03:41:23 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DILwL-00051G-Ap; Mon, 04 Apr 2005 03:24:05 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DILwI-000510-V2 for sip@megatron.ietf.org; Mon, 04 Apr 2005 03:24:03 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA00360 for ; Mon, 4 Apr 2005 03:24:01 -0400 (EDT) Received: from sj-iport-1-in.cisco.com ([171.71.176.70] helo=sj-iport-1.cisco.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DIM4C-0006LD-HY for sip@ietf.org; Mon, 04 Apr 2005 03:32:12 -0400 Received: from sj-core-2.cisco.com (171.71.177.254) by sj-iport-1.cisco.com with ESMTP; 04 Apr 2005 00:23:53 -0700 X-IronPort-AV: i="3.91,145,1110182400"; d="scan'208"; a="625354589:sNHT27449568" Received: from mira-sjc5-d.cisco.com (IDENT:mirapoint@mira-sjc5-d.cisco.com [171.71.163.28]) by sj-core-2.cisco.com (8.12.10/8.12.6) with ESMTP id j347NkgE012632 for ; Mon, 4 Apr 2005 00:23:46 -0700 (PDT) Received: from [192.168.1.100] (che-vpn-cluster-1-255.cisco.com [10.86.240.255]) by mira-sjc5-d.cisco.com (MOS 3.4.6-GR) with ESMTP id AJC33601; Mon, 4 Apr 2005 00:23:50 -0700 (PDT) Message-ID: <4250EB85.8010705@cisco.com> Date: Mon, 04 Apr 2005 03:23:49 -0400 From: Jonathan Rosenberg User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7.3) Gecko/20040910 X-Accept-Language: en-us, en MIME-Version: 1.0 To: IETF SIP List Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Score: 0.0 (/) X-Scan-Signature: 244a2fd369eaf00ce6820a760a3de2e8 Content-Transfer-Encoding: 7bit Subject: [Sip] Target-Dialog draft submitted - open issue around kpml, dialog package X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 4b800b1eab964a31702fa68f1ff0e955 Content-Transfer-Encoding: 7bit Folks, I've updated the target dialog draft based on discussions during IETF and some list comments, and submitted it. Until it appears, you can pick it up at: http://www.jdrosen.net/papers/draft-ietf-sip-target-dialog-00.txt Writing this up did pop out an open issue which we need to resolve. This issue might impact the dialog and kpml package drafts depending on how we go. The issue is this. The target-dialog draft says to include this header field if you need a new request to be authorized by proving that you know about a specific dialog. We made this a header field so that it could work with REFER or SUBSCRIBE or even INVITE. With SUBSCRIBE, however, two of the potential event packages to use this (dialog and kpml), ALREADY have a means of proving that the subscriber knows the target dialog - through the Event header field parameters which each define. Thus, it would seem that including the event header field parameters and target-dialog header field is redundant. I see three solutions: 1. Only include the target-dialog header field when there isn't already something in the message that proves you know the target dialog. The drawback here is that a UA seeking authorization of a request will need to potentially look in several places for proof of dialog awareness. 2. Include both of them. They have different semantics. The event header parameters are basically filters. The target-dialog header field is used to drive authorization. Thus, a single request will often have both containing the same dialog identifiers. One might imagine cases where they aren't the same; i.e. I subscribe using the dialog event package to dialog X, but authorization is based on my awareness of dialog Y. 3. Limit Target-DIalog to REFER, possibly INVITE. (2) is more general but inefficient. (1) is more efficient, and more compatible with how kpml and the dialog event package work today. Going with approach (2) means that both documents might need to be updated; KPML at least probably would. I'm inclined to go for (1), but there was ample arguments in favor of (1) and (2) that I wanted to bring it to the list. The target-dialog draft is currently written assuming solution (2), however. I'd need to update it if we go to (1). I've also updated app-interaction to make usage of target dialog, but I'll wait to submit that until we've concluded this issue. Thanks, Jonathan R. -- Jonathan D. Rosenberg, Ph.D. 600 Lanidex Plaza Director, Service Provider VoIP Architecture Parsippany, NJ 07054-2711 Cisco Systems jdrosen@cisco.com FAX: (973) 952-5050 http://www.jdrosen.net PHONE: (973) 952-5000 http://www.cisco.com _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Mon Apr 4 16:07:42 2005 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA25391 for ; Mon, 4 Apr 2005 16:07:42 -0400 (EDT) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DIXzL-0003g3-So for sip-web-archive@ietf.org; Mon, 04 Apr 2005 16:16:00 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DIXcd-00013K-EO; Mon, 04 Apr 2005 15:52:31 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DIXcY-00011d-Dq; Mon, 04 Apr 2005 15:52:26 -0400 Received: from CNRI.Reston.VA.US (localhost [127.0.0.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA19977; Mon, 4 Apr 2005 15:52:24 -0400 (EDT) Message-Id: <200504041952.PAA19977@ietf.org> Mime-Version: 1.0 Content-Type: Multipart/Mixed; Boundary="NextPart" To: i-d-announce@ietf.org From: Internet-Drafts@ietf.org Date: Mon, 04 Apr 2005 15:52:24 -0400 Cc: sip@ietf.org Subject: [Sip] I-D ACTION:draft-ietf-sip-target-dialog-00.txt X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org X-Spam-Score: 0.4 (/) X-Scan-Signature: e1b0e72ff1bbd457ceef31828f216a86 --NextPart A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Session Initiation Protocol Working Group of the IETF. Title : Request Authorization through Dialog Identification in the Session Initiation Protocol (SIP) Author(s) : J. Rosenberg Filename : draft-ietf-sip-target-dialog-00.txt Pages : 15 Date : 2005-4-4 This specification defines the Target-Dialog header field for the Session Initiation Protocol (SIP), and the corresponding option tag, tdialog. This header field is used in requests that create SIP dialogs. It indicates to the recipient that the sender is aware of an existing dialog with the recipient, either because the sender is on the other side of that dialog, or because it has access to the dialog identifiers. The recipient can then authorize the request based on this awareness. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-sip-target-dialog-00.txt To remove yourself from the I-D Announcement list, send a message to i-d-announce-request@ietf.org with the word unsubscribe in the body of the message. You can also visit https://www1.ietf.org/mailman/listinfo/I-D-announce to change your subscription settings. Internet-Drafts are also available by anonymous FTP. Login with the username "anonymous" and a password of your e-mail address. After logging in, type "cd internet-drafts" and then "get draft-ietf-sip-target-dialog-00.txt". A list of Internet-Drafts directories can be found in http://www.ietf.org/shadow.html or ftp://ftp.ietf.org/ietf/1shadow-sites.txt Internet-Drafts can also be obtained by e-mail. Send a message to: mailserv@ietf.org. In the body type: "FILE /internet-drafts/draft-ietf-sip-target-dialog-00.txt". NOTE: The mail server at ietf.org can return the document in MIME-encoded form by using the "mpack" utility. To use this feature, insert the command "ENCODING mime" before the "FILE" command. To decode the response(s), you will need "munpack" or a MIME-compliant mail reader. Different MIME-compliant mail readers exhibit different behavior, especially when dealing with "multipart" MIME messages (i.e. documents which have been split up into multiple messages), so check your local documentation on how to manipulate these messages. Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: Multipart/Alternative; Boundary="OtherAccess" --OtherAccess Content-Type: Message/External-body; access-type="mail-server"; server="mailserv@ietf.org" Content-Type: text/plain Content-ID: <2005-4-4161628.I-D@ietf.org> ENCODING mime FILE /internet-drafts/draft-ietf-sip-target-dialog-00.txt --OtherAccess Content-Type: Message/External-body; name="draft-ietf-sip-target-dialog-00.txt"; site="ftp.ietf.org"; access-type="anon-ftp"; directory="internet-drafts" Content-Type: text/plain Content-ID: <2005-4-4161628.I-D@ietf.org> --OtherAccess-- --NextPart Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline Content-Transfer-Encoding: 7bit _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip --NextPart-- From sip-bounces@ietf.org Mon Apr 4 16:37:50 2005 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA03434 for ; Mon, 4 Apr 2005 16:37:50 -0400 (EDT) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DIYSV-0006YS-Qn for sip-web-archive@ietf.org; Mon, 04 Apr 2005 16:46:09 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DIXwJ-0000wr-Kf; Mon, 04 Apr 2005 16:12:51 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DIXwH-0000wY-QY for sip@megatron.ietf.org; Mon, 04 Apr 2005 16:12:49 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA26841 for ; Mon, 4 Apr 2005 16:12:48 -0400 (EDT) Received: from voyager.coretrek.no ([212.33.142.2]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DIY4H-0004EH-OI for sip@ietf.org; Mon, 04 Apr 2005 16:21:06 -0400 Received: from localhost (localhost [127.0.0.1]) by voyager.coretrek.no (Postfix) with ESMTP id A36DDA9874; Mon, 4 Apr 2005 22:12:33 +0200 (CEST) Received: from [72.29.231.70] (unknown [72.29.231.70]) by voyager.coretrek.no (Postfix) with ESMTP id 5B8BBA8929; Mon, 4 Apr 2005 22:12:31 +0200 (CEST) In-Reply-To: <4250EB85.8010705@cisco.com> References: <4250EB85.8010705@cisco.com> Mime-Version: 1.0 (Apple Message framework v619.2) Content-Type: text/plain; charset=US-ASCII; format=flowed Message-Id: <58ac5fabce34d2be892f0e219a9affe9@telio.no> Content-Transfer-Encoding: 7bit From: Hisham Khartabil Subject: Re: [Sip] Target-Dialog draft submitted - open issue around kpml, dialog package Date: Mon, 4 Apr 2005 22:12:28 +0200 To: Jonathan Rosenberg X-Mailer: Apple Mail (2.619.2) X-Virus-Scanned: by AMaViS perl-11 (CoreTrek clamav patch 1) X-Spam-Score: 0.0 (/) X-Scan-Signature: b5d20af10c334b36874c0264b10f59f1 Content-Transfer-Encoding: 7bit Cc: IETF SIP List X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 5011df3e2a27abcc044eaa15befcaa87 Content-Transfer-Encoding: 7bit I prefer (1) with a slight modification: you need to say that event packages needing this information are required to choose which mechanism to use and document it. If an event package does not define a mechanism then the target-dialog header should be used. target-dialog extension must not be used with event packages the define where to place such info. I don't think the drawback you mention for 1 is a drawback really. Implementers of an event package that already defines where to find target dialog information (like dialog package) would not use this extension and therefore recipients who also understand the package would not look in 2 places. The package document tells you where to look. Hisham On Apr 4, 2005, at 9:23 AM, Jonathan Rosenberg wrote: > Folks, > > I've updated the target dialog draft based on discussions during IETF > and some list comments, and submitted it. Until it appears, you can > pick it up at: > > http://www.jdrosen.net/papers/draft-ietf-sip-target-dialog-00.txt > > Writing this up did pop out an open issue which we need to resolve. > This issue might impact the dialog and kpml package drafts depending > on how we go. > > The issue is this. The target-dialog draft says to include this header > field if you need a new request to be authorized by proving that you > know about a specific dialog. We made this a header field so that it > could work with REFER or SUBSCRIBE or even INVITE. With SUBSCRIBE, > however, two of the potential event packages to use this (dialog and > kpml), ALREADY have a means of proving that the subscriber knows the > target dialog - through the Event header field parameters which each > define. Thus, it would seem that including the event header field > parameters and target-dialog header field is redundant. > > I see three solutions: > > 1. Only include the target-dialog header field when there isn't > already something in the message that proves you know the target > dialog. The drawback here is that a UA seeking authorization of a > request will need to potentially look in several places for proof of > dialog awareness. > > 2. Include both of them. They have different semantics. The event > header parameters are basically filters. The target-dialog header > field is used to drive authorization. Thus, a single request will > often have both containing the same dialog identifiers. One might > imagine cases where they aren't the same; i.e. I subscribe using the > dialog event package to dialog X, but authorization is based on my > awareness of dialog Y. > > 3. Limit Target-DIalog to REFER, possibly INVITE. > > > > (2) is more general but inefficient. (1) is more efficient, and more > compatible with how kpml and the dialog event package work today. > Going with approach (2) means that both documents might need to be > updated; KPML at least probably would. > > I'm inclined to go for (1), but there was ample arguments in favor of > (1) and (2) that I wanted to bring it to the list. The target-dialog > draft is currently written assuming solution (2), however. I'd need to > update it if we go to (1). > > I've also updated app-interaction to make usage of target dialog, but > I'll wait to submit that until we've concluded this issue. > > Thanks, > Jonathan R. > > > -- > Jonathan D. Rosenberg, Ph.D. 600 Lanidex Plaza > Director, Service Provider VoIP Architecture Parsippany, NJ > 07054-2711 > Cisco Systems > jdrosen@cisco.com FAX: (973) 952-5050 > http://www.jdrosen.net PHONE: (973) 952-5000 > http://www.cisco.com > > _______________________________________________ > Sip mailing list https://www1.ietf.org/mailman/listinfo/sip > This list is for NEW development of the core SIP Protocol > Use sip-implementors@cs.columbia.edu for questions on current sip > Use sipping@ietf.org for new developments on the application of sip > _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Tue Apr 5 06:08:20 2005 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id GAA02318 for ; Tue, 5 Apr 2005 06:08:20 -0400 (EDT) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DIl71-0002Ns-Be for sip-web-archive@ietf.org; Tue, 05 Apr 2005 06:16:47 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DIkuh-0006lk-B0; Tue, 05 Apr 2005 06:04:03 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DIkue-0006lf-RF for sip@megatron.ietf.org; Tue, 05 Apr 2005 06:04:01 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id GAA02031 for ; Tue, 5 Apr 2005 06:03:57 -0400 (EDT) Received: from goliath.siemens.de ([192.35.17.28]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DIl2m-0002Da-AZ for sip@ietf.org; Tue, 05 Apr 2005 06:12:24 -0400 Received: from mail2.siemens.de (mail2.siemens.de [139.25.208.11]) by goliath.siemens.de (8.12.6/8.12.6) with ESMTP id j35A3ptu005395; Tue, 5 Apr 2005 12:03:51 +0200 Received: from mchp9daa.mch.sbs.de (mchp9daa.mch.sbs.de [139.25.137.99]) by mail2.siemens.de (8.12.6/8.12.6) with ESMTP id j35A3o5r017739; Tue, 5 Apr 2005 12:03:50 +0200 Received: by mchp9daa.mch.sbs.de with Internet Mail Service (5.5.2657.72) id <2A168LD4>; Tue, 5 Apr 2005 12:03:50 +0200 Message-ID: From: Fries Steffen To: jon.peterson@neustar.biz, fluffy@cisco.com Date: Tue, 5 Apr 2005 12:03:49 +0200 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2657.72) Content-Type: text/plain X-Spam-Score: 0.0 (/) X-Scan-Signature: ffa9dfbbe7cc58b3fa6b8ae3e57b0aa3 Cc: IETF SIP List Subject: [Sip] Question to Identity draft X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 8abaac9e10c826e8252866cbe6766464 Hi Jon, hi Cullen, by reading the IDs regarding enhanced identity management (draft-ietf-sip-identity-04) and certificate management (draft-ietf-sipping-certs-01) I've got a question to a possible use case. Assumed that two user A and B from two different domains X and Y want to communicate securely. User A sends his INVITE with an attached certificate to User B in domain Y. The INVITE is send through an authentication service, which authenticates (according the identity draft) that the AOR matches the FROM field. Additionally a digital signature is calculated also over the body of the message. Thus also the attached certificate is signed. Using this approach would assure User B that User A has registered with his credentials in domain X. User B could then use the received certificate to communicate securely with user A at least for the duration of the session. User B may also send his certificate to user B also through an authentication service. Within a next session, when both users newly registered, the certificates may be different than in the session before. Is this scenario somehow covered by the identity draft? It could save the credential server in certain scenarios. The approach itself may require an enhanced storing of the username and certificate associations if non-repudiation is desired. Regards Steffen _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Tue Apr 5 07:47:27 2005 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA09714 for ; Tue, 5 Apr 2005 07:47:27 -0400 (EDT) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DImeu-0005df-Ai for sip-web-archive@ietf.org; Tue, 05 Apr 2005 07:55:53 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DImW5-00017b-IW; Tue, 05 Apr 2005 07:46:45 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DIQeg-0006Lu-TZ for sip@megatron.ietf.org; Mon, 04 Apr 2005 08:26:11 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA25435 for ; Mon, 4 Apr 2005 08:26:10 -0400 (EDT) Received: from web54201.mail.yahoo.com ([206.190.39.243]) by ietf-mx.ietf.org with smtp (Exim 4.33) id 1DIQmW-00010F-PO for sip@ietf.org; Mon, 04 Apr 2005 08:34:23 -0400 Received: (qmail 96774 invoked by uid 60001); 4 Apr 2005 12:25:55 -0000 Comment: DomainKeys? See http://antispam.yahoo.com/domainkeys DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.com; b=m0u8RWYoprc8mXAoDM9LPx0mdxwyzOlQaQK9SuWVYfpyKSzTfdzEmElsn2FAi7HcwlibnG8hrlQre93Vgx82qkG9GfaKaiRmYqkRi69pLT3P04sG5Q+LEOGpQWZq28cXjbLuLTM5J7sntNy9rlo+pVFaf/LKsngCM8OmcPFbLB4= ; Message-ID: <20050404122555.96772.qmail@web54201.mail.yahoo.com> Received: from [217.45.197.113] by web54201.mail.yahoo.com via HTTP; Mon, 04 Apr 2005 05:25:54 PDT Date: Mon, 4 Apr 2005 05:25:54 -0700 (PDT) From: Rayees Khan To: rsparks@xten.com MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Spam-Score: 0.0 (/) X-Scan-Signature: 69a74e02bbee44ab4f8eafdbcedd94a1 X-Mailman-Approved-At: Tue, 05 Apr 2005 07:46:42 -0400 Cc: sip@ietf.org, rayees.khan@flextronicssoftware.com Subject: [Sip] Comments : draft-sparks-sip-nit-problems-02 X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: rakhan@hssworld.com List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 21c69d3cfc2dd19218717dbe1d974352 Hi Robert, Please find below the comments I have on the mentioned draft. regards Rayees (Flextronics Software Systems, India) Sedtion 1.1 ----------- o Other option could be to make NITs 3-way handshaked as opposed to the current 2-way one Section 1.3 ----------- o DNS SRV records have a TTL value which is returned along with other params in a DNS SRV query. This parameter can be used to determine when to flush it out from cache o As soon as it is flushed out from cache SIP EP should retry to get the DNS SRV record from DNS o It does make sense to have a black list. However, the question arises again when is an address removed from the blacklist? Should we have a mechanism of pinging the addresses in the blacklist so that if it responds it is removed from the list __________________________________ Do you Yahoo!? Yahoo! Sports - Sign up for Fantasy Baseball. http://baseball.fantasysports.yahoo.com/ _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Tue Apr 5 08:14:14 2005 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA12706 for ; Tue, 5 Apr 2005 08:14:14 -0400 (EDT) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DIn4p-0006zE-To for sip-web-archive@ietf.org; Tue, 05 Apr 2005 08:22:41 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DImW4-00017U-Gr; Tue, 05 Apr 2005 07:46:44 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DIQe4-0006Is-5a for sip@megatron.ietf.org; Mon, 04 Apr 2005 08:25:32 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA25423 for ; Mon, 4 Apr 2005 08:25:31 -0400 (EDT) Received: from [220.117.211.170] (helo=www.nablecomm.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DIQlz-0000zy-Cu for sip@ietf.org; Mon, 04 Apr 2005 08:33:44 -0400 content-class: urn:content-classes:message Subject: [Sip] Question for 'Preconfigured Outbound-Proxy' and 'Out-Dialog Request' MIME-Version: 1.0 Content-Type: text/plain; charset="ks_c_5601-1987" Content-Transfer-Encoding: quoted-printable Date: Mon, 4 Apr 2005 21:25:27 +0900 X-MimeOLE: Produced By Microsoft Exchange V6.0.6249.0 Message-ID: <1BA77CA730953F44B2684FD426A30D65124345@WWW.nablecomm.com> Thread-Topic: [Sip] Question for 'Preconfigured Outbound-Proxy' and 'Out-Dialog Request' Thread-Index: AcU5EWKqFGn1bBa3Q9CXxcxSpvNMHA== From: =?ks_c_5601-1987?B?w9YgvK4=?= To: X-Spam-Score: 0.0 (/) X-Scan-Signature: 9182cfff02fae4f1b6e9349e01d62f32 Content-Transfer-Encoding: quoted-printable X-Mailman-Approved-At: Tue, 05 Apr 2005 07:46:43 -0400 X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: e5ba305d0e64821bf3d8bc5d3bb07228 Content-Transfer-Encoding: quoted-printable Hello. I am Sip Stack Developer and have a question for =A1=AEPreconfigured = Outbound-Proxy=A1=AF and =A1=AEOut-Dialog Request=A1=AF. For example, preconfigured Outboud-Proxy address is = =A1=AEoutbound.domain.com:5060=A1=AF and this request is out dialog. And Request Uri or To Header Field is not equal to outbound proxy. Then which one is correct? Case 1. REGISTER sip:domain.com SIP/2.0 To: Route: ... ... and this message is automatically sent to outbound.domain.com by sip = stack. Case 2. REGISTER sip:domain.com SIP/2.0 To: ... ... and this message is implicitly sent to outbound.domain.com by client = transceiver. _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Tue Apr 5 08:19:17 2005 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA13504 for ; Tue, 5 Apr 2005 08:19:17 -0400 (EDT) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DIn9i-0007Fd-Pu for sip-web-archive@ietf.org; Tue, 05 Apr 2005 08:27:44 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DImW6-00017i-Hx; Tue, 05 Apr 2005 07:46:46 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DIQsq-00071g-NX for sip@megatron.ietf.org; Mon, 04 Apr 2005 08:40:48 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA26614 for ; Mon, 4 Apr 2005 08:40:47 -0400 (EDT) Received: from web54203.mail.yahoo.com ([206.190.39.245]) by ietf-mx.ietf.org with smtp (Exim 4.33) id 1DIR0n-0001aR-4b for sip@ietf.org; Mon, 04 Apr 2005 08:49:01 -0400 Received: (qmail 86908 invoked by uid 60001); 4 Apr 2005 12:40:39 -0000 Comment: DomainKeys? See http://antispam.yahoo.com/domainkeys DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.com; b=FmHlITmkHK/L8bifdxdF4ZQnZjBvJxbTvqnrcPCNpdGVjmc5Nil2Oac3tTn+NV4t58VQ3+Mgm4EFYCLtD1CNwwb3Gf4v7fZ6ts0zx8Sh0zEMZ+t6H1ENqqHOcs1KV1xAmC5Y/VRwbaHWW4a95Lgm6n9scJS4BaG/jujw1UOfCMs= ; Message-ID: <20050404124039.86906.qmail@web54203.mail.yahoo.com> Received: from [217.45.197.113] by web54203.mail.yahoo.com via HTTP; Mon, 04 Apr 2005 05:40:39 PDT Date: Mon, 4 Apr 2005 05:40:39 -0700 (PDT) From: Rayees Khan To: rsparks@xten.com MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="0-967020315-1112618439=:84214" X-Spam-Score: 0.0 (/) X-Scan-Signature: a7d2e37451f7f22841e3b6f40c67db0f X-Mailman-Approved-At: Tue, 05 Apr 2005 07:46:42 -0400 Cc: sip@ietf.org, rayees.khan@flextronicssoftware.com Subject: [Sip] Fwd: Comments : draft-sparks-sip-nit-problems-02 X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: rakhan@hssworld.com List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 6ffdee8af20de249c24731d8414917d3 --0-967020315-1112618439=:84214 Content-Type: text/plain; charset=us-ascii Content-Id: Content-Disposition: inline Note: forwarded message attached. __________________________________ Do you Yahoo!? Yahoo! Small Business - Try our new resources site! http://smallbusiness.yahoo.com/resources/ --0-967020315-1112618439=:84214 Content-Type: message/rfc822 X-Apparently-To: rakhanhss@yahoo.com via 206.190.39.251; Mon, 04 Apr 2005 05:26:12 -0700 Authentication-Results: mta138.mail.sc5.yahoo.com from=yahoo.com; domainkeys=fail (bad sig) X-Originating-IP: [203.200.71.140] Return-Path: Received: from 203.200.71.140 (EHLO spark.hss.co.in) (203.200.71.140) by mta138.mail.sc5.yahoo.com with SMTP; Mon, 04 Apr 2005 05:26:12 -0700 Received: from spark.hss.co.in (localhost [127.0.0.1]) by spark.hss.co.in (8.12.10/8.12.10) with ESMTP id j34CMBP4005706 for ; Mon, 4 Apr 2005 17:52:12 +0530 (IST) Received: from ultra.hss.co.in (ultra [192.168.100.5] (may be forged)) by spark.hss.co.in (8.12.10/8.12.10) with ESMTP id j34CMB6c005703 for ; Mon, 4 Apr 2005 17:52:11 +0530 (IST) Received: from sandesh.hss.hns.com (localhost [127.0.0.1]) by ultra.hss.co.in (8.10.0/8.10.0) with ESMTP id j34CR8901881 for ; Mon, 4 Apr 2005 17:57:08 +0530 (IST) Received: from ultra.hss.co.in ([192.168.100.5]) by sandesh.hss.hns.com (Lotus Domino Release 6.0) with ESMTP id 2005040418023335-171876 ; Mon, 4 Apr 2005 18:02:33 +0530 Received: from spark.hss.co.in (localhost [127.0.0.1]) by ultra.hss.co.in (8.10.0/8.10.0) with ESMTP id j34CR5b01878 for ; Mon, 4 Apr 2005 17:57:05 +0530 (IST) Received: from spark.hss.co.in (localhost [127.0.0.1]) by spark.hss.co.in (8.12.10/8.12.10) with ESMTP id j34CM5P4005679 for ; Mon, 4 Apr 2005 17:52:05 +0530 (IST) Received: from web54201.mail.yahoo.com (web54201.mail.yahoo.com [206.190.39.243]) by spark.hss.co.in (8.12.10/8.12.10) with SMTP id j34CM16c005655 for ; Mon, 4 Apr 2005 17:52:04 +0530 (IST) Received: (qmail 96774 invoked by uid 60001); 4 Apr 2005 12:25:55 -0000 Comment: DomainKeys? See http://antispam.yahoo.com/domainkeys DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.com; b=m0u8RWYoprc8mXAoDM9LPx0mdxwyzOlQaQK9SuWVYfpyKSzTfdzEmElsn2FAi7HcwlibnG8hrlQre93Vgx82qkG9GfaKaiRmYqkRi69pLT3P04sG5Q+LEOGpQWZq28cXjbLuLTM5J7sntNy9rlo+pVFaf/LKsngCM8OmcPFbLB4= ; Received: from [217.45.197.113] by web54201.mail.yahoo.com via HTTP; Mon, 04 Apr 2005 05:25:54 PDT Date: Mon, 4 Apr 2005 05:25:54 -0700 (PDT) From: Rayees Khan Reply-To: rakhanhss@yahoo.com Subject: Comments : draft-sparks-sip-nit-problems-02 To: rsparks@xten.com Cc: sip@ietf.org, rakhanhss@yahoo.com MIME-Version: 1.0 X-MIMETrack: Itemize by SMTP Server on Sandesh/HSS(Release 6.0|September 26, 2002) at 04/04/2005 06:02:33 PM, Serialize by Router on Sandesh/HSS(Release 6.0|September 26, 2002) at 04/04/2005 06:02:34 PM, Serialize complete at 04/04/2005 06:02:34 PM Content-Type: text/plain; charset=us-ascii Content-Length: 929 Hi Robert, Please find below the comments I have on the mentioned draft. regards Rayees (Flextronics Software Systems, India) Sedtion 1.1 ----------- o Other option could be to make NITs 3-way handshaked as opposed to the current 2-way one Section 1.3 ----------- o DNS SRV records have a TTL value which is returned along with other params in a DNS SRV query. This parameter can be used to determine when to flush it out from cache o As soon as it is flushed out from cache SIP EP should retry to get the DNS SRV record from DNS o It does make sense to have a black list. However, the question arises again when is an address removed from the blacklist? Should we have a mechanism of pinging the addresses in the blacklist so that if it responds it is removed from the list __________________________________ Do you Yahoo!? Yahoo! Sports - Sign up for Fantasy Baseball. http://baseball.fantasysports.yahoo.com/ --0-967020315-1112618439=:84214 Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline Content-Transfer-Encoding: 7bit _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip --0-967020315-1112618439=:84214-- From sip-bounces@ietf.org Tue Apr 5 12:19:31 2005 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA05595 for ; Tue, 5 Apr 2005 12:19:31 -0400 (EDT) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DIquH-0007gA-CA for sip-web-archive@ietf.org; Tue, 05 Apr 2005 12:28:01 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DIqgc-00064p-Nn; Tue, 05 Apr 2005 12:13:54 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DIqga-00064h-GZ for sip@megatron.ietf.org; Tue, 05 Apr 2005 12:13:53 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA04908 for ; Tue, 5 Apr 2005 12:13:49 -0400 (EDT) Received: from salvelinus.brooktrout.com ([204.176.205.6]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DIqol-0007Qt-5r for sip@ietf.org; Tue, 05 Apr 2005 12:22:19 -0400 Received: from nhmail2.needham.brooktrout.com (nhmail2.brooktrout.com [204.176.205.242]) by salvelinus.brooktrout.com (8.12.5/8.12.5) with ESMTP id j35G8xlp017974; Tue, 5 Apr 2005 12:09:00 -0400 (EDT) Received: by nhmail2.brooktrout.com with Internet Mail Service (5.5.2653.19) id ; Tue, 5 Apr 2005 12:04:48 -0400 Message-ID: From: Eric Burger To: Hisham Khartabil , Jonathan Rosenberg Subject: RE: [Sip] Target-Dialog draft submitted - open issue around kpml, dialog package Date: Tue, 5 Apr 2005 12:04:47 -0400 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2653.19) Content-Type: text/plain X-Spam-Score: 0.0 (/) X-Scan-Signature: 22bbb45ef41b733eb2d03ee71ece8243 Cc: IETF SIP List X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: dbb8771284c7a36189745aa720dc20ab We also prefer (1), and, being a "legacy" event package, KPML uses the mechanism documented in the draft. > -----Original Message----- > From: sip-bounces@ietf.org [mailto:sip-bounces@ietf.org]On Behalf Of > Hisham Khartabil > Sent: Monday, April 04, 2005 4:12 PM > To: Jonathan Rosenberg > Cc: IETF SIP List > Subject: Re: [Sip] Target-Dialog draft submitted - open issue around > kpml, dialog package > > > I prefer (1) with a slight modification: you need to say that event > packages needing this information are required to choose which > mechanism to use and document it. If an event package does > not define a > mechanism then the target-dialog header should be used. target-dialog > extension must not be used with event packages the define where to > place such info. > > I don't think the drawback you mention for 1 is a drawback really. > Implementers of an event package that already defines where to find > target dialog information (like dialog package) would not use this > extension and therefore recipients who also understand the package > would not look in 2 places. The package document tells you where to > look. > > Hisham > > On Apr 4, 2005, at 9:23 AM, Jonathan Rosenberg wrote: > > > Folks, > > > > I've updated the target dialog draft based on discussions > during IETF > > and some list comments, and submitted it. Until it appears, you can > > pick it up at: > > > > http://www.jdrosen.net/papers/draft-ietf-sip-target-dialog-00.txt > > > > Writing this up did pop out an open issue which we need to resolve. > > This issue might impact the dialog and kpml package drafts > depending > > on how we go. > > > > The issue is this. The target-dialog draft says to include > this header > > field if you need a new request to be authorized by proving > that you > > know about a specific dialog. We made this a header field > so that it > > could work with REFER or SUBSCRIBE or even INVITE. With SUBSCRIBE, > > however, two of the potential event packages to use this > (dialog and > > kpml), ALREADY have a means of proving that the subscriber > knows the > > target dialog - through the Event header field parameters > which each > > define. Thus, it would seem that including the event header field > > parameters and target-dialog header field is redundant. > > > > I see three solutions: > > > > 1. Only include the target-dialog header field when there isn't > > already something in the message that proves you know the target > > dialog. The drawback here is that a UA seeking authorization of a > > request will need to potentially look in several places for > proof of > > dialog awareness. > > > > 2. Include both of them. They have different semantics. The event > > header parameters are basically filters. The target-dialog header > > field is used to drive authorization. Thus, a single request will > > often have both containing the same dialog identifiers. One might > > imagine cases where they aren't the same; i.e. I subscribe > using the > > dialog event package to dialog X, but authorization is based on my > > awareness of dialog Y. > > > > 3. Limit Target-DIalog to REFER, possibly INVITE. > > > > > > > > (2) is more general but inefficient. (1) is more efficient, > and more > > compatible with how kpml and the dialog event package work today. > > Going with approach (2) means that both documents might need to be > > updated; KPML at least probably would. > > > > I'm inclined to go for (1), but there was ample arguments > in favor of > > (1) and (2) that I wanted to bring it to the list. The > target-dialog > > draft is currently written assuming solution (2), however. > I'd need to > > update it if we go to (1). > > > > I've also updated app-interaction to make usage of target > dialog, but > > I'll wait to submit that until we've concluded this issue. > > > > Thanks, > > Jonathan R. > > > > > > -- > > Jonathan D. Rosenberg, Ph.D. 600 Lanidex Plaza > > Director, Service Provider VoIP Architecture Parsippany, NJ > > 07054-2711 > > Cisco Systems > > jdrosen@cisco.com FAX: (973) 952-5050 > > http://www.jdrosen.net PHONE: (973) 952-5000 > > http://www.cisco.com > > > > _______________________________________________ > > Sip mailing list https://www1.ietf.org/mailman/listinfo/sip > > This list is for NEW development of the core SIP Protocol > > Use sip-implementors@cs.columbia.edu for questions on current sip > > Use sipping@ietf.org for new developments on the application of sip > > > > > _______________________________________________ > Sip mailing list https://www1.ietf.org/mailman/listinfo/sip > This list is for NEW development of the core SIP Protocol > Use sip-implementors@cs.columbia.edu for questions on current sip > Use sipping@ietf.org for new developments on the application of sip > _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Tue Apr 5 17:26:48 2005 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA18893 for ; Tue, 5 Apr 2005 17:26:48 -0400 (EDT) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DIvhg-0007Ey-UP for sip-web-archive@ietf.org; Tue, 05 Apr 2005 17:35:21 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DIvTK-0007xf-8M; Tue, 05 Apr 2005 17:20:30 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DIvTJ-0007xa-3n for sip@megatron.ietf.org; Tue, 05 Apr 2005 17:20:29 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA18328 for ; Tue, 5 Apr 2005 17:20:26 -0400 (EDT) Received: from oak.neustar.com ([209.173.53.70]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DIvbW-0006vr-OA for sip@ietf.org; Tue, 05 Apr 2005 17:28:59 -0400 Received: from stntsmtp1.cis.neustar.com (smartexch.neustar.com [10.31.13.79]) by oak.neustar.com (8.12.8/8.11.0) with ESMTP id j35LKIKD018292; Tue, 5 Apr 2005 21:20:18 GMT Received: from stntexch03.cis.neustar.com ([10.31.13.45]) by stntsmtp1.cis.neustar.com with Microsoft SMTPSVC(6.0.3790.211); Tue, 5 Apr 2005 17:20:17 -0400 X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Date: Tue, 5 Apr 2005 17:20:17 -0400 Message-ID: <24EAE5D4448B9D4592C6D234CBEBD59701502E08@stntexch03.cis.neustar.com> Thread-Topic: Question to Identity draft Thread-Index: AcU5xsryixFnhrqeRzGQARgiqz5p5AASIz5A From: "Peterson, Jon" To: "Fries Steffen" , X-OriginalArrivalTime: 05 Apr 2005 21:20:17.0741 (UTC) FILETIME=[43E80FD0:01C53A25] X-Spam-Score: 0.0 (/) X-Scan-Signature: d8ae4fd88fcaf47c1a71c804d04f413d Content-Transfer-Encoding: quoted-printable Cc: IETF SIP List Subject: [Sip] RE: Question to Identity draft X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: d185fa790257f526fedfd5d01ed9c976 Content-Transfer-Encoding: quoted-printable Your question points to an important difference in applicability between = sip-identity-04 and sipping-certs-01, and it is essentially a matter of = what you mean by "communicate securely". The primary differences between sip-identity-04 and sipping-certs-01 lie = in what they require user agents to support and what security services = they offer. sip-identity-04 offers an integrity and replay protection = service, whereas sipping-certs-01 offers a full suit of MIME security = services including confidentiality (the cost of course being that UAs = must support S/MIME and the certificate acquisition service). The method of exchanging certificates within SIP messages which you = describe below was subtantially documented in RFC3261. There's no doubt = the integrity provided by sip-identity-04 could help to secure = certificates exchanged in this manner. But the question is what security = properties you want to derive from this practice. If you want to use the = exchanged certificates for integrity, then well, sip-identity-04 already = provides integrity. If you want to use the exchanged certificates for = confidentiality, then you get the bootstrapping problem - how does the = sender of the INVITE learn the key they must use to encrypt the body of = their request? This is the purpose of the certificate server, and of = sipping-certs-01. I doubt that exchanging certificates within INVITEs = and so on will prove more servicable. Jon Peterson NeuStar, Inc. > -----Original Message----- > From: Fries Steffen [mailto:steffen.fries@siemens.com] > Sent: Tuesday, April 05, 2005 3:04 AM > To: Peterson, Jon; fluffy@cisco.com > Cc: IETF SIP List > Subject: Question to Identity draft >=20 >=20 > Hi Jon, hi Cullen, >=20 > by reading the IDs regarding enhanced identity management > (draft-ietf-sip-identity-04) and certificate management > (draft-ietf-sipping-certs-01) I've got a question to a=20 > possible use case.=20 >=20 > Assumed that two user A and B from two different domains X=20 > and Y want to > communicate securely. User A sends his INVITE with an=20 > attached certificate > to User B in domain Y. The INVITE is send through an=20 > authentication service, > which authenticates (according the identity draft) that the=20 > AOR matches the > FROM field. Additionally a digital signature is calculated=20 > also over the > body of the message. Thus also the attached certificate is=20 > signed. Using > this approach would assure User B that User A has registered with his > credentials in domain X. User B could then use the received=20 > certificate to > communicate securely with user A at least for the duration of=20 > the session. > User B may also send his certificate to user B also through an > authentication service. Within a next session, when both users newly > registered, the certificates may be different than in the=20 > session before. >=20 > Is this scenario somehow covered by the identity draft? It=20 > could save the > credential server in certain scenarios. The approach itself=20 > may require an > enhanced storing of the username and certificate associations if > non-repudiation is desired. >=20 > Regards=09 > Steffen >=20 _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Tue Apr 5 19:45:06 2005 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA01885 for ; Tue, 5 Apr 2005 19:45:06 -0400 (EDT) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DIxrX-0003rc-UX for sip-web-archive@ietf.org; Tue, 05 Apr 2005 19:53:41 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DIxdq-0001tU-2p; Tue, 05 Apr 2005 19:39:30 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DIxdo-0001sU-Dy for sip@megatron.ietf.org; Tue, 05 Apr 2005 19:39:28 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA01252 for ; Tue, 5 Apr 2005 19:39:24 -0400 (EDT) Received: from oak.neustar.com ([209.173.53.70]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DIxm2-0003an-2r for sip@ietf.org; Tue, 05 Apr 2005 19:47:59 -0400 Received: from stntsmtp1.cis.neustar.com (smartexch.neustar.com [10.31.13.79]) by oak.neustar.com (8.12.8/8.11.0) with ESMTP id j35NdHKD023484 for ; Tue, 5 Apr 2005 23:39:17 GMT Received: from stntexch03.cis.neustar.com ([10.31.13.45]) by stntsmtp1.cis.neustar.com with Microsoft SMTPSVC(6.0.3790.211); Tue, 5 Apr 2005 19:39:17 -0400 X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Date: Tue, 5 Apr 2005 19:39:17 -0400 Message-ID: <24EAE5D4448B9D4592C6D234CBEBD59701502E0C@stntexch03.cis.neustar.com> Thread-Topic: sip-identity-05: display-name woes Thread-Index: AcU6OJk6PuoQdH+tQlaJE8Tb4dlQ7w== From: "Peterson, Jon" To: X-OriginalArrivalTime: 05 Apr 2005 23:39:17.0434 (UTC) FILETIME=[AEC039A0:01C53A38] X-Spam-Score: 0.0 (/) X-Scan-Signature: b280b4db656c3ca28dd62e5e0b03daa8 Content-Transfer-Encoding: quoted-printable Subject: [Sip] sip-identity-05: display-name woes X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 10d3e4e3c32e363f129e380e644649be Content-Transfer-Encoding: quoted-printable In Minneapolis, Jonathan raised the prospect that the Identity header = field should contain a signature over the display-name portion of the = >From header field value. This is attractive because SIP user agent = implementations might render only that display-name to their users when = an INVITE is received. Accordingly, securing display-name is very useful = for human authorization decisions. After some cajoling, I hastily agreed = that we could do this for sip-identity-05. As I've worked towards a revision, though, I've become convinced that = this is more complicated than I initially thought. At the root of the = problem is the extremely rigid nature of the sip-identity mechanism. It = is intentionally hostile to being "configurable" in any way; there are = currently no reference indicators whose inclusion in the Identity = signature is optional. If a reference indicator is present in the = request, it appears in the identity-string (which is hashed and signed = to form the contents of the Identity header field); if it isn't present = in the request, the corresponding field of the identity-string is blank. This does not interact well with identity-string elements that might or = might not be added by the authentication service depending on its = policies or capabilities. Unfortunately, it is difficult to anticipate = how the operator of an authentication service might decide whether or = not a human-readable free text field like the display-name is = appropriate, and accordingly, we can't expect every authentication = service operator to have such policies. At a mechanism level, the problem is how we express all of the following = conditions in the identity string: - The display-name is present in the request, and it is has been = authorized by the domain. - The display-name is present in the request, but the domain has no = authorization policies related to display-names. - The display-name is not present in the request. Here are a few options as to how we might approach this: (A) If the display-name is present, include it in the identity string no = matter what. Of course, then the problem is that the verifier has no way = of knowing whether or not the domain actually employed any policies to = validate the display-name. Accordingly, it really doesn't add much value = for the verifier. (B) If the display-name is present and authorized, include it, and also = include some other flag somewhere in the message (in the Identity or = Identity-Info headers, probably) noting that this authentication service = enforces display-name policies. I am reluctant to start going down this = path because it introduces variable reference indicators, which are a = notorious source of bid-down attacks. That flag, wherever it resides, = must then also be secured by the Identity header or it might be removed = by someone replaying the message. Once we start going down this path, it = also becomes something of a slippery slope - why not also have a flag = for other common SIP headers that might optionally be included, and = which could conceivably be evaluated by an authentication service? All = of this makes the verification processing more complicated as well; the = margin of error in the regeneration of the hash and string increases. (C) If the display-name is present and authorized, include it. If the = display-name is present but the domain has no display-name policies, = then rather than include it, include some fixed value in the identity = string like 'no-display-policies' in the slot that would ordinarily be = occupied by the display-name value. That is kinda kludgey, but gets the = message across to the verifier loud and clear. (D) If the display-name is present and authorized, include it. If the = display-name is present but unauthorized, then don't include it in the = identity-string, and also strip it from the From header field of the = request. This is undesirable because proxy server should not be mucking = with the From header field unless they want to be called names like = 'B2BUA' or what have you. Simplest from a verification perspective, = though. (E) Give up on including display-name. People should learn to make user = agents that render addr-specs to their users instead of/in addition to = display-names. Unlikely that any domain will have policies about this = anyway (it certainly never caught on for email). Any better ideas, or barring that, any preferences among the above? Jon Peterson NeuStar, Inc. _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Tue Apr 5 20:05:18 2005 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA03158 for ; Tue, 5 Apr 2005 20:05:17 -0400 (EDT) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DIyB6-0004Z0-F0 for sip-web-archive@ietf.org; Tue, 05 Apr 2005 20:13:53 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DIy2O-0000hD-UU; Tue, 05 Apr 2005 20:04:52 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DIy2M-0000gu-MS for sip@megatron.ietf.org; Tue, 05 Apr 2005 20:04:50 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA03133 for ; Tue, 5 Apr 2005 20:04:46 -0400 (EDT) Received: from zrtps0kp.nortelnetworks.com ([47.140.192.56]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DIyAa-0004Y7-Fv for sip@ietf.org; Tue, 05 Apr 2005 20:13:21 -0400 Received: from zrtpd0jn.us.nortel.com (zrtpd0jn.us.nortel.com [47.140.202.35]) by zrtps0kp.nortelnetworks.com (Switch-2.2.6/Switch-2.2.0) with ESMTP id j3604NW16191; Tue, 5 Apr 2005 20:04:23 -0400 (EDT) Received: by zrtpd0jn.us.nortel.com with Internet Mail Service (5.5.2653.19) id <2KL1NA36>; Tue, 5 Apr 2005 20:04:23 -0400 Message-ID: <1ECE0EB50388174790F9694F77522CCF01DE8F92@zrc2hxm0.corp.nortel.com> From: "Francois Audet" To: "'Peterson, Jon'" , "'Fries Steffen'" , "'fluffy@cisco.com'" Subject: RE: [Sip] RE: Question to Identity draft Date: Tue, 5 Apr 2005 20:04:15 -0400 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2653.19) X-Spam-Score: 0.5 (/) X-Scan-Signature: 4c358d334afcd91b425d436ca5722f22 Cc: "'IETF SIP List'" X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============0139838448==" Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org X-Spam-Score: 0.5 (/) X-Scan-Signature: 441f623df000f14368137198649cb083 This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. --===============0139838448== Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C53A3C.2BFD6A22" This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. ------_=_NextPart_001_01C53A3C.2BFD6A22 Content-Type: text/plain There is still many cases where the sipping-certs does not work properly, which I think could be addressed by something along the lines of sip-identity and what Steffen is talking about. I think it would complement sipping-certs very well. For example, it is often not the case that sipping-certs will be able to fetch the certificate of the UA that will answer the session. For example: - The target corresponds to a group of people, say in a call center, a hunt group or something along those lines. In many cases, it may not be feasible, or even desireable that all these people share the same certificate. - Retargeting will also not work. By retargetting, I am including any time of forking, forwarding and so forth where the targets correspond to people with different certificates. - The target is a "moving target". For example, it could be a bank of gateways, media servers, IVR systems or whatever. (I guess all those cases are a form of retargeting because the responder is not who was in the initial request). In those cases, you can send SUBSCRIBEs as much as you want, but you won't get a usable certificate because the INVITE after the SUBSCRIBE is not going to land at the same place. If instead something along lines of sip-indentity was used (even in conjunction with sipping-certs), I think we can get rid of the bootstrap problem you refer to, by having a two-pass process. What I am pointing out is the bootstrap problem may exist as well with sipping-certs. In fact, it can be worst in the sense that it would get in an infinite loop of retrying because the target keeps on moving. Assume A always includes it's certificate when it calls B. If A had access to B's certificate beforehand (using certs), then no problem. It works exactly as per sipping-certs. If A couldn't get access to B's certificate beforehand, or if it turns out to be the wrong B, then B would receive the request, but the key (as per your example) would be wrong. B should be able to provide it's certificate to A in the same session, so that the session could be renegotiated (if A whishes to do so). For example, I can think of the following mechanism: - B rejects the request with error code XXX and includes it's certificate in the response. B also includes a Contact. - A examines the certificate (and Contact), and determine if it will re-initiate the request or not, based on it's own local criteria (is C already trusted, etc.). One use case of course for this is encryption (sRTP). It would work equally well with SDESC and with MIKEY/kmgmt. > -----Original Message----- > From: sip-bounces@ietf.org [mailto:sip-bounces@ietf.org] On > Behalf Of Peterson, Jon > Sent: Tuesday, April 05, 2005 14:20 > To: Fries Steffen; fluffy@cisco.com > Cc: IETF SIP List > Subject: [Sip] RE: Question to Identity draft > > > > Your question points to an important difference in > applicability between sip-identity-04 and sipping-certs-01, > and it is essentially a matter of what you mean by > "communicate securely". > > The primary differences between sip-identity-04 and > sipping-certs-01 lie in what they require user agents to > support and what security services they offer. > sip-identity-04 offers an integrity and replay protection > service, whereas sipping-certs-01 offers a full suit of MIME > security services including confidentiality (the cost of > course being that UAs must support S/MIME and the certificate > acquisition service). > > The method of exchanging certificates within SIP messages > which you describe below was subtantially documented in > RFC3261. There's no doubt the integrity provided by > sip-identity-04 could help to secure certificates exchanged > in this manner. But the question is what security properties > you want to derive from this practice. If you want to use the > exchanged certificates for integrity, then well, > sip-identity-04 already provides integrity. If you want to > use the exchanged certificates for confidentiality, then you > get the bootstrapping problem - how does the sender of the > INVITE learn the key they must use to encrypt the body of > their request? This is the purpose of the certificate server, > and of sipping-certs-01. I doubt that exchanging certificates > within INVITEs and so on will prove more servicable. > > Jon Peterson > NeuStar, Inc. > > > -----Original Message----- > > From: Fries Steffen [mailto:steffen.fries@siemens.com] > > Sent: Tuesday, April 05, 2005 3:04 AM > > To: Peterson, Jon; fluffy@cisco.com > > Cc: IETF SIP List > > Subject: Question to Identity draft > > > > > > Hi Jon, hi Cullen, > > > > by reading the IDs regarding enhanced identity management > > (draft-ietf-sip-identity-04) and certificate management > > (draft-ietf-sipping-certs-01) I've got a question to a > > possible use case. > > > > Assumed that two user A and B from two different domains X > > and Y want to > > communicate securely. User A sends his INVITE with an > > attached certificate > > to User B in domain Y. The INVITE is send through an > > authentication service, > > which authenticates (according the identity draft) that the > > AOR matches the > > FROM field. Additionally a digital signature is calculated > > also over the > > body of the message. Thus also the attached certificate is > > signed. Using > > this approach would assure User B that User A has > registered with his > > credentials in domain X. User B could then use the received > > certificate to > > communicate securely with user A at least for the duration of > > the session. > > User B may also send his certificate to user B also through an > > authentication service. Within a next session, when both users newly > > registered, the certificates may be different than in the > > session before. > > > > Is this scenario somehow covered by the identity draft? It > > could save the > > credential server in certain scenarios. The approach itself > > may require an > > enhanced storing of the username and certificate associations if > > non-repudiation is desired. > > > > Regards > > Steffen > > > > _______________________________________________ > Sip mailing list https://www1.ietf.org/mailman/listinfo/sip > This list is for NEW development of the core SIP Protocol > Use sip-implementors@cs.columbia.edu for questions on current > sip Use sipping@ietf.org for new developments on the > application of sip > > ------_=_NextPart_001_01C53A3C.2BFD6A22 Content-Type: text/html RE: [Sip] RE: Question to Identity draft

There is still many cases where the sipping-certs does not work
properly, which I think could be addressed by something along
the lines of sip-identity and what Steffen is talking about.
I think it would complement sipping-certs very well.

For example, it is often not the case that sipping-certs
will be able to fetch the certificate of the
UA that will answer the session. For example:

- The target corresponds to a group of people, say in
  a call center, a hunt group or something along those
  lines. In many cases, it may not be feasible, or
  even desireable that all these people share the same
  certificate.

- Retargeting will also not work. By retargetting, I am
  including any time of forking, forwarding and so forth
  where the targets correspond to people with different
  certificates.

- The target is a "moving target". For example, it could
  be a bank of gateways, media servers, IVR systems or
  whatever.

(I guess all those cases are a form of retargeting because
the responder is not who was in the initial request).

In those cases, you can send SUBSCRIBEs as much as you want,
but you won't get a usable certificate because the INVITE
after the SUBSCRIBE is not going to land at the same place.

If instead something along lines of sip-indentity was used
(even in conjunction with sipping-certs), I think we can get
rid of the bootstrap problem you refer to, by having a two-pass
process.

What I am pointing out is the bootstrap problem may exist
as well with sipping-certs. In fact, it can be worst in the sense
that it would get in an infinite loop of retrying because the
target keeps on moving.

Assume A always includes it's certificate when it calls B.
If A had access to B's certificate beforehand (using certs), then
no problem. It works exactly as per sipping-certs.

If A couldn't get access to B's certificate beforehand, or if
it turns out to be the wrong B, then B would receive the
request, but the key (as per your example) would be wrong. B should
be able to provide it's certificate to A in the same session, so
that the session could be renegotiated (if A whishes to do so).

For example, I can think of the following mechanism:

- B rejects the request with error code XXX and includes it's certificate
  in the response. B also includes a Contact.

- A examines the certificate (and Contact), and determine if it will
  re-initiate the request or not, based on it's own local criteria
  (is C already trusted, etc.).
 
One use case of course for this is encryption (sRTP). It would work equally
well with SDESC and with MIKEY/kmgmt.



> -----Original Message-----
> From: sip-bounces@ietf.org [mailto:sip-bounces@ietf.org] On
> Behalf Of Peterson, Jon
> Sent: Tuesday, April 05, 2005 14:20
> To: Fries Steffen; fluffy@cisco.com
> Cc: IETF SIP List
> Subject: [Sip] RE: Question to Identity draft
>
>
>
> Your question points to an important difference in
> applicability between sip-identity-04 and sipping-certs-01,
> and it is essentially a matter of what you mean by
> "communicate securely".
>
> The primary differences between sip-identity-04 and
> sipping-certs-01 lie in what they require user agents to
> support and what security services they offer.
> sip-identity-04 offers an integrity and replay protection
> service, whereas sipping-certs-01 offers a full suit of MIME
> security services including confidentiality (the cost of
> course being that UAs must support S/MIME and the certificate
> acquisition service).
>
> The method of exchanging certificates within SIP messages
> which you describe below was subtantially documented in
> RFC3261. There's no doubt the integrity provided by
> sip-identity-04 could help to secure certificates exchanged
> in this manner. But the question is what security properties
> you want to derive from this practice. If you want to use the
> exchanged certificates for integrity, then well,
> sip-identity-04 already provides integrity. If you want to
> use the exchanged certificates for confidentiality, then you
> get the bootstrapping problem - how does the sender of the
> INVITE learn the key they must use to encrypt the body of
> their request? This is the purpose of the certificate server,
> and of sipping-certs-01. I doubt that exchanging certificates
> within INVITEs and so on will prove more servicable.
>
> Jon Peterson
> NeuStar, Inc.
>
> > -----Original Message-----
> > From: Fries Steffen [mailto:steffen.fries@siemens.com]
> > Sent: Tuesday, April 05, 2005 3:04 AM
> > To: Peterson, Jon; fluffy@cisco.com
> > Cc: IETF SIP List
> > Subject: Question to Identity draft
> >
> >
> > Hi Jon, hi Cullen,
> >
> > by reading the IDs regarding enhanced identity management
> > (draft-ietf-sip-identity-04) and certificate management
> > (draft-ietf-sipping-certs-01) I've got a question to a
> > possible use case.
> >
> > Assumed that two user A and B from two different domains X
> > and Y want to
> > communicate securely. User A sends his INVITE with an
> > attached certificate
> > to User B in domain Y. The INVITE is send through an
> > authentication service,
> > which authenticates (according the identity draft) that the
> > AOR matches the
> > FROM field. Additionally a digital signature is calculated
> > also over the
> > body of the message. Thus also the attached certificate is
> > signed. Using
> > this approach would assure User B that User A has
> registered with his
> > credentials in domain X. User B could then use the received
> > certificate to
> > communicate securely with user A at least for the duration of
> > the session.
> > User B may also send his certificate to user B also through an
> > authentication service. Within a next session, when both users newly
> > registered, the certificates may be different than in the
> > session before.
> >
> > Is this scenario somehow covered by the identity draft? It
> > could save the
> > credential server in certain scenarios. The approach itself
> > may require an
> > enhanced storing of the username and certificate associations if
> > non-repudiation is desired.
> >
> > Regards    
> >     Steffen
> >
>
> _______________________________________________
> Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
> This list is for NEW development of the core SIP Protocol
> Use sip-implementors@cs.columbia.edu for questions on current
> sip Use sipping@ietf.org for new developments on the
> application of sip
>
>

------_=_NextPart_001_01C53A3C.2BFD6A22-- --===============0139838448== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline Content-Transfer-Encoding: 7bit _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip --===============0139838448==-- From sip-bounces@ietf.org Wed Apr 6 01:11:35 2005 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA25009 for ; Wed, 6 Apr 2005 01:11:35 -0400 (EDT) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJ2xW-000656-97 for sip-web-archive@ietf.org; Wed, 06 Apr 2005 01:20:10 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJ2ml-0007G1-Ki; Wed, 06 Apr 2005 01:09:03 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJ2mi-0007DK-81 for sip@megatron.ietf.org; Wed, 06 Apr 2005 01:09:01 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA24750 for ; Wed, 6 Apr 2005 01:08:59 -0400 (EDT) Received: from nylon.softarmor.com ([66.135.38.164]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJ2uz-0005xD-8E for sip@ietf.org; Wed, 06 Apr 2005 01:17:34 -0400 Received: from [206.176.144.210] (206-176-144-210.waymark.net [206.176.144.210] (may be forged)) (authenticated bits=0) by nylon.softarmor.com (8.13.1/8.12.11) with ESMTP id j365B2Zv005857 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Wed, 6 Apr 2005 00:11:02 -0500 Message-ID: <42537187.1050107@softarmor.com> Date: Wed, 06 Apr 2005 00:20:07 -0500 From: Dean Willis User-Agent: Mozilla Thunderbird 0.8 (X11/20040913) X-Accept-Language: en-us, en MIME-Version: 1.0 To: sip@ietf.org Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: quoted-printable X-MIME-Autoconverted: from 8bit to quoted-printable by nylon.softarmor.com id j365B2Zv005857 X-Spam-Score: 0.0 (/) X-Scan-Signature: 3643ee1fccf5d6cf2af25f27d28abb29 Content-Transfer-Encoding: quoted-printable Cc: rohan@ekabal.com, Gonzalo Camarillo , Allison Mankin Subject: [Sip] Draft minutes of SIP meeting at IETF 62 X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: f5c1164b9029aa0dd842007e530e24ad Content-Transfer-Encoding: quoted-printable The following are the draft minutes. Please send any required=20 corrections by COB August 7, 2005. Revisions will be posted as processed at: http://www.softarmor.com/sipwg/meets/ietf62/notes/minutes-sip-ietf62.html ----- Minutes edited by Dean Willis based on notes by Paul Kyzivat, Spencer Dawkins, Vijay Gurbani, Amy Pendleton, and Migual Angel Garcia-Martin. Monday, 1930-2200 Topic: Agenda Bash and Status by Chairs Slides presented and to be included in proceedings. Agenda accepted as presented. Chairs reviewed status of current work. It was noted that the current charter and milestones are completely obsolete, despite having had changes submitted several times by the chairs and the ADs. Apparently there is some sort of process problem with the IETF web site. Topic: GRUU Remaining Issues (Knowing AOR, Rewriting by SBC, etc.) by Jonathan Rosenberg see draft-ietf-sip-gruu-03.txt Slides presented and to be included in proceedings. Changes to previous doc reviewed. The redundancy issue has been declared out of scope, and discussion suggested that this should perhaps be placed into the Jennings "outbound" draft. The current model assumes that both "sip" and "sips" versions of a GRUU are created when a GRUU is, and that they route to the same resource. The URI scheme of the "To:" header is used to select the appropriate GRUU. It was suggested that this should be clarified in RFC 3261, perhaps as an errata. Several record-routing cases were discussed based on slides. There was inconclusive discussion of a scenario where the use of GRUU creates an undesirable "tromboning" effect back to the upstream entity after resolution 1) Open Issue: Discovering AoR from A GRUU Discussed issue about getting AOR from gruu - why this is/isn=92t a need. Objections were raised to the proposed compromise in the draft. Various other alternatives discussed. Cullen Jennings didn't see a compelling reason for it. Paul Kyzivat (who had raised the issue initially) said he no longer found this a need- solutions other than GRUU were sufficient. Aki Niemi and Orit Levin still expressed a desire for this feature. Dean, as chair, said we have no requirement for this, and a domain can do it anyway if it wants. Inconclusive discussion followed. 2 )Open Issue: relationship of Identity to GRUU The relationship between these two elements was discussed without conclusion, although Jon Peterson (author of the Identity work) asserted an pinion that a GRUU and an identity are not the same thing. Topic: Non-Invite Transactions by Robert Sparks see draft-sparks-sip-nit-future-01.txt Slides were presented and should be included in the proceedings. 1) Proposed that we accept and refine Time left concept, and not define general "Try again later" behavior. This approach uses a new header indicating how much time the downstream element has left. Adam roach argued that it was not a good idea - if we don't get any hints from proxies who are not aware of this extension, we will go round in circles. Robert called for a hum on if this work should continue or not. The consensus was for neither the timeline nor the "try again later" work to continue. 2) Proposed that we pursue address success and failure caching. The goal is to allow next NIT to avoid non-responding address. Question is how often to probe the non-responding address? No concrete way. Jonathan Rosenberg proposed that we use Jenning's outbound I-D. Cullen Jennings stated that this may work for UA - Proxy, but Proxy-Proxy may not quite work. Robert Sparks proposed that for now we carry a blacklist; put these addresses in a cache with a timeout (let the developer determine the timeout). And we continue to pursue Cullen's outbound I-D as a possible better answer. Discussion followed. The conclusion was that for now we will use some weighted back to list algorithm that will be fleshed out on the mailing list. Topic: REFER Extensions by Orit Levin see draft-ietf-sip-refer-with-norefersub-01.txt Slides were presented that should be included in proceedings. Only one open issue remained for the draft since its WGLC. This was "How does a REFER-Issuer enable the feature?". Alternatives include: a) Commonly preceded by OPTIONS, b) supported header in the request, c) required header in the response, d) require header in the request. Discussion agreed that the Supported header is the wrong approach, as it indicates which features are supported by the sender, not required for the respondent. Discussion became prolonged, and the participants were moved to the hallway for a focused discussion. This discussion reached the following conclusion: 1) Add a new Refer-To header field 2) Keep option tag 3) Including this option tag in Require header is NOT RECOMMENDED. This conclusion was shared with the WG, and no objections were noted. The "hallway" conversation necessitated a slight juggling of the agenda, with resource Priority being discussed during the hallway discussion. Topic SIP Resource Priority by James Polk See: draft-ietf-sip-resource-priority-06.txt Slides were presented and should be included in proceedings It was noted that this draft is just 2 weeks shy of its 5th anniversary, making it one of our longer-lived discussions. Changes since previous version were discussed. The plan of record is to submit and WGLC a revision of this draft with minor cleanup as proposed here. The authors requested: "For those who care, please approach us and let us know of any concerns. If someone can read this as an innocent bystander and provide comments, please do". The chairs polled the room: "Does everyone who cares about this draft think their issue have essentially been met?" The consensus of the room was favorable and no issues were raised. It should be noted that Mike Pierce, a long time participant in this discussion, was not present as of this poll. Topic: Request Identity by Jon Peterson See: draft-ietf-sip-identity-04.txt Slides were presented and should be included in the proceedings. New open issues: 1) Display name handling - should identity signature cover the display name? All clients (MS Outlook, for instance) use the display name, and not the name-addr. Jonathan noted that this is usually a good thing; the service provider bears the burden of coming up with the display name and the client is provided a bit-by-bit rendering of the display name. Following discussion indicated a strong consensus to protect the display name if feasible. The consensus was to protect display name, and in the display name, just put quoted strings and prohibit LWS. In the security section of the draft there should be a discussion of the disadvantages of including display names (account minting a la Yahoo!)...) 2) Applicability to REGISTER - why provide authentication info to a authentication server as well as to the registrar? Jonathan Rosenberg presented an acceptable use case, and the authors concluded that they would amend the draft to indicate the usability of Identity in REGISTER transactions. Topic: Response Identity by Jon Peterson No slides presented. Jon lead a discussion about the meaning and critical aspects of response identity. Jon says he has lost his way on this draft. The sip-identity work doesn't work for responses because of retargeting. Who do responses actually come from? What are intermediaries allowed to do when routing SIP requests? How would a UAC make authentication decisions based on response identity? Anyone can impersonate a requester, but impersonating a responder is a lot harder - need dialog identifiers, etc. Improve channel security to make it even harder to impersonate a responder? Provide causal trace after-the-fact? Let UAC explore new targets for a request? Assume bar is high enough for impersonators now? - what if the real responder tries to impersonate someone else? Jonathan Rosenberg said major threat is if someone fakes a connected party id, assuming we had that, and that such is a requirement. Rohan Mahy thought History-Info is the right solution and said he plans to write up something about it. Consensus: We're generally headed in the right direction but have a long way to go. Topic: Accept-Disposition by Gonzalo Camarillo See: draft-camarillo-sip-accept-disposition-00.txt Slides presented and should be included in proceedings open question: How do we say we don't understand content-disposition? Add Accept-Disposition (equivalent to Accept header)? We have several ways to require support for something - method, option tag, body with handling=3Drequired. Want to pick one and clarify content disposition handling Combining two problems - Accept is used as hint about how you goofed. Isn't Warning closer to what we're getting at? Accept headers became useless because everyone Accept: * (everything). Don't we really want an explicit code that tells us what we want to know? How to tell refusal from lack of comprehension? What is scope of Accept-Disposition? Conclusion: Rather than pursue this approach, for the application (exploder) that stimulated this draft there was a decision to use an option tag to negotiate support for the needed combination of features. Separately, there was interest by some (at least Gonzalo and Paul) in starting to investigate the underspecification of Content-Disposition. Tuesday, 1300-1500 Agenda by Chairs Agenda accepted as proposed in slides. The proposed topic of "Connection Reuse" was withdrawn by author Rohan Mahy. If time allows, a discussion of retargeting led by Jon Peterson will be undertaken. Topic: SIP Interaction Framework by Jonathan Rosenberg See: draft-ietf-sipping-app-interaction-framework-04.txt Slides presented and should be included in proceedings The current state of the draft has raised a requirement for other work that Jonathan calls the "target dialog" approach and has fleshed out. Discussion of this approach ensued. Alan Johnston noted that an option tag is needed. Robert Sparks spoke in favor of the approach. Following discussion, the chairs polled the room and a consensus to proceed with this approach was reported. The chairs are instructed to work with the Area Director to add the target dialog draft to the working group charter. Topic; Management of Outbound Connections by Cullen Jennings See: draft-jennings-sipping-outbound-01.txt Slides were presented and should be included in proceedings Open issue: Do we need an option tag to know if registrar supports flow-id and if UA supports this. Rohan argued against the option tag. Jonathan proposed that it would be needed it in the Require in the REGISTER. Rohan countered that one could check in the response what it came back, and perhaps add a Contact header field parameter to discover if the functionality is supported by the registrar. Alan H. noted that if the registrar does not support the functionality, you end up with a wrong binding that you have to fix later. After discussion, there were no sustained objections to adding an option tag, and a quick poll indicated consensus for this approach. Cullen agreed to make this change in the next revision. Topic: Using Certificates with SIP by Cullen Jennings see draft-ietf-sipping-certs-01.txt Slides were presented and should be included in proceedings 1) Robert Sparks commented that the draft needs further text about caching certs, and checking certificate revocation. 2) Jon Peterson suggested that we make sure to clarify subscription duration, which Cullen noted should not cache beyond validity time 3) Rohan observed that we need to refresh the subscription even if the cert is still is valid, when there hasn't been a NOTIFY for some long period of time. 4) Francois Audet noted issues with retargeting and forking. For example,the sales group example does not work properly. An other case is retargeting. Use case: the help desk. You don't care who is going to answer, but the requirement is the conversation to be encrypted. Cullen observed that the assumption of this draft is indeed that all devices for the ID have the same credentials. Jon Peterson suggested that RFC 3261 with SIPS resolves theses cases. Cullen observed that there are separate problems: a) to determine who the certificate belongs to, and b) acquiring the certs. This draft addresses only b. It was resolved that the scope of the draft should be clarified, and that we should change the name to "credential management" instead of "certificate management". 5) Jonathan asked:"What happens if I send a SUBSCRIBE for a GRUU? Do I get the cert for the AOR?" Cullen responded that the draft discusses users, not devices. Jon Peterson stated that this problem should be resolved in the identity draft, not here. Topic: End-to-middle security by Kumiko Ono see draft-ono-sipping-end2middle-security-04.txt Slides were presented and should be included in proceedings Chairs noted that they expect this work to migrate from SIPPING to SIP fairly soon, as has gone beyond the requirements consensus and into implementation. 1) Open issue: Signatures inside, encryption outside or the other way around? Jon reported that we did some analysis about this when drafting RFC 3261, and think the signature should go inside, the encryption outside. Cullen believes that signature inside the encrypting part will give better security properties (from the security group). Catherine also stated that the crypto community thinks signature inside is generally better, although there are sometimes exceptions. Conclusion: consensus to have signature inside. 2 )Open issue: How a proxy can tell a UA to disclose a body while protecting data integrity? Options include new error response, existing resp with warning header, or existing resp instruct UA one task at a time. James Polk asked if we could use CID and Reason header? Jon Peterson noted that CID is valid is the scope is a partial body of the multipart, but if you talk about the whole body, you don't need a CID. Dean asked: can the proxy request a body? Jon responded: if it is undecipherable, how can it point to one body? The proxy only knows the whole multipart body, not the individual parts. It is better to do it at the high level -- the proxy says I need to read this body, without indicating which one. Dean and Jonathan noted that Content-Disposition may also be applicable. No conclusion noted for this issue. Chairs Poll: This is a proposal for an implementation of the end-to-middle requirements established by SIPPING. Do we wish to adopt this as a working group item? A consensus in favor of adoption was reported, and the chairs are instructed to work with the D to get this item added to the SIP WG milestone list. Topic: Extension Negotiation by Volker Hilt See: draft-hilt-sip-ext-neg-00.txt Slides were presented and should be included in the proceedings. Discussion followed. Paul K noted that this aggregates on not being clear of what is the scope of what an Accept header is. Does it apply to OPTIONS? Severe discussion about when to include or not the Accept header, in which methods. Jonathan replied: There is not a not clear answer, but interoperability is maximized when you put everything you support in the header. OPTIONS carries a permanent scope: this is what I support. Gonzalo observed that, at the end of the day what we want to disclose is the desired Content-Disposition. Dean also observed that RFC 3261 scopes the Accept header to the duration of a dialog and that RFC 3264 scopes the Accept header for the duration of a SUBSCRIBE dialog. Dean suggested that this would be a good time time to have guidelines for Accept headers. Cullen and Jonathan maintain that it is simpler to populate the Accept header with everything that is supported, even if this set becomes very large. Jonathan clarifies that the use case is when the server can provide an alternative extension in case the client does not support a given extension. The example: if the presence server knows that the client does not support RPID, then the server might put the contents of activity elements in note elements. Adam noted that there is currently no way for the server to determine that something is not supported at the client. There does not seem to be a clear path forward, and we should perhaps look more closely at use cases. Topic: Retargeting by Jon Peterson Slides presented and should be included in proceedings. Discussion followed. Rohan Mahy observed that sometimes an unanticipated respondent is a desirable outcome. And sometimes it isn't. Keith Drage proposed that response identity should be connected party ID. Jon observed that the response identity problem is defined as the ability from the UAC to determine that the response came from an impersonator. Implementation of connected party is likely to occur security problems, and a UAC doing wrong authorizations. Jonathan suggested that we reduce the scope of the requirements to something that we can solve today. There are other harder problems that we can't solve today. Jon proposed that we need to solve the problem that ends up in SRTP, starting from SIP identity, SIP certs, Mikey, SRTP. Discussion of endpoint vs proxy trust followed, with the general consensus being that, at least to some extent, proxies must be trusted, because "the SIP proxy allocates you with a SIP URI and can take it out of you at any time". Jon proposed that we takes this work as an informational document in SIPPING discussing the kind of attacks. Jonathan noted that we need to update the SIPS behavior in SIP, there are a few open holes. Jon restated that the scope of this work is to detect that there has been a retargeting, not to prevent that retargeting to happen. No further conclusions were noted. The meeting of the SIP working group concluded on schedule. _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Wed Apr 6 02:10:51 2005 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA09339 for ; Wed, 6 Apr 2005 02:10:51 -0400 (EDT) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJ3st-00084E-48 for sip-web-archive@ietf.org; Wed, 06 Apr 2005 02:19:27 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJ3W5-00033q-UV; Wed, 06 Apr 2005 01:55:53 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJ3W3-00033g-82 for sip@megatron.ietf.org; Wed, 06 Apr 2005 01:55:51 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA28187 for ; Wed, 6 Apr 2005 01:55:50 -0400 (EDT) Received: from sj-iport-2-in.cisco.com ([171.71.176.71] helo=sj-iport-2.cisco.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJ3eK-0007Yb-Is for sip@ietf.org; Wed, 06 Apr 2005 02:04:25 -0400 Received: from sj-core-1.cisco.com (171.71.177.237) by sj-iport-2.cisco.com with ESMTP; 05 Apr 2005 22:55:41 -0700 Received: from mira-sjc5-d.cisco.com (IDENT:mirapoint@mira-sjc5-d.cisco.com [171.71.163.28]) by sj-core-1.cisco.com (8.12.10/8.12.6) with ESMTP id j365tcDr026139; Tue, 5 Apr 2005 22:55:38 -0700 (PDT) Received: from [10.151.21.127] (rtp-vpn3-914.cisco.com [10.82.219.150]) by mira-sjc5-d.cisco.com (MOS 3.4.6-GR) with ESMTP id AJD98534; Tue, 5 Apr 2005 22:55:36 -0700 (PDT) Message-ID: <425331FA.1050900@cisco.com> Date: Tue, 05 Apr 2005 20:48:58 -0400 From: Jonathan Rosenberg User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7.3) Gecko/20040910 X-Accept-Language: en-us, en MIME-Version: 1.0 To: Hisham Khartabil Subject: Re: [Sip] Target-Dialog draft submitted - open issue around kpml, dialog package References: <4250EB85.8010705@cisco.com> <58ac5fabce34d2be892f0e219a9affe9@telio.no> In-Reply-To: <58ac5fabce34d2be892f0e219a9affe9@telio.no> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Score: 0.7 (/) X-Scan-Signature: 7baded97d9887f7a0c7e8a33c2e3ea1b Content-Transfer-Encoding: 7bit Cc: IETF SIP List X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org X-Spam-Score: 0.7 (/) X-Scan-Signature: 4adaf050708fb13be3316a9eee889caa Content-Transfer-Encoding: 7bit Hisham Khartabil wrote: > I prefer (1) with a slight modification: you need to say that event > packages needing this information are required to choose which mechanism > to use and document it. If an event package does not define a mechanism > then the target-dialog header should be used. target-dialog extension > must not be used with event packages the define where to place such info. My point is that the semantics are different. The usage of the dialog identifiers in the event header field is more like a filter; it is asking the recipient for a subscription to information related to that dialog only. The Target-Dialog header field is used for proof-of-knowledge for authorization purposes. One can imagine that a single event package might use the dialog identifiers in the Event header field in some subscriptions (in which case target dialog is not needed), and in other cases, the event header field has no dialog identifiers, but still the target dialog is needed for authorization purposes. > > I don't think the drawback you mention for 1 is a drawback really. > Implementers of an event package that already defines where to find > target dialog information (like dialog package) would not use this > extension and therefore recipients who also understand the package would > not look in 2 places. The package document tells you where to look. Per above, I don't think you could do that in many cases. -Jonathan R. -- Jonathan D. Rosenberg, Ph.D. 600 Lanidex Plaza Director, Service Provider VoIP Architecture Parsippany, NJ 07054-2711 Cisco Systems jdrosen@cisco.com FAX: (973) 952-5050 http://www.jdrosen.net PHONE: (973) 952-5000 http://www.cisco.com _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Wed Apr 6 03:24:42 2005 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA09514 for ; Wed, 6 Apr 2005 03:24:41 -0400 (EDT) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJ52M-00020l-NB for sip-web-archive@ietf.org; Wed, 06 Apr 2005 03:33:19 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJ4ri-0000RA-7b; Wed, 06 Apr 2005 03:22:18 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJ4rf-0000LR-Md for sip@megatron.ietf.org; Wed, 06 Apr 2005 03:22:15 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA09358 for ; Wed, 6 Apr 2005 03:22:12 -0400 (EDT) Received: from mailgate.siemenscomms.co.uk ([195.171.110.225]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJ4zx-0001wv-4s for sip@ietf.org; Wed, 06 Apr 2005 03:30:49 -0400 Received: from CONVERSION-DAEMON.siemenscomms.co.uk by siemenscomms.co.uk (PMDF V6.0-24 #40642) id <0IEI00401KD219@siemenscomms.co.uk> for sip@ietf.org; Wed, 06 Apr 2005 08:19:50 +0100 (BST) Received: from ntht206e.siemenscomms.co.uk ([137.223.247.52]) by siemenscomms.co.uk (PMDF V6.0-24 #40642) with ESMTP id <0IEI000CRKD2QO@siemenscomms.co.uk>; Wed, 06 Apr 2005 08:19:50 +0100 (BST) Received: by ntht206e.siemenscomms.co.uk with Internet Mail Service (5.5.2657.72) id <224HN29F>; Wed, 06 Apr 2005 08:21:57 +0100 Content-return: allowed Date: Wed, 06 Apr 2005 08:21:56 +0100 From: "Elwell, John" Subject: RE: [Sip] sip-identity-05: display-name woes To: "Peterson, Jon" , sip@ietf.org Message-id: <50B1CBA96870A34799A506B2313F2667052AF3B1@ntht201e.siemenscomms.co.uk> MIME-version: 1.0 X-Mailer: Internet Mail Service (5.5.2657.72) Content-type: text/plain Content-transfer-encoding: 7BIT X-Spam-Score: 0.8 (/) X-Scan-Signature: 825e642946eda55cd9bc654a36dab8c2 Content-Transfer-Encoding: 7BIT X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org X-Spam-Score: 0.8 (/) X-Scan-Signature: ff03b0075c3fc728d7d60a15b4ee1ad2 Content-Transfer-Encoding: 7BIT Jon, I don't like A and D. Of the others, I am perhaps less negative to B than you are (but we do need to make sure we don't go down the slippery slope). With C, presumably the default string could be null. How often in practice do we anticipate a domain having policies that will authorise display names - if this is likely to be a rare thing, we might as well go with E. John > -----Original Message----- > From: Peterson, Jon [mailto:jon.peterson@neustar.biz] > Sent: 06 April 2005 00:39 > To: sip@ietf.org > Subject: [Sip] sip-identity-05: display-name woes > > > In Minneapolis, Jonathan raised the prospect that the > Identity header field should contain a signature over the > display-name portion of the >From header field value. This is > attractive because SIP user agent implementations might > render only that display-name to their users when an INVITE > is received. Accordingly, securing display-name is very > useful for human authorization decisions. After some > cajoling, I hastily agreed that we could do this for sip-identity-05. > > As I've worked towards a revision, though, I've become > convinced that this is more complicated than I initially > thought. At the root of the problem is the extremely rigid > nature of the sip-identity mechanism. It is intentionally > hostile to being "configurable" in any way; there are > currently no reference indicators whose inclusion in the > Identity signature is optional. If a reference indicator is > present in the request, it appears in the identity-string > (which is hashed and signed to form the contents of the > Identity header field); if it isn't present in the request, > the corresponding field of the identity-string is blank. > > This does not interact well with identity-string elements > that might or might not be added by the authentication > service depending on its policies or capabilities. > Unfortunately, it is difficult to anticipate how the operator > of an authentication service might decide whether or not a > human-readable free text field like the display-name is > appropriate, and accordingly, we can't expect every > authentication service operator to have such policies. > > At a mechanism level, the problem is how we express all of > the following conditions in the identity string: > > - The display-name is present in the request, and it is has > been authorized by the domain. > - The display-name is present in the request, but the domain > has no authorization policies related to display-names. > - The display-name is not present in the request. > > Here are a few options as to how we might approach this: > > (A) If the display-name is present, include it in the > identity string no matter what. Of course, then the problem > is that the verifier has no way of knowing whether or not the > domain actually employed any policies to validate the > display-name. Accordingly, it really doesn't add much value > for the verifier. > > (B) If the display-name is present and authorized, include > it, and also include some other flag somewhere in the message > (in the Identity or Identity-Info headers, probably) noting > that this authentication service enforces display-name > policies. I am reluctant to start going down this path > because it introduces variable reference indicators, which > are a notorious source of bid-down attacks. That flag, > wherever it resides, must then also be secured by the > Identity header or it might be removed by someone replaying > the message. Once we start going down this path, it also > becomes something of a slippery slope - why not also have a > flag for other common SIP headers that might optionally be > included, and which could conceivably be evaluated by an > authentication service? All of this makes the verification > processing more complicated as well; the margin of error in > the regeneration of the hash and string increases. > > (C) If the display-name is present and authorized, include > it. If the display-name is present but the domain has no > display-name policies, then rather than include it, include > some fixed value in the identity string like > 'no-display-policies' in the slot that would ordinarily be > occupied by the display-name value. That is kinda kludgey, > but gets the message across to the verifier loud and clear. > > (D) If the display-name is present and authorized, include > it. If the display-name is present but unauthorized, then > don't include it in the identity-string, and also strip it > from the From header field of the request. This is > undesirable because proxy server should not be mucking with > the From header field unless they want to be called names > like 'B2BUA' or what have you. Simplest from a verification > perspective, though. > > (E) Give up on including display-name. People should learn to > make user agents that render addr-specs to their users > instead of/in addition to display-names. Unlikely that any > domain will have policies about this anyway (it certainly > never caught on for email). > > Any better ideas, or barring that, any preferences among the above? > > Jon Peterson > NeuStar, Inc. > > _______________________________________________ > Sip mailing list https://www1.ietf.org/mailman/listinfo/sip > This list is for NEW development of the core SIP Protocol > Use sip-implementors@cs.columbia.edu for questions on current sip > Use sipping@ietf.org for new developments on the application of sip > _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Wed Apr 6 05:12:16 2005 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id FAA17499 for ; Wed, 6 Apr 2005 05:12:16 -0400 (EDT) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJ6iU-0005ob-Hm for sip-web-archive@ietf.org; Wed, 06 Apr 2005 05:20:54 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJ6NQ-0005pe-B2; Wed, 06 Apr 2005 04:59:08 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJ6NN-0005pO-Ew for sip@megatron.ietf.org; Wed, 06 Apr 2005 04:59:05 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id EAA16368 for ; Wed, 6 Apr 2005 04:59:03 -0400 (EDT) Received: from david.siemens.de ([192.35.17.14]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJ6Vh-0005Kg-33 for sip@ietf.org; Wed, 06 Apr 2005 05:07:41 -0400 Received: from mail2.siemens.de (mail2.siemens.de [139.25.208.11]) by david.siemens.de (8.12.6/8.12.6) with ESMTP id j368wxKu019710; Wed, 6 Apr 2005 10:58:59 +0200 Received: from mchp9daa.mch.sbs.de (mchp9daa.mch.sbs.de [139.25.137.99]) by mail2.siemens.de (8.12.6/8.12.6) with ESMTP id j368wxf4005706; Wed, 6 Apr 2005 10:58:59 +0200 Received: by mchp9daa.mch.sbs.de with Internet Mail Service (5.5.2657.72) id <2A1685DA>; Wed, 6 Apr 2005 10:58:59 +0200 Message-ID: From: Fries Steffen To: "Peterson, Jon" , fluffy@cisco.com Date: Wed, 6 Apr 2005 10:58:57 +0200 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2657.72) Content-Type: text/plain X-Spam-Score: 0.0 (/) X-Scan-Signature: 386e0819b1192672467565a524848168 Cc: IETF SIP List Subject: [Sip] RE: Question to Identity draft X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: cf3becbbd6d1a45acbe2ffd4ab88bdc2 Hi John, I made some inline comments. ------snipp > The method of exchanging certificates within SIP messages > which you describe below was subtantially documented in > RFC3261. There's no doubt the integrity provided by > sip-identity-04 could help to secure certificates exchanged > in this manner. But the question is what security properties > you want to derive from this practice. If you want to use the > exchanged certificates for integrity, then well, > sip-identity-04 already provides integrity. If you want to > use the exchanged certificates for confidentiality, then you > get the bootstrapping problem - how does the sender of the > INVITE learn the key they must use to encrypt the body of > their request? This is the purpose of the certificate server, > and of sipping-certs-01. I doubt that exchanging certificates > within INVITEs and so on will prove more servicable. [stf] yes, RFC3261 talks about certificate exchhange. But here it is only possible to take certificates, which are (more or less) bound to a person. Assume that you use certificates, which are bound to the host used for phone calls. Then you would need some instance assuring, that this certificate is connected with the registration under some AOR. What I had in mind is an inband certificate exchange from, e.g., self signed certificates, were the authentication services basically assures that the message (and thus the certificate) came from a person registered under a certain AOR. The certificate itself may then be used for end-to-end integrity services. A usage example would be the key management for SRTP using MIKEY, were one option is the usage of certificates. When here a certificate is used, which is completely unknown to the receiver, then there is no real value. But when a trusted component (the authentication service) assures, that a person registered with a dedicated AOR is connected with this certificate, then it gets a meaning. It would basically provide the assurance, that for the time I am in the call, I am using this certificate, which may be sufficient. Regards Steffen > > Jon Peterson > NeuStar, Inc. > > > -----Original Message----- > > From: Fries Steffen [mailto:steffen.fries@siemens.com] > > Sent: Tuesday, April 05, 2005 3:04 AM > > To: Peterson, Jon; fluffy@cisco.com > > Cc: IETF SIP List > > Subject: Question to Identity draft > > > > > > Hi Jon, hi Cullen, > > > > by reading the IDs regarding enhanced identity management > > (draft-ietf-sip-identity-04) and certificate management > > (draft-ietf-sipping-certs-01) I've got a question to a possible use > > case. > > > > Assumed that two user A and B from two different domains X > and Y want > > to communicate securely. User A sends his INVITE with an attached > > certificate to User B in domain Y. The INVITE is send through an > > authentication service, which authenticates (according the identity > > draft) that the AOR matches the FROM field. Additionally a digital > > signature is calculated also over the body of the message. > Thus also > > the attached certificate is signed. Using this approach > would assure > > User B that User A has registered with his credentials in domain X. > > User B could then use the received certificate to > communicate securely > > with user A at least for the duration of the session. > > User B may also send his certificate to user B also through an > > authentication service. Within a next session, when both > users newly > > registered, the certificates may be different than in the session > > before. > > > > Is this scenario somehow covered by the identity draft? It > could save > > the credential server in certain scenarios. The approach itself may > > require an enhanced storing of the username and certificate > > associations if non-repudiation is desired. > > > > Regards > > Steffen > > > _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Wed Apr 6 06:12:09 2005 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id GAA22745 for ; Wed, 6 Apr 2005 06:12:09 -0400 (EDT) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJ7eT-0008AN-2H for sip-web-archive@ietf.org; Wed, 06 Apr 2005 06:20:49 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJ7UE-0007wL-7O; Wed, 06 Apr 2005 06:10:14 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJ7UC-0007qy-55 for sip@megatron.ietf.org; Wed, 06 Apr 2005 06:10:12 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id GAA22513 for ; Wed, 6 Apr 2005 06:10:09 -0400 (EDT) Received: from mailgate.siemenscomms.co.uk ([195.171.110.225]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJ7cV-00086o-Ms for sip@ietf.org; Wed, 06 Apr 2005 06:18:49 -0400 Received: from CONVERSION-DAEMON.siemenscomms.co.uk by siemenscomms.co.uk (PMDF V6.0-24 #40642) id <0IEI00201S53TA@siemenscomms.co.uk> for sip@ietf.org; Wed, 06 Apr 2005 11:07:51 +0100 (BST) Received: from ntht206e.siemenscomms.co.uk ([137.223.247.52]) by siemenscomms.co.uk (PMDF V6.0-24 #40642) with ESMTP id <0IEI0024US53KP@siemenscomms.co.uk> for sip@ietf.org; Wed, 06 Apr 2005 11:07:51 +0100 (BST) Received: by ntht206e.siemenscomms.co.uk with Internet Mail Service (5.5.2657.72) id <224HNLL7>; Wed, 06 Apr 2005 11:09:58 +0100 Content-return: allowed Date: Wed, 06 Apr 2005 11:09:57 +0100 From: "Elwell, John" To: sip@ietf.org Message-id: <50B1CBA96870A34799A506B2313F2667052AF7B0@ntht201e.siemenscomms.co.uk> MIME-version: 1.0 X-Mailer: Internet Mail Service (5.5.2657.72) Content-type: text/plain Content-transfer-encoding: 7BIT X-Spam-Score: 0.0 (/) X-Scan-Signature: d17f825e43c9aed4fd65b7edddddec89 Content-Transfer-Encoding: 7BIT Subject: [Sip] Question on SIPS and Contact URI X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: de4f315c9369b71d7dd5909b42224370 Content-Transfer-Encoding: 7BIT I cannot find anything that specifies how a SIP UA should behave when it receives a SIPS URI in a Contact header during a dialog (target refresh) or during dialog establishment if the transport is not TLS. The implication is that all future requests to that contact must be sent using TLS, even though TLS has not been used up to now for this dialog. Is that correct? What would a UA do that does not support TLS? What if the first proxy that has record-routed does not support TLS? One solution might be to convert the URI to a SIP URI for sending future requests. John _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Wed Apr 6 06:33:15 2005 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id GAA25202 for ; Wed, 6 Apr 2005 06:33:14 -0400 (EDT) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJ7yr-0000Sk-Ji for sip-web-archive@ietf.org; Wed, 06 Apr 2005 06:41:54 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJ7kn-0004B3-Fe; Wed, 06 Apr 2005 06:27:21 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJ7kl-0004Ay-WC for sip@megatron.ietf.org; Wed, 06 Apr 2005 06:27:20 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id GAA23854 for ; Wed, 6 Apr 2005 06:27:17 -0400 (EDT) Received: from mgw-x3.nokia.com ([131.228.20.26]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJ7t5-0000DS-KD for sip@ietf.org; Wed, 06 Apr 2005 06:35:57 -0400 Received: from esdks003.ntc.nokia.com (esdks003.ntc.nokia.com [172.21.138.158]) by mgw-x3.nokia.com (Switch-2.2.8/Switch-2.2.8) with ESMTP id j36APvJ08012; Wed, 6 Apr 2005 13:25:58 +0300 (EET DST) X-Scanned: Wed, 6 Apr 2005 13:25:06 +0300 Nokia Message Protector V1.3.34 2004121512 - RELEASE Received: (from root@localhost) by esdks003.ntc.nokia.com (8.12.9/8.12.9) id j36AP6od000880; Wed, 6 Apr 2005 13:25:06 +0300 Received: from mgw-int1.ntc.nokia.com (172.21.143.96) by esdks003.ntc.nokia.com 00unyBrA; Wed, 06 Apr 2005 13:25:05 EEST Received: from esebh003.NOE.Nokia.com (esebh003.ntc.nokia.com [172.21.138.82]) by mgw-int1.ntc.nokia.com (Switch-2.2.8/Switch-2.2.8) with ESMTP id j36AOuM10036; Wed, 6 Apr 2005 13:24:56 +0300 (EET DST) Received: from [127.0.0.1] ([172.21.39.90]) by esebh003.NOE.Nokia.com with Microsoft SMTPSVC(5.0.2195.6881); Wed, 6 Apr 2005 13:23:42 +0300 Message-ID: <4253B8AE.70804@nokia.com> Date: Wed, 06 Apr 2005 13:23:42 +0300 From: Miguel Garcia User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7.2) Gecko/20040804 Netscape/7.2 (ax) X-Accept-Language: en-us, en, es-es MIME-Version: 1.0 To: Elwell@mgw-int1.ntc.nokia.com, "" Subject: Re: [Sip] Question on SIPS and Contact URI References: <50B1CBA96870A34799A506B2313F2667052AF7B0@ntht201e.siemenscomms.co.uk> In-Reply-To: <50B1CBA96870A34799A506B2313F2667052AF7B0@ntht201e.siemenscomms.co.uk> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-OriginalArrivalTime: 06 Apr 2005 10:23:42.0466 (UTC) FILETIME=[B4E7E620:01C53A92] X-Spam-Score: 0.0 (/) X-Scan-Signature: 8abaac9e10c826e8252866cbe6766464 Content-Transfer-Encoding: 7bit Cc: sip@ietf.org X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 69a74e02bbee44ab4f8eafdbcedd94a1 Content-Transfer-Encoding: 7bit The first proxy not supporting TLS? Hmmm... I thought that RFC 3261 mandates proxies to support TLS (besides UDP and TCP), so the case would not exist. /Miguel Elwell, John wrote: > I cannot find anything that specifies how a SIP UA should behave when it > receives a SIPS URI in a Contact header during a dialog (target refresh) or > during dialog establishment if the transport is not TLS. The implication is > that all future requests to that contact must be sent using TLS, even though > TLS has not been used up to now for this dialog. Is that correct? What would > a UA do that does not support TLS? What if the first proxy that has > record-routed does not support TLS? One solution might be to convert the URI > to a SIP URI for sending future requests. > > John > > > _______________________________________________ > Sip mailing list https://www1.ietf.org/mailman/listinfo/sip > This list is for NEW development of the core SIP Protocol > Use sip-implementors@cs.columbia.edu for questions on current sip > Use sipping@ietf.org for new developments on the application of sip > -- Miguel A. Garcia tel:+358-50-4804586 sip:miguel.an.garcia@openlaboratory.net Nokia Research Center Helsinki, Finland _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Wed Apr 6 07:54:50 2005 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA01961 for ; Wed, 6 Apr 2005 07:54:50 -0400 (EDT) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJ9Fp-0004E1-7n for sip-web-archive@ietf.org; Wed, 06 Apr 2005 08:03:29 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJ97D-0008MF-TE; Wed, 06 Apr 2005 07:54:35 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJ97C-0008MA-Rq for sip@megatron.ietf.org; Wed, 06 Apr 2005 07:54:34 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA01951 for ; Wed, 6 Apr 2005 07:54:33 -0400 (EDT) Received: from mailgate2.nl.thalesgroup.com ([193.67.31.101] helo=mailgate2.signaal.nl) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJ9FT-0004A4-65 for sip@ietf.org; Wed, 06 Apr 2005 08:03:12 -0400 Received: from mta1.nl.thales (mta1.signaal.local [193.67.31.130]) by mailgate2.signaal.nl (4.8.1.149) with ESMTP id for ; Wed, 6 Apr 2005 13:53:29 +0200 (MEST) Received: from suna900.sc.signaal.nl (suna900.sc.signaal.nl [192.7.99.164]) by mta1.nl.thales (4.9.7.3) with ESMTP id CNb8fAAV for ; Wed, 6 Apr 2005 13:53:12 +0200 (MEST) Received: from scms1.sc.signaal.nl ([192.7.99.212]) by suna900.sc.signaal.nl (Netscape Messaging Server 3.6) with ESMTP id AAA6C0B for ; Wed, 6 Apr 2005 13:53:07 +0200 Received: from scd01-MTA by scms1.sc.signaal.nl with Novell_GroupWise; Wed, 06 Apr 2005 13:53:16 +0200 Message-Id: X-Mailer: Novell GroupWise Internet Agent 6.0.4 Date: Wed, 06 Apr 2005 13:53:04 +0200 From: "Samuel Osorio Calvo" To: , , Subject: Re: [Sip] Question on SIPS and Contact URI MIME-Version: 1.0 (Generated by Clearswift ES version 4.8.1.149) Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: quoted-printable Content-Disposition: inline X-Spam-Score: 0.0 (/) X-Scan-Signature: 6cca30437e2d04f45110f2ff8dc1b1d5 Content-Transfer-Encoding: quoted-printable Cc: sip@ietf.org X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: b7b9551d71acde901886cc48bfc088a6 Content-Transfer-Encoding: quoted-printable When the caller starts a dialog with a SIPS URI, it forces that all = proxies in the path use TLS and since TLS is a mandatory feature for SIP = proxies, the request MUST have followed a TLS path. However, RFC 3261 does not mandates anything about the last hop (UA-->outbo= und proxy OR egress proxy-->remote UA). Thus, the final proxy, applying = local policies, might send the SIPS request using another transport = mechanism to the UA because RFC 3261 does not mandates UAs to support TLS. Hence, as far as I know, the UA not supporting TLS will use the standard = SIP forwarding mechanisms (Via, Route, Contact, ...) and will probably = insert sips: URI in the subsequent replies and request. These messages = will be taken by the proxy, which will use TLS where applicable: Something like: Dialog initiating request: UA1---???--->outbound proxy--TLS-->P1----TLS--->P2----TLS--->Egress = proxy--????--->UA2 reply & within dialog messages: UA2---???--->Egress proxy---TLS-->outbound proxy----???--->UA1 (P1 and P2 have not inserted Record-Route headers). ??? will be fixed by local policy and UA supported features, it can be = UDP, TCP, SCTP,......... Hope it helps and please correct me if I am not right, Samuel Osorio. Unclassified. >>> Miguel Garcia 04/06/05 12:23PM >>> The first proxy not supporting TLS? Hmmm... I thought that RFC 3261=20 mandates proxies to support TLS (besides UDP and TCP), so the case = would=20 not exist. /Miguel Elwell, John wrote: > I cannot find anything that specifies how a SIP UA should behave when it > receives a SIPS URI in a Contact header during a dialog (target refresh) = or > during dialog establishment if the transport is not TLS. The implication = is > that all future requests to that contact must be sent using TLS, even = though > TLS has not been used up to now for this dialog. Is that correct? What = would > a UA do that does not support TLS? What if the first proxy that has > record-routed does not support TLS? One solution might be to convert the = URI > to a SIP URI for sending future requests. >=20 > John >=20 >=20 > _______________________________________________ > Sip mailing list https://www1.ietf.org/mailman/listinfo/sip=20 > This list is for NEW development of the core SIP Protocol > Use sip-implementors@cs.columbia.edu for questions on current sip > Use sipping@ietf.org for new developments on the application of sip >=20 --=20 Miguel A. Garcia tel:+358-50-4804586 sip:miguel.an.garcia@openlaboratory.net=20 Nokia Research Center Helsinki, Finland _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip=20 This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Wed Apr 6 08:22:16 2005 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA05392 for ; Wed, 6 Apr 2005 08:22:16 -0400 (EDT) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJ9gN-0005Ux-QE for sip-web-archive@ietf.org; Wed, 06 Apr 2005 08:30:56 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJ9WN-00030G-73; Wed, 06 Apr 2005 08:20:35 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJ9WJ-0002z7-Up for sip@megatron.ietf.org; Wed, 06 Apr 2005 08:20:33 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA05196 for ; Wed, 6 Apr 2005 08:20:30 -0400 (EDT) Received: from mailgate.siemenscomms.co.uk ([195.171.110.225]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJ9ef-0005PG-9U for sip@ietf.org; Wed, 06 Apr 2005 08:29:09 -0400 Received: from CONVERSION-DAEMON.siemenscomms.co.uk by siemenscomms.co.uk (PMDF V6.0-24 #40642) id <0IEI00E01Y6CNP@siemenscomms.co.uk> for sip@ietf.org; Wed, 06 Apr 2005 13:18:12 +0100 (BST) Received: from ntht206e.siemenscomms.co.uk ([137.223.247.52]) by siemenscomms.co.uk (PMDF V6.0-24 #40642) with ESMTP id <0IEI00E45Y6C1E@siemenscomms.co.uk>; Wed, 06 Apr 2005 13:18:12 +0100 (BST) Received: by ntht206e.siemenscomms.co.uk with Internet Mail Service (5.5.2657.72) id <224HNNJD>; Wed, 06 Apr 2005 13:20:19 +0100 Content-return: allowed Date: Wed, 06 Apr 2005 13:20:18 +0100 From: "Elwell, John" Subject: RE: [Sip] Question on SIPS and Contact URI To: Samuel Osorio Calvo , Miguel.An.Garcia@nokia.com, "Elwell, John" Message-id: <50B1CBA96870A34799A506B2313F2667052E7B3D@ntht201e.siemenscomms.co.uk> MIME-version: 1.0 X-Mailer: Internet Mail Service (5.5.2657.72) Content-type: text/plain Content-transfer-encoding: 7BIT X-Spam-Score: 0.0 (/) X-Scan-Signature: 825e642946eda55cd9bc654a36dab8c2 Content-Transfer-Encoding: 7BIT Cc: sip@ietf.org X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: ff03b0075c3fc728d7d60a15b4ee1ad2 Content-Transfer-Encoding: 7BIT Thanks Samuel and Miguel for your responses. Yes, it was the case where the UA does not support TLS that was the real driver for the question - non-support by a proxy was an afterthought and shouldn't (in theory) be a problem. So if I send an INVITE request (say) to a SIPS URI and place a SIPS URI in the Contact header field, if the last proxy forwards it on a non-TLS link to the UAS, then my real question is whether I can depend on that working, i.e., will the destination UA be able to send me subsequent requests in that dialog? Samuel suggests that the non-TLS UA would still use the SIPS URI for subsequent requests. My idea was that it might convert it to a SIP URI. I guess either should satisfy my concern that my UA will still be able to receive requests from the non-TLS UA. Any other opinions? John > -----Original Message----- > From: Samuel Osorio Calvo [mailto:samuel.osorio@nl.thalesgroup.com] > Sent: 06 April 2005 12:53 > To: Elwell@mgw-int1.ntc.nokia.com; > Miguel.An.Garcia@nokia.com; john.elwell@siemens.com > Cc: sip@ietf.org > Subject: Re: [Sip] Question on SIPS and Contact URI > > When the caller starts a dialog with a SIPS URI, it forces > that all proxies in the path use TLS and since TLS is a > mandatory feature for SIP proxies, the request MUST have > followed a TLS path. > However, RFC 3261 does not mandates anything about the last > hop (UA-->outbound proxy OR egress proxy-->remote UA). > Thus, the final proxy, applying local policies, might send > the SIPS request using another transport mechanism to the UA > because RFC 3261 does not mandates UAs to support TLS. > > Hence, as far as I know, the UA not supporting TLS will use > the standard SIP forwarding mechanisms (Via, Route, Contact, > ...) and will probably insert sips: URI in the subsequent > replies and request. These messages will be taken by the > proxy, which will use TLS where applicable: > Something like: > > Dialog initiating request: > UA1---???--->outbound > proxy--TLS-->P1----TLS--->P2----TLS--->Egress proxy--????--->UA2 > > reply & within dialog messages: > UA2---???--->Egress proxy---TLS-->outbound proxy----???--->UA1 > (P1 and P2 have not inserted Record-Route headers). > > ??? will be fixed by local policy and UA supported features, > it can be UDP, TCP, SCTP,......... > > > Hope it helps and please correct me if I am not right, > > Samuel Osorio. > > > Unclassified. > >>> Miguel Garcia 04/06/05 12:23PM >>> > The first proxy not supporting TLS? Hmmm... I thought that RFC 3261 > mandates proxies to support TLS (besides UDP and TCP), so the > case would > not exist. > > /Miguel > > Elwell, John wrote: > > > I cannot find anything that specifies how a SIP UA should > behave when it > > receives a SIPS URI in a Contact header during a dialog > (target refresh) or > > during dialog establishment if the transport is not TLS. > The implication is > > that all future requests to that contact must be sent using > TLS, even though > > TLS has not been used up to now for this dialog. Is that > correct? What would > > a UA do that does not support TLS? What if the first proxy that has > > record-routed does not support TLS? One solution might be > to convert the URI > > to a SIP URI for sending future requests. > > > > John > > > > > > _______________________________________________ > > Sip mailing list https://www1.ietf.org/mailman/listinfo/sip > > This list is for NEW development of the core SIP Protocol > > Use sip-implementors@cs.columbia.edu for questions on current sip > > Use sipping@ietf.org for new developments on the application of sip > > > > -- > Miguel A. Garcia tel:+358-50-4804586 > sip:miguel.an.garcia@openlaboratory.net > Nokia Research Center Helsinki, Finland > > > _______________________________________________ > Sip mailing list https://www1.ietf.org/mailman/listinfo/sip > This list is for NEW development of the core SIP Protocol > Use sip-implementors@cs.columbia.edu for questions on current sip > Use sipping@ietf.org for new developments on the application of sip > > > _______________________________________________ > Sip mailing list https://www1.ietf.org/mailman/listinfo/sip > This list is for NEW development of the core SIP Protocol > Use sip-implementors@cs.columbia.edu for questions on current sip > Use sipping@ietf.org for new developments on the application of sip > _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Wed Apr 6 08:35:13 2005 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA06381 for ; Wed, 6 Apr 2005 08:35:13 -0400 (EDT) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJ9su-0005yH-PA for sip-web-archive@ietf.org; Wed, 06 Apr 2005 08:43:53 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJ9i3-0007ao-Rd; Wed, 06 Apr 2005 08:32:39 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJ9i2-0007aT-6f for sip@megatron.ietf.org; Wed, 06 Apr 2005 08:32:38 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA06159 for ; Wed, 6 Apr 2005 08:32:36 -0400 (EDT) Received: from mgw-x4.nokia.com ([131.228.20.27]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJ9qN-0005rK-RB for sip@ietf.org; Wed, 06 Apr 2005 08:41:16 -0400 Received: from esdks002.ntc.nokia.com (esdks002.ntc.nokia.com [172.21.138.121]) by mgw-x4.nokia.com (Switch-2.2.8/Switch-2.2.8) with ESMTP id j36CWTP07718; Wed, 6 Apr 2005 15:32:29 +0300 (EET DST) X-Scanned: Wed, 6 Apr 2005 15:31:40 +0300 Nokia Message Protector V1.3.34 2004121512 - RELEASE Received: (from root@localhost) by esdks002.ntc.nokia.com (8.12.9/8.12.9) id j36CVekR013563; Wed, 6 Apr 2005 15:31:40 +0300 Received: from mgw-int2.ntc.nokia.com (172.21.143.97) by esdks002.ntc.nokia.com 00p21wL5; Wed, 06 Apr 2005 15:31:37 EEST Received: from esebh003.NOE.Nokia.com (esebh003.ntc.nokia.com [172.21.138.82]) by mgw-int2.ntc.nokia.com (Switch-2.2.8/Switch-2.2.8) with ESMTP id j36CVbU28074; Wed, 6 Apr 2005 15:31:37 +0300 (EET DST) Received: from [127.0.0.1] ([172.21.39.90]) by esebh003.NOE.Nokia.com with Microsoft SMTPSVC(5.0.2195.6881); Wed, 6 Apr 2005 15:31:34 +0300 Message-ID: <4253D6A6.60003@nokia.com> Date: Wed, 06 Apr 2005 15:31:34 +0300 From: Miguel Garcia User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7.2) Gecko/20040804 Netscape/7.2 (ax) X-Accept-Language: en-us, en, es-es MIME-Version: 1.0 To: "Elwell, John" Subject: Re: [Sip] Question on SIPS and Contact URI References: <50B1CBA96870A34799A506B2313F2667052E7B3D@ntht201e.siemenscomms.co.uk> In-Reply-To: <50B1CBA96870A34799A506B2313F2667052E7B3D@ntht201e.siemenscomms.co.uk> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-OriginalArrivalTime: 06 Apr 2005 12:31:34.0751 (UTC) FILETIME=[91F1AEF0:01C53AA4] X-Spam-Score: 0.0 (/) X-Scan-Signature: 3971661e40967acfc35f708dd5f33760 Content-Transfer-Encoding: 7bit Cc: sip@ietf.org X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 3fbd9b434023f8abfcb1532abaec7a21 Content-Transfer-Encoding: 7bit John: The problem is that a SIP URI is never equivalent to a SIPS URI (Section 19.1.4 in RFC 3261), so you can't simply say I use the same URI without the "s" in "sips". In your example, if the UAS does not support TLS, and no proxy recorded the route, the session should fail. I think this bit is probably not spelled out in RFC 3261, but I guess this is how it should be. The caller could retry again without TLS, perhaps. /Miguel Elwell, John wrote: > Thanks Samuel and Miguel for your responses. > > Yes, it was the case where the UA does not support TLS that was the real > driver for the question - non-support by a proxy was an afterthought and > shouldn't (in theory) be a problem. > > So if I send an INVITE request (say) to a SIPS URI and place a SIPS URI in > the Contact header field, if the last proxy forwards it on a non-TLS link to > the UAS, then my real question is whether I can depend on that working, > i.e., will the destination UA be able to send me subsequent requests in that > dialog? > > Samuel suggests that the non-TLS UA would still use the SIPS URI for > subsequent requests. My idea was that it might convert it to a SIP URI. I > guess either should satisfy my concern that my UA will still be able to > receive requests from the non-TLS UA. Any other opinions? > > John > > > >>-----Original Message----- >>From: Samuel Osorio Calvo [mailto:samuel.osorio@nl.thalesgroup.com] >>Sent: 06 April 2005 12:53 >>To: Elwell@mgw-int1.ntc.nokia.com; >>Miguel.An.Garcia@nokia.com; john.elwell@siemens.com >>Cc: sip@ietf.org >>Subject: Re: [Sip] Question on SIPS and Contact URI >> >>When the caller starts a dialog with a SIPS URI, it forces >>that all proxies in the path use TLS and since TLS is a >>mandatory feature for SIP proxies, the request MUST have >>followed a TLS path. >>However, RFC 3261 does not mandates anything about the last >>hop (UA-->outbound proxy OR egress proxy-->remote UA). >>Thus, the final proxy, applying local policies, might send >>the SIPS request using another transport mechanism to the UA >>because RFC 3261 does not mandates UAs to support TLS. >> >>Hence, as far as I know, the UA not supporting TLS will use >>the standard SIP forwarding mechanisms (Via, Route, Contact, >>...) and will probably insert sips: URI in the subsequent >>replies and request. These messages will be taken by the >>proxy, which will use TLS where applicable: >>Something like: >> >>Dialog initiating request: >>UA1---???--->outbound >>proxy--TLS-->P1----TLS--->P2----TLS--->Egress proxy--????--->UA2 >> >>reply & within dialog messages: >>UA2---???--->Egress proxy---TLS-->outbound proxy----???--->UA1 >>(P1 and P2 have not inserted Record-Route headers). >> >>??? will be fixed by local policy and UA supported features, >>it can be UDP, TCP, SCTP,......... >> >> >>Hope it helps and please correct me if I am not right, >> >>Samuel Osorio. >> >> >>Unclassified. >> >>>>>Miguel Garcia 04/06/05 12:23PM >>> >> >>The first proxy not supporting TLS? Hmmm... I thought that RFC 3261 >>mandates proxies to support TLS (besides UDP and TCP), so the >>case would >>not exist. >> >>/Miguel >> >>Elwell, John wrote: >> >> >>>I cannot find anything that specifies how a SIP UA should >> >>behave when it >> >>>receives a SIPS URI in a Contact header during a dialog >> >>(target refresh) or >> >>>during dialog establishment if the transport is not TLS. >> >>The implication is >> >>>that all future requests to that contact must be sent using >> >>TLS, even though >> >>>TLS has not been used up to now for this dialog. Is that >> >>correct? What would >> >>>a UA do that does not support TLS? What if the first proxy that has >>>record-routed does not support TLS? One solution might be >> >>to convert the URI >> >>>to a SIP URI for sending future requests. >>> >>>John >>> >>> >>>_______________________________________________ >>>Sip mailing list https://www1.ietf.org/mailman/listinfo/sip >>>This list is for NEW development of the core SIP Protocol >>>Use sip-implementors@cs.columbia.edu for questions on current sip >>>Use sipping@ietf.org for new developments on the application of sip >>> >> >>-- >>Miguel A. Garcia tel:+358-50-4804586 >>sip:miguel.an.garcia@openlaboratory.net >>Nokia Research Center Helsinki, Finland >> >> >>_______________________________________________ >>Sip mailing list https://www1.ietf.org/mailman/listinfo/sip >>This list is for NEW development of the core SIP Protocol >>Use sip-implementors@cs.columbia.edu for questions on current sip >>Use sipping@ietf.org for new developments on the application of sip >> >> >>_______________________________________________ >>Sip mailing list https://www1.ietf.org/mailman/listinfo/sip >>This list is for NEW development of the core SIP Protocol >>Use sip-implementors@cs.columbia.edu for questions on current sip >>Use sipping@ietf.org for new developments on the application of sip >> -- Miguel A. Garcia tel:+358-50-4804586 sip:miguel.an.garcia@openlaboratory.net Nokia Research Center Helsinki, Finland _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Wed Apr 6 09:27:39 2005 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA10511 for ; Wed, 6 Apr 2005 09:27:39 -0400 (EDT) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJAhf-0007Tz-Fc for sip-web-archive@ietf.org; Wed, 06 Apr 2005 09:36:19 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJAVT-00089Y-Bq; Wed, 06 Apr 2005 09:23:43 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJAVQ-00089Q-R0 for sip@megatron.ietf.org; Wed, 06 Apr 2005 09:23:41 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA10257 for ; Wed, 6 Apr 2005 09:23:38 -0400 (EDT) Received: from mailgate.siemenscomms.co.uk ([195.171.110.225]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJAdk-0007Nz-OU for sip@ietf.org; Wed, 06 Apr 2005 09:32:19 -0400 Received: from CONVERSION-DAEMON.siemenscomms.co.uk by siemenscomms.co.uk (PMDF V6.0-24 #40642) id <0IEJ0080113D6K@siemenscomms.co.uk> for sip@ietf.org; Wed, 06 Apr 2005 14:21:13 +0100 (BST) Received: from ntht206e.siemenscomms.co.uk ([137.223.247.52]) by siemenscomms.co.uk (PMDF V6.0-24 #40642) with ESMTP id <0IEJ0079T13D5H@siemenscomms.co.uk>; Wed, 06 Apr 2005 14:21:13 +0100 (BST) Received: by ntht206e.siemenscomms.co.uk with Internet Mail Service (5.5.2657.72) id <224HN3G6>; Wed, 06 Apr 2005 14:23:20 +0100 Content-return: allowed Date: Wed, 06 Apr 2005 14:23:17 +0100 From: "Elwell, John" Subject: RE: [Sip] Question on SIPS and Contact URI To: Miguel Garcia Message-id: <50B1CBA96870A34799A506B2313F2667052E7C97@ntht201e.siemenscomms.co.uk> MIME-version: 1.0 X-Mailer: Internet Mail Service (5.5.2657.72) Content-type: text/plain Content-transfer-encoding: 7BIT X-Spam-Score: 0.0 (/) X-Scan-Signature: 2bf730a014b318fd3efd65b39b48818c Content-Transfer-Encoding: 7BIT Cc: sip@ietf.org X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: a92270ba83d7ead10c5001bb42ec3221 Content-Transfer-Encoding: 7BIT Miguel, This would depend on the UAS that does not support TLS rejecting an INVITE request containing a SIPS URI in the Contact header field. This certainly is not spelled out. If the UAS simply accepts the request, the UAC will not know and will not retry the request with a SIP URI. Then the UAS will be unable to send any requests on the dialog, including BYE. John > -----Original Message----- > From: Miguel Garcia [mailto:Miguel.An.Garcia@nokia.com] > Sent: 06 April 2005 13:32 > To: Elwell, John > Cc: Samuel Osorio Calvo; sip@ietf.org > Subject: Re: [Sip] Question on SIPS and Contact URI > > John: > > The problem is that a SIP URI is never equivalent to a SIPS > URI (Section > 19.1.4 in RFC 3261), so you can't simply say I use the same > URI without > the "s" in "sips". > > In your example, if the UAS does not support TLS, and no > proxy recorded > the route, the session should fail. I think this bit is probably not > spelled out in RFC 3261, but I guess this is how it should be. The > caller could retry again without TLS, perhaps. > > /Miguel > > Elwell, John wrote: > > > Thanks Samuel and Miguel for your responses. > > > > Yes, it was the case where the UA does not support TLS that > was the real > > driver for the question - non-support by a proxy was an > afterthought and > > shouldn't (in theory) be a problem. > > > > So if I send an INVITE request (say) to a SIPS URI and > place a SIPS URI in > > the Contact header field, if the last proxy forwards it on > a non-TLS link to > > the UAS, then my real question is whether I can depend on > that working, > > i.e., will the destination UA be able to send me subsequent > requests in that > > dialog? > > > > Samuel suggests that the non-TLS UA would still use the SIPS URI for > > subsequent requests. My idea was that it might convert it > to a SIP URI. I > > guess either should satisfy my concern that my UA will > still be able to > > receive requests from the non-TLS UA. Any other opinions? > > > > John > > > > > > > >>-----Original Message----- > >>From: Samuel Osorio Calvo [mailto:samuel.osorio@nl.thalesgroup.com] > >>Sent: 06 April 2005 12:53 > >>To: Elwell@mgw-int1.ntc.nokia.com; > >>Miguel.An.Garcia@nokia.com; john.elwell@siemens.com > >>Cc: sip@ietf.org > >>Subject: Re: [Sip] Question on SIPS and Contact URI > >> > >>When the caller starts a dialog with a SIPS URI, it forces > >>that all proxies in the path use TLS and since TLS is a > >>mandatory feature for SIP proxies, the request MUST have > >>followed a TLS path. > >>However, RFC 3261 does not mandates anything about the last > >>hop (UA-->outbound proxy OR egress proxy-->remote UA). > >>Thus, the final proxy, applying local policies, might send > >>the SIPS request using another transport mechanism to the UA > >>because RFC 3261 does not mandates UAs to support TLS. > >> > >>Hence, as far as I know, the UA not supporting TLS will use > >>the standard SIP forwarding mechanisms (Via, Route, Contact, > >>...) and will probably insert sips: URI in the subsequent > >>replies and request. These messages will be taken by the > >>proxy, which will use TLS where applicable: > >>Something like: > >> > >>Dialog initiating request: > >>UA1---???--->outbound > >>proxy--TLS-->P1----TLS--->P2----TLS--->Egress proxy--????--->UA2 > >> > >>reply & within dialog messages: > >>UA2---???--->Egress proxy---TLS-->outbound proxy----???--->UA1 > >>(P1 and P2 have not inserted Record-Route headers). > >> > >>??? will be fixed by local policy and UA supported features, > >>it can be UDP, TCP, SCTP,......... > >> > >> > >>Hope it helps and please correct me if I am not right, > >> > >>Samuel Osorio. > >> > >> > >>Unclassified. > >> > >>>>>Miguel Garcia 04/06/05 12:23PM >>> > >> > >>The first proxy not supporting TLS? Hmmm... I thought that RFC 3261 > >>mandates proxies to support TLS (besides UDP and TCP), so the > >>case would > >>not exist. > >> > >>/Miguel > >> > >>Elwell, John wrote: > >> > >> > >>>I cannot find anything that specifies how a SIP UA should > >> > >>behave when it > >> > >>>receives a SIPS URI in a Contact header during a dialog > >> > >>(target refresh) or > >> > >>>during dialog establishment if the transport is not TLS. > >> > >>The implication is > >> > >>>that all future requests to that contact must be sent using > >> > >>TLS, even though > >> > >>>TLS has not been used up to now for this dialog. Is that > >> > >>correct? What would > >> > >>>a UA do that does not support TLS? What if the first proxy that has > >>>record-routed does not support TLS? One solution might be > >> > >>to convert the URI > >> > >>>to a SIP URI for sending future requests. > >>> > >>>John > >>> > >>> > >>>_______________________________________________ > >>>Sip mailing list https://www1.ietf.org/mailman/listinfo/sip > >>>This list is for NEW development of the core SIP Protocol > >>>Use sip-implementors@cs.columbia.edu for questions on current sip > >>>Use sipping@ietf.org for new developments on the application of sip > >>> > >> > >>-- > >>Miguel A. Garcia tel:+358-50-4804586 > >>sip:miguel.an.garcia@openlaboratory.net > >>Nokia Research Center Helsinki, Finland > >> > >> > >>_______________________________________________ > >>Sip mailing list https://www1.ietf.org/mailman/listinfo/sip > >>This list is for NEW development of the core SIP Protocol > >>Use sip-implementors@cs.columbia.edu for questions on current sip > >>Use sipping@ietf.org for new developments on the application of sip > >> > >> > >>_______________________________________________ > >>Sip mailing list https://www1.ietf.org/mailman/listinfo/sip > >>This list is for NEW development of the core SIP Protocol > >>Use sip-implementors@cs.columbia.edu for questions on current sip > >>Use sipping@ietf.org for new developments on the application of sip > >> > > -- > Miguel A. Garcia tel:+358-50-4804586 > sip:miguel.an.garcia@openlaboratory.net > Nokia Research Center Helsinki, Finland > _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Wed Apr 6 09:54:43 2005 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA12931 for ; Wed, 6 Apr 2005 09:54:43 -0400 (EDT) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJB7s-0008A0-7z for sip-web-archive@ietf.org; Wed, 06 Apr 2005 10:03:24 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJAxy-0001FD-JO; Wed, 06 Apr 2005 09:53:10 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJAxv-0001Dt-EQ for sip@megatron.ietf.org; Wed, 06 Apr 2005 09:53:08 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA12721 for ; Wed, 6 Apr 2005 09:53:04 -0400 (EDT) Received: from [65.220.123.3] (helo=mail.pingtel.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJB6G-00086t-HD for sip@ietf.org; Wed, 06 Apr 2005 10:01:45 -0400 Received: from keywest (hide.pingtel.com [65.220.123.2]) by mail.pingtel.com (Postfix) with SMTP id A03D66C01C for ; Wed, 6 Apr 2005 09:53:04 -0400 (EDT) From: "Dale Worley" To: Subject: RE: [Sip] Question on SIPS and Contact URI Date: Wed, 6 Apr 2005 09:51:03 -0400 Message-ID: <002c01c53aaf$ad4e12f0$6a01010a@keywest> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook CWS, Build 9.0.2416 (9.0.2910.0) In-Reply-To: Importance: Normal X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1441 X-Spam-Score: 0.0 (/) X-Scan-Signature: 2409bba43e9c8d580670fda8b695204a Content-Transfer-Encoding: 7bit X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: b19722fc8d3865b147c75ae2495625f2 Content-Transfer-Encoding: 7bit > However, RFC 3261 does not mandates anything about the last > hop (UA-->outbound proxy OR egress proxy-->remote UA). > Thus, the final proxy, applying local policies, might send > the SIPS request using another transport mechanism to the UA > because RFC 3261 does not mandates UAs to support TLS. Strictly speaking, section 4 says "A call made to a SIPS URI guarantees that ... TLS .. is used to carry all SIP messages from the caller to the domain of the callee. From there, the request is sent securely to the callee, but with security mechanisms that depend on the policy of the domain of the callee." Once a dialog is established, requests within the dialog are handled differently than requests outside of a dialog, in regard to their request-URIs and routing. Section 12.2.1.1 says "A request within a dialog is constructed by using many of the components of the state stored as part of the dialog. ... The UAC uses the remote target and route set to build the Request-URI and Route header field of the request. [much detail to support RFC 2543 follows]" The request within a dialog is routed using the stored route set of the dialog. It is loaded into the Route: headers, which control how the request is routed. Dale _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Wed Apr 6 10:44:48 2005 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA18526 for ; Wed, 6 Apr 2005 10:44:48 -0400 (EDT) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJBuL-0001QE-If for sip-web-archive@ietf.org; Wed, 06 Apr 2005 10:53:29 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJBkj-0003fK-6S; Wed, 06 Apr 2005 10:43:33 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJBkh-0003ev-Jr for sip@megatron.ietf.org; Wed, 06 Apr 2005 10:43:31 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA18375 for ; Wed, 6 Apr 2005 10:43:29 -0400 (EDT) Received: from rtp-iport-2.cisco.com ([64.102.122.149]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJBt3-0001NG-13 for sip@ietf.org; Wed, 06 Apr 2005 10:52:10 -0400 Received: from rtp-core-2.cisco.com (64.102.124.13) by rtp-iport-2.cisco.com with ESMTP; 06 Apr 2005 10:43:21 -0400 Received: from flask.cisco.com (IDENT:mirapoint@flask.cisco.com [161.44.122.62]) by rtp-core-2.cisco.com (8.12.10/8.12.6) with ESMTP id j36EhIjI007867; Wed, 6 Apr 2005 10:43:18 -0400 (EDT) Received: from cisco.com ([161.44.79.173]) by flask.cisco.com (MOS 3.4.6-GR) with ESMTP id AQK12501; Wed, 6 Apr 2005 10:43:17 -0400 (EDT) Message-ID: <4253F584.4020702@cisco.com> Date: Wed, 06 Apr 2005 10:43:16 -0400 From: Paul Kyzivat User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.1) Gecko/20020826 X-Accept-Language: en-us, en MIME-Version: 1.0 To: "Elwell, John" Subject: Re: [Sip] Question on SIPS and Contact URI References: <50B1CBA96870A34799A506B2313F2667052E7C97@ntht201e.siemenscomms.co.uk> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Score: 0.0 (/) X-Scan-Signature: 8a85b14f27c9dcbe0719e27d46abc1f8 Content-Transfer-Encoding: 7bit Cc: Miguel Garcia , sip@ietf.org X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: ed68cc91cc637fea89623888898579ba Content-Transfer-Encoding: 7bit Jonathan and I discovered issues with sip/sips related to GRUU, which Jonathan brought up at last meeting. It became apparent that the whole subject is underspecified in 3261. I think the answer needs to be that a sip and sips uri that differ only in the scheme name must be understood to identify either the same resource or no resource. This allows the derivation of a candidate uri of one type given a uri of the other type. This candidate is then not guaranteed to work, but if it does work will be the right thing. Paul Elwell, John wrote: > Miguel, > > This would depend on the UAS that does not support TLS rejecting an INVITE > request containing a SIPS URI in the Contact header field. This certainly is > not spelled out. > If the UAS simply accepts the request, the UAC will not know and will not > retry the request with a SIP URI. Then the UAS will be unable to send any > requests on the dialog, including BYE. > > John > > >>-----Original Message----- >>From: Miguel Garcia [mailto:Miguel.An.Garcia@nokia.com] >>Sent: 06 April 2005 13:32 >>To: Elwell, John >>Cc: Samuel Osorio Calvo; sip@ietf.org >>Subject: Re: [Sip] Question on SIPS and Contact URI >> >>John: >> >>The problem is that a SIP URI is never equivalent to a SIPS >>URI (Section >>19.1.4 in RFC 3261), so you can't simply say I use the same >>URI without >>the "s" in "sips". >> >>In your example, if the UAS does not support TLS, and no >>proxy recorded >>the route, the session should fail. I think this bit is probably not >>spelled out in RFC 3261, but I guess this is how it should be. The >>caller could retry again without TLS, perhaps. >> >>/Miguel >> >>Elwell, John wrote: >> >> >>>Thanks Samuel and Miguel for your responses. >>> >>>Yes, it was the case where the UA does not support TLS that >> >>was the real >> >>>driver for the question - non-support by a proxy was an >> >>afterthought and >> >>>shouldn't (in theory) be a problem. >>> >>>So if I send an INVITE request (say) to a SIPS URI and >> >>place a SIPS URI in >> >>>the Contact header field, if the last proxy forwards it on >> >>a non-TLS link to >> >>>the UAS, then my real question is whether I can depend on >> >>that working, >> >>>i.e., will the destination UA be able to send me subsequent >> >>requests in that >> >>>dialog? >>> >>>Samuel suggests that the non-TLS UA would still use the SIPS URI for >>>subsequent requests. My idea was that it might convert it >> >>to a SIP URI. I >> >>>guess either should satisfy my concern that my UA will >> >>still be able to >> >>>receive requests from the non-TLS UA. Any other opinions? >>> >>>John >>> >>> >>> >>> >>>>-----Original Message----- >>>>From: Samuel Osorio Calvo [mailto:samuel.osorio@nl.thalesgroup.com] >>>>Sent: 06 April 2005 12:53 >>>>To: Elwell@mgw-int1.ntc.nokia.com; >>>>Miguel.An.Garcia@nokia.com; john.elwell@siemens.com >>>>Cc: sip@ietf.org >>>>Subject: Re: [Sip] Question on SIPS and Contact URI >>>> >>>>When the caller starts a dialog with a SIPS URI, it forces >>>>that all proxies in the path use TLS and since TLS is a >>>>mandatory feature for SIP proxies, the request MUST have >>>>followed a TLS path. >>>>However, RFC 3261 does not mandates anything about the last >>>>hop (UA-->outbound proxy OR egress proxy-->remote UA). >>>>Thus, the final proxy, applying local policies, might send >>>>the SIPS request using another transport mechanism to the UA >>>>because RFC 3261 does not mandates UAs to support TLS. >>>> >>>>Hence, as far as I know, the UA not supporting TLS will use >>>>the standard SIP forwarding mechanisms (Via, Route, Contact, >>>>...) and will probably insert sips: URI in the subsequent >>>>replies and request. These messages will be taken by the >>>>proxy, which will use TLS where applicable: >>>>Something like: >>>> >>>>Dialog initiating request: >>>>UA1---???--->outbound >>>>proxy--TLS-->P1----TLS--->P2----TLS--->Egress proxy--????--->UA2 >>>> >>>>reply & within dialog messages: >>>>UA2---???--->Egress proxy---TLS-->outbound proxy----???--->UA1 >>>>(P1 and P2 have not inserted Record-Route headers). >>>> >>>>??? will be fixed by local policy and UA supported features, >>>>it can be UDP, TCP, SCTP,......... >>>> >>>> >>>>Hope it helps and please correct me if I am not right, >>>> >>>>Samuel Osorio. >>>> >>>> >>>>Unclassified. >>>> >>>> >>>>>>>Miguel Garcia 04/06/05 12:23PM >>> >>>>>> >>>>The first proxy not supporting TLS? Hmmm... I thought that RFC 3261 >>>>mandates proxies to support TLS (besides UDP and TCP), so the >>>>case would >>>>not exist. >>>> >>>>/Miguel >>>> >>>>Elwell, John wrote: >>>> >>>> >>>> >>>>>I cannot find anything that specifies how a SIP UA should >>>> >>>>behave when it >>>> >>>> >>>>>receives a SIPS URI in a Contact header during a dialog >>>> >>>>(target refresh) or >>>> >>>> >>>>>during dialog establishment if the transport is not TLS. >>>> >>>>The implication is >>>> >>>> >>>>>that all future requests to that contact must be sent using >>>> >>>>TLS, even though >>>> >>>> >>>>>TLS has not been used up to now for this dialog. Is that >>>> >>>>correct? What would >>>> >>>> >>>>>a UA do that does not support TLS? What if the first proxy that has >>>>>record-routed does not support TLS? One solution might be >>>> >>>>to convert the URI >>>> >>>> >>>>>to a SIP URI for sending future requests. >>>>> >>>>>John >>>>> >>>>> >>>>>_______________________________________________ >>>>>Sip mailing list https://www1.ietf.org/mailman/listinfo/sip >>>>>This list is for NEW development of the core SIP Protocol >>>>>Use sip-implementors@cs.columbia.edu for questions on current sip >>>>>Use sipping@ietf.org for new developments on the application of sip >>>>> >>>> >>>>-- >>>>Miguel A. Garcia tel:+358-50-4804586 >>>>sip:miguel.an.garcia@openlaboratory.net >>>>Nokia Research Center Helsinki, Finland >>>> >>>> >>>>_______________________________________________ >>>>Sip mailing list https://www1.ietf.org/mailman/listinfo/sip >>>>This list is for NEW development of the core SIP Protocol >>>>Use sip-implementors@cs.columbia.edu for questions on current sip >>>>Use sipping@ietf.org for new developments on the application of sip >>>> >>>> >>>>_______________________________________________ >>>>Sip mailing list https://www1.ietf.org/mailman/listinfo/sip >>>>This list is for NEW development of the core SIP Protocol >>>>Use sip-implementors@cs.columbia.edu for questions on current sip >>>>Use sipping@ietf.org for new developments on the application of sip >>>> >>> >>-- >>Miguel A. Garcia tel:+358-50-4804586 >>sip:miguel.an.garcia@openlaboratory.net >>Nokia Research Center Helsinki, Finland >> > > > _______________________________________________ > Sip mailing list https://www1.ietf.org/mailman/listinfo/sip > This list is for NEW development of the core SIP Protocol > Use sip-implementors@cs.columbia.edu for questions on current sip > Use sipping@ietf.org for new developments on the application of sip > _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Wed Apr 6 10:54:30 2005 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA19514 for ; Wed, 6 Apr 2005 10:54:30 -0400 (EDT) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJC3k-0001k2-AL for sip-web-archive@ietf.org; Wed, 06 Apr 2005 11:03:12 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJBok-00050S-La; Wed, 06 Apr 2005 10:47:42 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJBoi-00050N-2P for sip@megatron.ietf.org; Wed, 06 Apr 2005 10:47:40 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA18866 for ; Wed, 6 Apr 2005 10:47:37 -0400 (EDT) Received: from sj-iport-3-in.cisco.com ([171.71.176.72] helo=sj-iport-3.cisco.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJBx5-0001W4-1Y for sip@ietf.org; Wed, 06 Apr 2005 10:56:19 -0400 Received: from sj-core-2.cisco.com (171.71.177.254) by sj-iport-3.cisco.com with ESMTP; 06 Apr 2005 07:47:30 -0700 X-IronPort-AV: i="3.92,79,1112598000"; d="scan'208"; a="246371756:sNHT31009042" Received: from flask.cisco.com (IDENT:mirapoint@flask.cisco.com [161.44.122.62]) by sj-core-2.cisco.com (8.12.10/8.12.6) with ESMTP id j36ElMgG004622; Wed, 6 Apr 2005 07:47:25 -0700 (PDT) Received: from cisco.com ([161.44.79.173]) by flask.cisco.com (MOS 3.4.6-GR) with ESMTP id AQK12983; Wed, 6 Apr 2005 10:47:25 -0400 (EDT) Message-ID: <4253F67C.6010002@cisco.com> Date: Wed, 06 Apr 2005 10:47:24 -0400 From: Paul Kyzivat User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.1) Gecko/20020826 X-Accept-Language: en-us, en MIME-Version: 1.0 To: Dale Worley Subject: Re: [Sip] Question on SIPS and Contact URI References: <002c01c53aaf$ad4e12f0$6a01010a@keywest> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Score: 0.0 (/) X-Scan-Signature: 9ed51c9d1356100bce94f1ae4ec616a9 Content-Transfer-Encoding: 7bit Cc: sip@ietf.org X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 50a516d93fd399dc60588708fd9a3002 Content-Transfer-Encoding: 7bit Dale has it right. A corollary to this is that using a sips uri in the Contact at most guarantees that the sips requirements will be followed in routing from the last proxy in the route header. This isn't especially helpful in general. Paul Dale Worley wrote: >>However, RFC 3261 does not mandates anything about the last >>hop (UA-->outbound proxy OR egress proxy-->remote UA). >>Thus, the final proxy, applying local policies, might send >>the SIPS request using another transport mechanism to the UA >>because RFC 3261 does not mandates UAs to support TLS. > > > Strictly speaking, section 4 says "A call made to a SIPS URI guarantees that > ... TLS .. is used to carry all SIP messages from the caller to the domain > of the callee. From there, the request is sent securely to the callee, but > with security mechanisms that depend on the policy of the domain of the > callee." > > Once a dialog is established, requests within the dialog are handled > differently than requests outside of a dialog, in regard to their > request-URIs and routing. > > Section 12.2.1.1 says "A request within a dialog is constructed by using > many of the components of the state stored as part of the dialog. ... The > UAC uses the remote target and route set to build the Request-URI and Route > header field of the request. [much detail to support RFC 2543 follows]" > > The request within a dialog is routed using the stored route set of the > dialog. It is loaded into the Route: headers, which control how the request > is routed. > > Dale > > > _______________________________________________ > Sip mailing list https://www1.ietf.org/mailman/listinfo/sip > This list is for NEW development of the core SIP Protocol > Use sip-implementors@cs.columbia.edu for questions on current sip > Use sipping@ietf.org for new developments on the application of sip > _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Wed Apr 6 11:15:34 2005 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA23043 for ; Wed, 6 Apr 2005 11:15:34 -0400 (EDT) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJCO3-0002q3-VF for sip-web-archive@ietf.org; Wed, 06 Apr 2005 11:24:16 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJC5d-0005Ck-BL; Wed, 06 Apr 2005 11:05:09 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJC5b-0005Bj-CN for sip@megatron.ietf.org; Wed, 06 Apr 2005 11:05:07 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA20945 for ; Wed, 6 Apr 2005 11:05:04 -0400 (EDT) Received: from [65.220.123.3] (helo=mail.pingtel.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJCDx-00028s-8u for sip@ietf.org; Wed, 06 Apr 2005 11:13:46 -0400 Received: from keywest (hide.pingtel.com [65.220.123.2]) by mail.pingtel.com (Postfix) with SMTP id 411916C019 for ; Wed, 6 Apr 2005 11:05:03 -0400 (EDT) From: "Dale Worley" To: Subject: RE: [Sip] Question on SIPS and Contact URI Date: Wed, 6 Apr 2005 11:03:02 -0400 Message-ID: <003e01c53ab9$bb504d50$6a01010a@keywest> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook CWS, Build 9.0.2416 (9.0.2910.0) In-Reply-To: <4253F67C.6010002@cisco.com> Importance: Normal X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1441 X-Spam-Score: 0.0 (/) X-Scan-Signature: 856eb5f76e7a34990d1d457d8e8e5b7f Content-Transfer-Encoding: 7bit X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 93238566e09e6e262849b4f805833007 Content-Transfer-Encoding: 7bit > From: Paul Kyzivat > > A corollary to this is that using a sips > uri in the > Contact at most guarantees that the sips requirements will be > followed > in routing from the last proxy in the route header. This isn't > especially helpful in general. It doesn't even guarantee that, since the last several routers might all be inside the destination domain. What it does guarantee is that any segments of the path that aren't done with TLS are done under the policy control of proxies that are administered by the destination domain, and that administration is presumably as concerned as anyone with the security of the contents of the dialog. Dale _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Wed Apr 6 13:02:57 2005 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA05112 for ; Wed, 6 Apr 2005 13:02:57 -0400 (EDT) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJE44-0006MN-Jx for sip-web-archive@ietf.org; Wed, 06 Apr 2005 13:11:40 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJDvW-0002X0-8T; Wed, 06 Apr 2005 13:02:50 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJDvU-0002U8-Qp for sip@megatron.ietf.org; Wed, 06 Apr 2005 13:02:48 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA05106 for ; Wed, 6 Apr 2005 13:02:45 -0400 (EDT) Received: from voyager.coretrek.no ([212.33.142.2]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJE3l-0006LV-91 for sip@ietf.org; Wed, 06 Apr 2005 13:11:29 -0400 Received: from localhost (localhost [127.0.0.1]) by voyager.coretrek.no (Postfix) with ESMTP id 0D59EA9874; Wed, 6 Apr 2005 19:02:22 +0200 (CEST) Received: from [72.29.231.70] (unknown [72.29.231.70]) by voyager.coretrek.no (Postfix) with ESMTP id BD0CFA9844; Wed, 6 Apr 2005 19:01:53 +0200 (CEST) In-Reply-To: <425331FA.1050900@cisco.com> References: <4250EB85.8010705@cisco.com> <58ac5fabce34d2be892f0e219a9affe9@telio.no> <425331FA.1050900@cisco.com> Mime-Version: 1.0 (Apple Message framework v619.2) Content-Type: text/plain; charset=US-ASCII; format=flowed Message-Id: <0fc5dbdb17b4164340ca3f4cd679eecd@telio.no> Content-Transfer-Encoding: 7bit From: Hisham Khartabil Subject: Re: [Sip] Target-Dialog draft submitted - open issue around kpml, dialog package Date: Wed, 6 Apr 2005 19:00:32 +0200 To: Jonathan Rosenberg X-Mailer: Apple Mail (2.619.2) X-Virus-Scanned: by AMaViS perl-11 (CoreTrek clamav patch 1) X-Spam-Score: 0.0 (/) X-Scan-Signature: 538aad3a3c4f01d8b6a6477ca4248793 Content-Transfer-Encoding: 7bit Cc: IETF SIP List X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 0a7aa2e6e558383d84476dc338324fab Content-Transfer-Encoding: 7bit I'm confused now. If they serve different purposes, then what is the problem? Do you believe that current implementations of those mentioned event packages already use the event header information for authorisation purposes? Hisham On Apr 6, 2005, at 2:48 AM, Jonathan Rosenberg wrote: > > > Hisham Khartabil wrote: > >> I prefer (1) with a slight modification: you need to say that event >> packages needing this information are required to choose which >> mechanism to use and document it. If an event package does not define >> a mechanism then the target-dialog header should be used. >> target-dialog extension must not be used with event packages the >> define where to place such info. > > My point is that the semantics are different. The usage of the dialog > identifiers in the event header field is more like a filter; it is > asking the recipient for a subscription to information related to that > dialog only. The Target-Dialog header field is used for > proof-of-knowledge for authorization purposes. One can imagine that a > single event package might use the dialog identifiers in the Event > header field in some subscriptions (in which case target dialog is not > needed), and in other cases, the event header field has no dialog > identifiers, but still the target dialog is needed for authorization > purposes. > >> I don't think the drawback you mention for 1 is a drawback really. >> Implementers of an event package that already defines where to find >> target dialog information (like dialog package) would not use this >> extension and therefore recipients who also understand the package >> would not look in 2 places. The package document tells you where to >> look. > > Per above, I don't think you could do that in many cases. > > -Jonathan R. > > > -- > Jonathan D. Rosenberg, Ph.D. 600 Lanidex Plaza > Director, Service Provider VoIP Architecture Parsippany, NJ > 07054-2711 > Cisco Systems > jdrosen@cisco.com FAX: (973) 952-5050 > http://www.jdrosen.net PHONE: (973) 952-5000 > http://www.cisco.com > _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Wed Apr 6 13:03:43 2005 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA05199 for ; Wed, 6 Apr 2005 13:03:42 -0400 (EDT) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJE4o-0006ON-C4 for sip-web-archive@ietf.org; Wed, 06 Apr 2005 13:12:26 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJDvl-0002jT-Lf; Wed, 06 Apr 2005 13:03:05 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJDvj-0002jH-47 for sip@megatron.ietf.org; Wed, 06 Apr 2005 13:03:03 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA05135 for ; Wed, 6 Apr 2005 13:02:59 -0400 (EDT) Received: from voyager.coretrek.no ([212.33.142.2]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJE42-0006MA-Bg for sip@ietf.org; Wed, 06 Apr 2005 13:11:43 -0400 Received: from localhost (localhost [127.0.0.1]) by voyager.coretrek.no (Postfix) with ESMTP id 07C5DA9869; Wed, 6 Apr 2005 19:02:45 +0200 (CEST) Received: from [72.29.231.70] (unknown [72.29.231.70]) by voyager.coretrek.no (Postfix) with ESMTP id A9760A9864; Wed, 6 Apr 2005 19:02:31 +0200 (CEST) In-Reply-To: <425331FA.1050900@cisco.com> References: <4250EB85.8010705@cisco.com> <58ac5fabce34d2be892f0e219a9affe9@telio.no> <425331FA.1050900@cisco.com> Mime-Version: 1.0 (Apple Message framework v619.2) Content-Type: text/plain; charset=US-ASCII; format=flowed Message-Id: <4e765416dfbbccb5fd78ff85599042ce@telio.no> Content-Transfer-Encoding: 7bit From: Hisham Khartabil Subject: Re: [Sip] Target-Dialog draft submitted - open issue around kpml, dialog package Date: Wed, 6 Apr 2005 19:01:57 +0200 To: Jonathan Rosenberg X-Mailer: Apple Mail (2.619.2) X-Virus-Scanned: by AMaViS perl-11 (CoreTrek clamav patch 1) X-Spam-Score: 0.0 (/) X-Scan-Signature: 538aad3a3c4f01d8b6a6477ca4248793 Content-Transfer-Encoding: 7bit Cc: IETF SIP List X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 0a7aa2e6e558383d84476dc338324fab Content-Transfer-Encoding: 7bit I'm confused now. If they serve different purposes, then what is the problem? Do you believe that current implementations of those mentioned event packages already use the event header information for authorisation purposes? Hisham On Apr 6, 2005, at 2:48 AM, Jonathan Rosenberg wrote: > > > Hisham Khartabil wrote: > >> I prefer (1) with a slight modification: you need to say that event >> packages needing this information are required to choose which >> mechanism to use and document it. If an event package does not define >> a mechanism then the target-dialog header should be used. >> target-dialog extension must not be used with event packages the >> define where to place such info. > > My point is that the semantics are different. The usage of the dialog > identifiers in the event header field is more like a filter; it is > asking the recipient for a subscription to information related to that > dialog only. The Target-Dialog header field is used for > proof-of-knowledge for authorization purposes. One can imagine that a > single event package might use the dialog identifiers in the Event > header field in some subscriptions (in which case target dialog is not > needed), and in other cases, the event header field has no dialog > identifiers, but still the target dialog is needed for authorization > purposes. > >> I don't think the drawback you mention for 1 is a drawback really. >> Implementers of an event package that already defines where to find >> target dialog information (like dialog package) would not use this >> extension and therefore recipients who also understand the package >> would not look in 2 places. The package document tells you where to >> look. > > Per above, I don't think you could do that in many cases. > > -Jonathan R. > > > -- > Jonathan D. Rosenberg, Ph.D. 600 Lanidex Plaza > Director, Service Provider VoIP Architecture Parsippany, NJ > 07054-2711 > Cisco Systems > jdrosen@cisco.com FAX: (973) 952-5050 > http://www.jdrosen.net PHONE: (973) 952-5000 > http://www.cisco.com > _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Wed Apr 6 15:55:56 2005 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA25274 for ; Wed, 6 Apr 2005 15:55:56 -0400 (EDT) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJGlT-0003yB-Lq for sip-web-archive@ietf.org; Wed, 06 Apr 2005 16:04:40 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJGNx-0003lF-OI; Wed, 06 Apr 2005 15:40:21 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJGNu-0003ks-Rd for sip@megatron.ietf.org; Wed, 06 Apr 2005 15:40:19 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA21695 for ; Wed, 6 Apr 2005 15:40:16 -0400 (EDT) Received: from oak.neustar.com ([209.173.53.70]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJGWJ-0002aF-Ei for sip@ietf.org; Wed, 06 Apr 2005 15:49:00 -0400 Received: from stntsmtp1.cis.neustar.com (smartexch.neustar.com [10.31.13.79]) by oak.neustar.com (8.12.8/8.11.0) with ESMTP id j36Jd6KD001660; Wed, 6 Apr 2005 19:39:06 GMT Received: from stntexch03.cis.neustar.com ([10.31.13.45]) by stntsmtp1.cis.neustar.com with Microsoft SMTPSVC(6.0.3790.211); Wed, 6 Apr 2005 15:39:07 -0400 X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Subject: RE: [Sip] RE: Question to Identity draft Date: Wed, 6 Apr 2005 15:39:05 -0400 Message-ID: <24EAE5D4448B9D4592C6D234CBEBD59701502E0D@stntexch03.cis.neustar.com> Thread-Topic: [Sip] RE: Question to Identity draft Thread-Index: AcU6PDLkpwUUJA/aRZmaAAN8z2kDsgAAEQTw From: "Peterson, Jon" To: "Francois Audet" , "Fries Steffen" , X-OriginalArrivalTime: 06 Apr 2005 19:39:07.0000 (UTC) FILETIME=[4BE03F80:01C53AE0] X-Spam-Score: 0.0 (/) X-Scan-Signature: 612a16ba5c5f570bfc42b3ac5606ac53 Content-Transfer-Encoding: quoted-printable Cc: IETF SIP List X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: d008c19e97860b8641c1851f84665a75 Content-Transfer-Encoding: quoted-printable I agree that the problems you describe below are all retargeting = problems. The retargeting draft (peterson-sipping-retarget-00 Section = 2.3) notes that this problem applies to the RFC3261 INVITE-like = certificate exchange mechanism. All in all, though, I'm pretty sure that = these sorts of problems are more tractable in a SUBSCRIBE-like model for = certificate acquisition than they are in an INVITE-like model for = certificate acquisition. In an INVITE-like model, you are sending the content that you want to = encrypt - that is, a session request - to an unanticipatable target. In = a SUBSCRIBE-like model, you are merely sending a request for a = certificate to an unanticipatable target. The second is at least = superficially better. If you strip everything out of the INVITE that = might be considered sensitive before you send your request, in the hopes = of just soliciting a certificate in a response, then basically you are = using the INVITE as a makeshift fetch. Using SUBSCRIBE has decided = advantages over a fetch - namely, you can establish persistent = relationships and get notifications when the target's certificate = changes. Speaking at a high level, there is no technical reason why a = subscription to a certificate service could not be redirected/retargeted = or somehow trickle down to the right service for the apparently = destination of the call. The tough part, of course, is synchronizing the = path traversed by the subscription with the path that would be traveled = by an INVITE, so that the certificate held by the UAC will always = correspond with the appropriate UAS target. I can imagine publication = models, though, in which users publishing certificates to a certificate = service will cause the cert to propagate, through multiple publications, = to where it needs to go for the purposes of certificate acquisition. = There are also possible ways this could be addressed with presence. So, regardless of whether or not sipping-certs solves all of the = conceivable problems, I think it's a more promising direction than = INVITEs. Of course, if a UA for whatever reason receives a request that = is undecipherable, it can reply with a 493 Undecipherable message, as = decribed in RFC3261, and return its certificate in that response. So, I = think the functionality that you describe at the end of your message is = indeed already available in RFC3261. The issues rasied in the = sipping-retargeting draft, though, illustrate why this might not be = sufficient. To address those sorts of problems, I think you'll need = something closer to sipping-certs. Jon Peterson NeuStar, Inc. -----Original Message----- From: Francois Audet [mailto:audet@nortel.com] Sent: Tuesday, April 05, 2005 5:04 PM To: Peterson, Jon; 'Fries Steffen'; 'fluffy@cisco.com' Cc: 'IETF SIP List' Subject: RE: [Sip] RE: Question to Identity draft There is still many cases where the sipping-certs does not work=20 properly, which I think could be addressed by something along=20 the lines of sip-identity and what Steffen is talking about.=20 I think it would complement sipping-certs very well.=20 For example, it is often not the case that sipping-certs=20 will be able to fetch the certificate of the=20 UA that will answer the session. For example:=20 - The target corresponds to a group of people, say in=20 a call center, a hunt group or something along those=20 lines. In many cases, it may not be feasible, or=20 even desireable that all these people share the same=20 certificate.=20 - Retargeting will also not work. By retargetting, I am=20 including any time of forking, forwarding and so forth=20 where the targets correspond to people with different=20 certificates.=20 - The target is a "moving target". For example, it could=20 be a bank of gateways, media servers, IVR systems or=20 whatever.=20 (I guess all those cases are a form of retargeting because=20 the responder is not who was in the initial request).=20 In those cases, you can send SUBSCRIBEs as much as you want,=20 but you won't get a usable certificate because the INVITE=20 after the SUBSCRIBE is not going to land at the same place.=20 If instead something along lines of sip-indentity was used=20 (even in conjunction with sipping-certs), I think we can get=20 rid of the bootstrap problem you refer to, by having a two-pass=20 process.=20 What I am pointing out is the bootstrap problem may exist=20 as well with sipping-certs. In fact, it can be worst in the sense=20 that it would get in an infinite loop of retrying because the=20 target keeps on moving.=20 Assume A always includes it's certificate when it calls B.=20 If A had access to B's certificate beforehand (using certs), then=20 no problem. It works exactly as per sipping-certs.=20 If A couldn't get access to B's certificate beforehand, or if=20 it turns out to be the wrong B, then B would receive the=20 request, but the key (as per your example) would be wrong. B should=20 be able to provide it's certificate to A in the same session, so=20 that the session could be renegotiated (if A whishes to do so).=20 For example, I can think of the following mechanism:=20 - B rejects the request with error code XXX and includes it's = certificate=20 in the response. B also includes a Contact.=20 - A examines the certificate (and Contact), and determine if it will=20 re-initiate the request or not, based on it's own local criteria=20 (is C already trusted, etc.).=20 =20 One use case of course for this is encryption (sRTP). It would work = equally=20 well with SDESC and with MIKEY/kmgmt.=20 > -----Original Message-----=20 > From: sip-bounces@ietf.org [mailto:sip-bounces@ietf.org] On=20 > Behalf Of Peterson, Jon=20 > Sent: Tuesday, April 05, 2005 14:20=20 > To: Fries Steffen; fluffy@cisco.com=20 > Cc: IETF SIP List=20 > Subject: [Sip] RE: Question to Identity draft=20 >=20 >=20 >=20 > Your question points to an important difference in=20 > applicability between sip-identity-04 and sipping-certs-01,=20 > and it is essentially a matter of what you mean by=20 > "communicate securely".=20 >=20 > The primary differences between sip-identity-04 and=20 > sipping-certs-01 lie in what they require user agents to=20 > support and what security services they offer.=20 > sip-identity-04 offers an integrity and replay protection=20 > service, whereas sipping-certs-01 offers a full suit of MIME=20 > security services including confidentiality (the cost of=20 > course being that UAs must support S/MIME and the certificate=20 > acquisition service).=20 >=20 > The method of exchanging certificates within SIP messages=20 > which you describe below was subtantially documented in=20 > RFC3261. There's no doubt the integrity provided by=20 > sip-identity-04 could help to secure certificates exchanged=20 > in this manner. But the question is what security properties=20 > you want to derive from this practice. If you want to use the=20 > exchanged certificates for integrity, then well,=20 > sip-identity-04 already provides integrity. If you want to=20 > use the exchanged certificates for confidentiality, then you=20 > get the bootstrapping problem - how does the sender of the=20 > INVITE learn the key they must use to encrypt the body of=20 > their request? This is the purpose of the certificate server,=20 > and of sipping-certs-01. I doubt that exchanging certificates=20 > within INVITEs and so on will prove more servicable.=20 >=20 > Jon Peterson=20 > NeuStar, Inc.=20 >=20 > > -----Original Message-----=20 > > From: Fries Steffen [mailto:steffen.fries@siemens.com]=20 > > Sent: Tuesday, April 05, 2005 3:04 AM=20 > > To: Peterson, Jon; fluffy@cisco.com=20 > > Cc: IETF SIP List=20 > > Subject: Question to Identity draft=20 > >=20 > >=20 > > Hi Jon, hi Cullen,=20 > >=20 > > by reading the IDs regarding enhanced identity management=20 > > (draft-ietf-sip-identity-04) and certificate management=20 > > (draft-ietf-sipping-certs-01) I've got a question to a=20 > > possible use case.=20 > >=20 > > Assumed that two user A and B from two different domains X=20 > > and Y want to=20 > > communicate securely. User A sends his INVITE with an=20 > > attached certificate=20 > > to User B in domain Y. The INVITE is send through an=20 > > authentication service,=20 > > which authenticates (according the identity draft) that the=20 > > AOR matches the=20 > > FROM field. Additionally a digital signature is calculated=20 > > also over the=20 > > body of the message. Thus also the attached certificate is=20 > > signed. Using=20 > > this approach would assure User B that User A has=20 > registered with his=20 > > credentials in domain X. User B could then use the received=20 > > certificate to=20 > > communicate securely with user A at least for the duration of=20 > > the session.=20 > > User B may also send his certificate to user B also through an=20 > > authentication service. Within a next session, when both users newly = > > registered, the certificates may be different than in the=20 > > session before.=20 > >=20 > > Is this scenario somehow covered by the identity draft? It=20 > > could save the=20 > > credential server in certain scenarios. The approach itself=20 > > may require an=20 > > enhanced storing of the username and certificate associations if=20 > > non-repudiation is desired.=20 > >=20 > > Regards =20 > > Steffen=20 > >=20 >=20 > _______________________________________________=20 > Sip mailing list https://www1.ietf.org/mailman/listinfo/sip=20 > This list is for NEW development of the core SIP Protocol=20 > Use sip-implementors@cs.columbia.edu for questions on current=20 > sip Use sipping@ietf.org for new developments on the=20 > application of sip=20 >=20 >=20 _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Wed Apr 6 16:06:41 2005 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA28449 for ; Wed, 6 Apr 2005 16:06:41 -0400 (EDT) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJGvs-000513-HE for sip-web-archive@ietf.org; Wed, 06 Apr 2005 16:15:25 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJGYq-0006cf-Fl; Wed, 06 Apr 2005 15:51:36 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJGYo-0006ad-Hi for sip@megatron.ietf.org; Wed, 06 Apr 2005 15:51:34 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA23999 for ; Wed, 6 Apr 2005 15:51:32 -0400 (EDT) Received: from oak.neustar.com ([209.173.53.70]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJGhC-0003OZ-FL for sip@ietf.org; Wed, 06 Apr 2005 16:00:16 -0400 Received: from stntsmtp1.cis.neustar.com (smartexch.neustar.com [10.31.13.79]) by oak.neustar.com (8.12.8/8.11.0) with ESMTP id j36JpMKD002269; Wed, 6 Apr 2005 19:51:22 GMT Received: from stntexch03.cis.neustar.com ([10.31.13.45]) by stntsmtp1.cis.neustar.com with Microsoft SMTPSVC(6.0.3790.211); Wed, 6 Apr 2005 15:51:22 -0400 X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Date: Wed, 6 Apr 2005 15:51:22 -0400 Message-ID: <24EAE5D4448B9D4592C6D234CBEBD59701502E0F@stntexch03.cis.neustar.com> Thread-Topic: Question to Identity draft Thread-Index: AcU6huRg0IKdV9yMS+SdPrer74LJcQAWVZgw From: "Peterson, Jon" To: "Fries Steffen" , X-OriginalArrivalTime: 06 Apr 2005 19:51:22.0991 (UTC) FILETIME=[028F8FF0:01C53AE2] X-Spam-Score: 0.0 (/) X-Scan-Signature: 082a9cbf4d599f360ac7f815372a6a15 Content-Transfer-Encoding: quoted-printable Cc: IETF SIP List Subject: [Sip] RE: Question to Identity draft X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: f60d0f7806b0c40781eee6b9cd0b2135 Content-Transfer-Encoding: quoted-printable > [stf] yes, RFC3261 talks about certificate exchhange. But here it is = only > possible to take certificates, which are (more or less) bound to a = person. > Assume that you use certificates, which are bound to the host used for = phone > calls. Then you would need some instance assuring, that this = certificate is > connected with the registration under some AOR. >=20 > What I had in mind is an inband certificate exchange from, e.g., self = signed > certificates, were the authentication services basically assures that = the > message (and thus the certificate) came from a person registered under = a > certain AOR.=20 RFC3261 does in fact describe the self-signed certificate case. > The certificate itself may then be used for end-to-end > integrity services. In what respect would using this certificates for an end-to-end = integrity service be superior to just using sip-identity-04 for = integrity? Note that that strength of a self-signed credential is = necessarily equivalent to the strength of the security mechanism used to = deliver that self-signed credential to potential users. So, if = sip-identity-04 is used to secure the cert, it isn't clear how the cert = provides a stronger or more attractive assurance than sip-identity-04 = itself would provide. > A usage example would be the key management for SRTP > using MIKEY, were one option is the usage of certificates. When here a > certificate is used, which is completely unknown to the receiver, then = there > is no real value. But when a trusted component (the authentication = service) > assures, that a person registered with a dedicated AOR is connected = with > this certificate, then it gets a meaning. It would basically provide = the > assurance, that for the time I am in the call, I am using this = certificate, > which may be sufficient.=20 No question that using sip-identity-04 would guarantee the integrity of = the certificate contained in a SIP message body. But why not have = sip-identity-04 secure the SDP body containing the keymgmt attribute for = MIKEY, rather than going through a certificate exchange phase in order = to subsequently use the a cert (whose strength is equivalent to = sip-identity-04) to secure the SDP body containing the keymgmt? In what = respect is this not a redundant step? Jon Peterson NeuStar, Inc. > Regards > Steffen >=20 >=20 _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Wed Apr 6 16:14:09 2005 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA29737 for ; Wed, 6 Apr 2005 16:14:09 -0400 (EDT) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJH37-0005Rc-6c for sip-web-archive@ietf.org; Wed, 06 Apr 2005 16:22:53 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJGnZ-0006z3-1i; Wed, 06 Apr 2005 16:06:49 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJGnX-0006xY-04 for sip@megatron.ietf.org; Wed, 06 Apr 2005 16:06:47 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA28478 for ; Wed, 6 Apr 2005 16:06:44 -0400 (EDT) Received: from oak.neustar.com ([209.173.53.70]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJGvw-00050r-Ca for sip@ietf.org; Wed, 06 Apr 2005 16:15:29 -0400 Received: from stntsmtp1.cis.neustar.com (smartexch.neustar.com [10.31.13.79]) by oak.neustar.com (8.12.8/8.11.0) with ESMTP id j36K6aKD003181; Wed, 6 Apr 2005 20:06:36 GMT Received: from stntexch03.cis.neustar.com ([10.31.13.45]) by stntsmtp1.cis.neustar.com with Microsoft SMTPSVC(6.0.3790.211); Wed, 6 Apr 2005 16:06:36 -0400 X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Subject: RE: [Sip] sip-identity-05: display-name woes Date: Wed, 6 Apr 2005 16:06:36 -0400 Message-ID: <24EAE5D4448B9D4592C6D234CBEBD59701502E11@stntexch03.cis.neustar.com> Thread-Topic: [Sip] sip-identity-05: display-name woes Thread-Index: AcU6eZdqhWYBDfBRRWONZ0rBExp17gAai80w From: "Peterson, Jon" To: "Elwell, John" , X-OriginalArrivalTime: 06 Apr 2005 20:06:36.0807 (UTC) FILETIME=[233CD170:01C53AE4] X-Spam-Score: 0.8 (/) X-Scan-Signature: 200d029292fbb60d25b263122ced50fc Content-Transfer-Encoding: quoted-printable X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org X-Spam-Score: 0.8 (/) X-Scan-Signature: d16ce744298aacf98517bc7c108bd198 Content-Transfer-Encoding: quoted-printable The issue with C using null for "no policy" is disambiguating this from = the case in from the display-name isn't actually present; e.g., where = the From header field just contains sip:jon@example.com rather than "Jon = Peterson" or what have you. I would prefer to = reserve null for that case. Jon Peterson NeuStar, Inc. > -----Original Message----- > From: sip-bounces@ietf.org [mailto:sip-bounces@ietf.org]On Behalf Of > Elwell, John > Sent: Wednesday, April 06, 2005 12:22 AM > To: Peterson, Jon; sip@ietf.org > Subject: RE: [Sip] sip-identity-05: display-name woes >=20 >=20 > Jon, >=20 > I don't like A and D. Of the others, I am perhaps less negative to B = than > you are (but we do need to make sure we don't go down the slippery = slope). > With C, presumably the default string could be null. How often in = practice > do we anticipate a domain having policies that will authorise display = names > - if this is likely to be a rare thing, we might as well go with E. >=20 > John > =20 >=20 > > -----Original Message----- > > From: Peterson, Jon [mailto:jon.peterson@neustar.biz]=20 > > Sent: 06 April 2005 00:39 > > To: sip@ietf.org > > Subject: [Sip] sip-identity-05: display-name woes > >=20 > >=20 > > In Minneapolis, Jonathan raised the prospect that the=20 > > Identity header field should contain a signature over the=20 > > display-name portion of the >From header field value. This is=20 > > attractive because SIP user agent implementations might=20 > > render only that display-name to their users when an INVITE=20 > > is received. Accordingly, securing display-name is very=20 > > useful for human authorization decisions. After some=20 > > cajoling, I hastily agreed that we could do this for=20 > sip-identity-05. > >=20 > > As I've worked towards a revision, though, I've become=20 > > convinced that this is more complicated than I initially=20 > > thought. At the root of the problem is the extremely rigid=20 > > nature of the sip-identity mechanism. It is intentionally=20 > > hostile to being "configurable" in any way; there are=20 > > currently no reference indicators whose inclusion in the=20 > > Identity signature is optional. If a reference indicator is=20 > > present in the request, it appears in the identity-string=20 > > (which is hashed and signed to form the contents of the=20 > > Identity header field); if it isn't present in the request,=20 > > the corresponding field of the identity-string is blank. > >=20 > > This does not interact well with identity-string elements=20 > > that might or might not be added by the authentication=20 > > service depending on its policies or capabilities.=20 > > Unfortunately, it is difficult to anticipate how the operator=20 > > of an authentication service might decide whether or not a=20 > > human-readable free text field like the display-name is=20 > > appropriate, and accordingly, we can't expect every=20 > > authentication service operator to have such policies. > >=20 > > At a mechanism level, the problem is how we express all of=20 > > the following conditions in the identity string: > >=20 > > - The display-name is present in the request, and it is has=20 > > been authorized by the domain. > > - The display-name is present in the request, but the domain=20 > > has no authorization policies related to display-names. > > - The display-name is not present in the request. > >=20 > > Here are a few options as to how we might approach this: > >=20 > > (A) If the display-name is present, include it in the=20 > > identity string no matter what. Of course, then the problem=20 > > is that the verifier has no way of knowing whether or not the=20 > > domain actually employed any policies to validate the=20 > > display-name. Accordingly, it really doesn't add much value=20 > > for the verifier. > >=20 > > (B) If the display-name is present and authorized, include=20 > > it, and also include some other flag somewhere in the message=20 > > (in the Identity or Identity-Info headers, probably) noting=20 > > that this authentication service enforces display-name=20 > > policies. I am reluctant to start going down this path=20 > > because it introduces variable reference indicators, which=20 > > are a notorious source of bid-down attacks. That flag,=20 > > wherever it resides, must then also be secured by the=20 > > Identity header or it might be removed by someone replaying=20 > > the message. Once we start going down this path, it also=20 > > becomes something of a slippery slope - why not also have a=20 > > flag for other common SIP headers that might optionally be=20 > > included, and which could conceivably be evaluated by an=20 > > authentication service? All of this makes the verification=20 > > processing more complicated as well; the margin of error in=20 > > the regeneration of the hash and string increases. > >=20 > > (C) If the display-name is present and authorized, include=20 > > it. If the display-name is present but the domain has no=20 > > display-name policies, then rather than include it, include=20 > > some fixed value in the identity string like=20 > > 'no-display-policies' in the slot that would ordinarily be=20 > > occupied by the display-name value. That is kinda kludgey,=20 > > but gets the message across to the verifier loud and clear. > >=20 > > (D) If the display-name is present and authorized, include=20 > > it. If the display-name is present but unauthorized, then=20 > > don't include it in the identity-string, and also strip it=20 > > from the From header field of the request. This is=20 > > undesirable because proxy server should not be mucking with=20 > > the From header field unless they want to be called names=20 > > like 'B2BUA' or what have you. Simplest from a verification=20 > > perspective, though. > >=20 > > (E) Give up on including display-name. People should learn to=20 > > make user agents that render addr-specs to their users=20 > > instead of/in addition to display-names. Unlikely that any=20 > > domain will have policies about this anyway (it certainly=20 > > never caught on for email). > >=20 > > Any better ideas, or barring that, any preferences among the above? > >=20 > > Jon Peterson > > NeuStar, Inc. > >=20 > > _______________________________________________ > > Sip mailing list https://www1.ietf.org/mailman/listinfo/sip > > This list is for NEW development of the core SIP Protocol > > Use sip-implementors@cs.columbia.edu for questions on current sip > > Use sipping@ietf.org for new developments on the application of sip > >=20 >=20 > _______________________________________________ > Sip mailing list https://www1.ietf.org/mailman/listinfo/sip > This list is for NEW development of the core SIP Protocol > Use sip-implementors@cs.columbia.edu for questions on current sip > Use sipping@ietf.org for new developments on the application of sip >=20 _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Wed Apr 6 16:24:11 2005 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA01086 for ; Wed, 6 Apr 2005 16:24:11 -0400 (EDT) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJHCo-0005rl-Ca for sip-web-archive@ietf.org; Wed, 06 Apr 2005 16:32:55 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJH2i-0000Km-DF; Wed, 06 Apr 2005 16:22:28 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJH2g-0000Ea-0N for sip@megatron.ietf.org; Wed, 06 Apr 2005 16:22:26 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA00845 for ; Wed, 6 Apr 2005 16:22:23 -0400 (EDT) Received: from oak.neustar.com ([209.173.53.70]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJHB5-0005mN-Hc for sip@ietf.org; Wed, 06 Apr 2005 16:31:08 -0400 Received: from stntsmtp1.cis.neustar.com (smartexch.neustar.com [10.31.13.79]) by oak.neustar.com (8.12.8/8.11.0) with ESMTP id j36KM9KD003775; Wed, 6 Apr 2005 20:22:10 GMT Received: from stntexch03.cis.neustar.com ([10.31.13.45]) by stntsmtp1.cis.neustar.com with Microsoft SMTPSVC(6.0.3790.211); Wed, 6 Apr 2005 16:22:10 -0400 X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Subject: RE: [Sip] Question on SIPS and Contact URI Date: Wed, 6 Apr 2005 16:22:09 -0400 Message-ID: <24EAE5D4448B9D4592C6D234CBEBD59701502E12@stntexch03.cis.neustar.com> Thread-Topic: [Sip] Question on SIPS and Contact URI Thread-Index: AcU6o2Db2Z+iu7kuQfKziXoRk7QKAAAQOENw From: "Peterson, Jon" To: "Elwell, John" , "Samuel Osorio Calvo" , X-OriginalArrivalTime: 06 Apr 2005 20:22:10.0201 (UTC) FILETIME=[4F957090:01C53AE6] X-Spam-Score: 0.0 (/) X-Scan-Signature: e472ca43d56132790a46d9eefd95f0a5 Content-Transfer-Encoding: quoted-printable Cc: sip@ietf.org X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 995b2e24d23b953c94bac5288c432399 Content-Transfer-Encoding: quoted-printable Paul is certainly correct that SIPS is underspecified, and I think that = with the advent of certain other tools for SIP (notably = jennings-sipping-outbound) it will be possible for us to revisit SIPS = and come up with a more coherent story. That much said, I think this issue of providing a Contact header in a = dialog-forming request which uses a transport unsupported by the = recipient is broader than SIPS. If the recipient only supports UDP, and = receives a request with a Contact header containing a ;transport=3DTCP = parameter, what is supposed to happen? This has been a much-discussed = problem for some years. The conventional answer is that a proxy server = that changes the transport (where this is understood to include = converting from TLS to unsecured TCP, even) must Record-Route itself and = remain in the path of future signaling within a dialog. This of course = results in inefficiency when the recipient UA does in fact support the = transport protocol given in the Contact, but the proxy has no way to = anticipate this capability. The more transport protocols we specify for SIP (yes, I'm talking to = you, SCTP), the more sorts of problems along these lines we will face. Jon Peterson NeuStar, Inc. > -----Original Message----- > From: sip-bounces@ietf.org [mailto:sip-bounces@ietf.org]On Behalf Of > Elwell, John > Sent: Wednesday, April 06, 2005 5:20 AM > To: Samuel Osorio Calvo; Miguel.An.Garcia@nokia.com; Elwell, John > Cc: sip@ietf.org > Subject: RE: [Sip] Question on SIPS and Contact URI >=20 >=20 > Thanks Samuel and Miguel for your responses. >=20 > Yes, it was the case where the UA does not support TLS that=20 > was the real > driver for the question - non-support by a proxy was an=20 > afterthought and > shouldn't (in theory) be a problem. >=20 > So if I send an INVITE request (say) to a SIPS URI and place=20 > a SIPS URI in > the Contact header field, if the last proxy forwards it on a=20 > non-TLS link to > the UAS, then my real question is whether I can depend on=20 > that working, > i.e., will the destination UA be able to send me subsequent=20 > requests in that > dialog? >=20 > Samuel suggests that the non-TLS UA would still use the SIPS URI for > subsequent requests. My idea was that it might convert it to=20 > a SIP URI. I > guess either should satisfy my concern that my UA will still=20 > be able to > receive requests from the non-TLS UA. Any other opinions? >=20 > John >=20 >=20 > > -----Original Message----- > > From: Samuel Osorio Calvo [mailto:samuel.osorio@nl.thalesgroup.com]=20 > > Sent: 06 April 2005 12:53 > > To: Elwell@mgw-int1.ntc.nokia.com;=20 > > Miguel.An.Garcia@nokia.com; john.elwell@siemens.com > > Cc: sip@ietf.org > > Subject: Re: [Sip] Question on SIPS and Contact URI > >=20 > > When the caller starts a dialog with a SIPS URI, it forces=20 > > that all proxies in the path use TLS and since TLS is a=20 > > mandatory feature for SIP proxies, the request MUST have=20 > > followed a TLS path. > > However, RFC 3261 does not mandates anything about the last=20 > > hop (UA-->outbound proxy OR egress proxy-->remote UA).=20 > > Thus, the final proxy, applying local policies, might send=20 > > the SIPS request using another transport mechanism to the UA=20 > > because RFC 3261 does not mandates UAs to support TLS. > >=20 > > Hence, as far as I know, the UA not supporting TLS will use=20 > > the standard SIP forwarding mechanisms (Via, Route, Contact,=20 > > ...) and will probably insert sips: URI in the subsequent=20 > > replies and request. These messages will be taken by the=20 > > proxy, which will use TLS where applicable: > > Something like: > >=20 > > Dialog initiating request: > > UA1---???--->outbound=20 > > proxy--TLS-->P1----TLS--->P2----TLS--->Egress proxy--????--->UA2 > >=20 > > reply & within dialog messages: > > UA2---???--->Egress proxy---TLS-->outbound proxy----???--->UA1 > > (P1 and P2 have not inserted Record-Route headers). > >=20 > > ??? will be fixed by local policy and UA supported features,=20 > > it can be UDP, TCP, SCTP,......... > >=20 > >=20 > > Hope it helps and please correct me if I am not right, > >=20 > > Samuel Osorio. > >=20 > >=20 > > Unclassified. > > >>> Miguel Garcia 04/06/05 12:23PM >>> > > The first proxy not supporting TLS? Hmmm... I thought that RFC 3261=20 > > mandates proxies to support TLS (besides UDP and TCP), so the=20 > > case would=20 > > not exist. > >=20 > > /Miguel > >=20 > > Elwell, John wrote: > >=20 > > > I cannot find anything that specifies how a SIP UA should=20 > > behave when it > > > receives a SIPS URI in a Contact header during a dialog=20 > > (target refresh) or > > > during dialog establishment if the transport is not TLS.=20 > > The implication is > > > that all future requests to that contact must be sent using=20 > > TLS, even though > > > TLS has not been used up to now for this dialog. Is that=20 > > correct? What would > > > a UA do that does not support TLS? What if the first=20 > proxy that has > > > record-routed does not support TLS? One solution might be=20 > > to convert the URI > > > to a SIP URI for sending future requests. > > >=20 > > > John > > >=20 > > >=20 > > > _______________________________________________ > > > Sip mailing list https://www1.ietf.org/mailman/listinfo/sip=20 > > > This list is for NEW development of the core SIP Protocol > > > Use sip-implementors@cs.columbia.edu for questions on current sip > > > Use sipping@ietf.org for new developments on the=20 > application of sip > > >=20 > >=20 > > --=20 > > Miguel A. Garcia tel:+358-50-4804586 > > sip:miguel.an.garcia@openlaboratory.net=20 > > Nokia Research Center Helsinki, Finland > >=20 > >=20 > > _______________________________________________ > > Sip mailing list https://www1.ietf.org/mailman/listinfo/sip=20 > > This list is for NEW development of the core SIP Protocol > > Use sip-implementors@cs.columbia.edu for questions on current sip > > Use sipping@ietf.org for new developments on the application of sip > >=20 > >=20 > > _______________________________________________ > > Sip mailing list https://www1.ietf.org/mailman/listinfo/sip > > This list is for NEW development of the core SIP Protocol > > Use sip-implementors@cs.columbia.edu for questions on current sip > > Use sipping@ietf.org for new developments on the application of sip > >=20 >=20 > _______________________________________________ > Sip mailing list https://www1.ietf.org/mailman/listinfo/sip > This list is for NEW development of the core SIP Protocol > Use sip-implementors@cs.columbia.edu for questions on current sip > Use sipping@ietf.org for new developments on the application of sip >=20 _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Wed Apr 6 17:33:38 2005 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA06599 for ; Wed, 6 Apr 2005 17:33:38 -0400 (EDT) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJII2-0007i7-FB for sip-web-archive@ietf.org; Wed, 06 Apr 2005 17:42:23 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJI7Y-00066d-Kk; Wed, 06 Apr 2005 17:31:32 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJI7W-00066T-Re for sip@megatron.ietf.org; Wed, 06 Apr 2005 17:31:30 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA06440 for ; Wed, 6 Apr 2005 17:31:28 -0400 (EDT) Received: from sj-iport-1-in.cisco.com ([171.71.176.70] helo=sj-iport-1.cisco.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJIFw-0007f0-Fo for sip@ietf.org; Wed, 06 Apr 2005 17:40:14 -0400 Received: from sj-core-1.cisco.com (171.71.177.237) by sj-iport-1.cisco.com with ESMTP; 06 Apr 2005 14:31:11 -0700 X-IronPort-AV: i="3.92,82,1112598000"; d="scan'208"; a="626359370:sNHT23707512014" Received: from flask.cisco.com (IDENT:mirapoint@flask.cisco.com [161.44.122.62]) by sj-core-1.cisco.com (8.12.10/8.12.6) with ESMTP id j36LV8Dr029043; Wed, 6 Apr 2005 14:31:09 -0700 (PDT) Received: from cisco.com ([161.44.79.173]) by flask.cisco.com (MOS 3.4.6-GR) with ESMTP id AQK59660; Wed, 6 Apr 2005 17:31:08 -0400 (EDT) Message-ID: <4254551C.7080201@cisco.com> Date: Wed, 06 Apr 2005 17:31:08 -0400 From: Paul Kyzivat User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.1) Gecko/20020826 X-Accept-Language: en-us, en MIME-Version: 1.0 To: "Peterson, Jon" Subject: Re: [Sip] sip-identity-05: display-name woes References: <24EAE5D4448B9D4592C6D234CBEBD59701502E0C@stntexch03.cis.neustar.com> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Score: 0.0 (/) X-Scan-Signature: 798b2e660f1819ae38035ac1d8d5e3ab Content-Transfer-Encoding: 7bit Cc: sip@ietf.org X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 0bc60ec82efc80c84b8d02f4b0e4de22 Content-Transfer-Encoding: 7bit Peterson, Jon wrote: > Here are a few options as to how we might approach this: > > (A) If the display-name is present, include it in the identity string no matter what. Of course, then the problem is that the verifier has no way of knowing whether or not the domain actually employed any policies to validate the display-name. Accordingly, it really doesn't add much value for the verifier. > > (B) If the display-name is present and authorized, include it, and also include some other flag somewhere in the message (in the Identity or Identity-Info headers, probably) noting that this authentication service enforces display-name policies. I am reluctant to start going down this path because it introduces variable reference indicators, which are a notorious source of bid-down attacks. That flag, wherever it resides, must then also be secured by the Identity header or it might be removed by someone replaying the message. Once we start going down this path, it also becomes something of a slippery slope - why not also have a flag for other common SIP headers that might optionally be included, and which could conceivably be evaluated by an authentication service? All of this makes the verification processing more complicated as well; the margin of error in the regeneration of the hash and string increases. > > (C) If the display-name is present and authorized, include it. If the display-name is present but the domain has no display-name policies, then rather than include it, include some fixed value in the identity string like 'no-display-policies' in the slot that would ordinarily be occupied by the display-name value. That is kinda kludgey, but gets the message across to the verifier loud and clear. > > (D) If the display-name is present and authorized, include it. If the display-name is present but unauthorized, then don't include it in the identity-string, and also strip it from the From header field of the request. This is undesirable because proxy server should not be mucking with the From header field unless they want to be called names like 'B2BUA' or what have you. Simplest from a verification perspective, though. > > (E) Give up on including display-name. People should learn to make user agents that render addr-specs to their users instead of/in addition to display-names. Unlikely that any domain will have policies about this anyway (it certainly never caught on for email). I don't much like any of those alternatives. > Any better ideas, or barring that, any preferences among the above? (F) If the display name is present but unauthorized, decline to sign the message. If the display-name is present and authorized, include it. _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Wed Apr 6 19:43:46 2005 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA22596 for ; Wed, 6 Apr 2005 19:43:46 -0400 (EDT) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJKK2-0002Tk-1J for sip-web-archive@ietf.org; Wed, 06 Apr 2005 19:52:34 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJK7k-0003MK-AH; Wed, 06 Apr 2005 19:39:52 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJK7i-0003JY-Hu for sip@megatron.ietf.org; Wed, 06 Apr 2005 19:39:50 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA22239 for ; Wed, 6 Apr 2005 19:39:47 -0400 (EDT) Received: from oak.neustar.com ([209.173.53.70]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJKGA-0002LJ-90 for sip@ietf.org; Wed, 06 Apr 2005 19:48:34 -0400 Received: from stntsmtp1.cis.neustar.com (smartexch.neustar.com [10.31.13.79]) by oak.neustar.com (8.12.8/8.11.0) with ESMTP id j36NdWKD010906; Wed, 6 Apr 2005 23:39:32 GMT Received: from stntexch03.cis.neustar.com ([10.31.13.45]) by stntsmtp1.cis.neustar.com with Microsoft SMTPSVC(6.0.3790.211); Wed, 6 Apr 2005 19:39:32 -0400 X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Subject: RE: [Sip] sip-identity-05: display-name woes Date: Wed, 6 Apr 2005 19:39:32 -0400 Message-ID: <24EAE5D4448B9D4592C6D234CBEBD59701502E14@stntexch03.cis.neustar.com> Thread-Topic: [Sip] sip-identity-05: display-name woes Thread-Index: AcU67/pKrbSPvGr9QkaF9IFT2/sesAADRMgQ From: "Peterson, Jon" To: "Paul Kyzivat" X-OriginalArrivalTime: 06 Apr 2005 23:39:32.0798 (UTC) FILETIME=[E25255E0:01C53B01] X-Spam-Score: 0.0 (/) X-Scan-Signature: 82c9bddb247d9ba4471160a9a865a5f3 Content-Transfer-Encoding: quoted-printable Cc: sip@ietf.org X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 082a9cbf4d599f360ac7f815372a6a15 Content-Transfer-Encoding: quoted-printable The problem with that, I think, is that it does not provide for the case = where the display-name is present, but the authentication service has no = policy with regard to display-names. What does the authentication = service do then, and how is that behavior disambiguated from the other = cases at the verifier? I agree that if the display-name is present and unauthorized, then the = authentication service shouldn't sign the message. In fact, you don't = even have to include the display-name in the identity-string in order to = structure the mechanism like that. The mechanism in sip-identity-04 = essentially reads: (G) If the domain has policies about display-names, and the display-name = is present and unauthorized, decline to sign the message, sending back a = 4xx suggesting that the display-name needs to be correct. Otherwise, = sign the message (NOT including the display-name) and forward it. Ultimately, a signature over the display-name itself is not necessary = unless you are concerned that the message is going to be modified in = transit (which is outside the threat model of sip-identity, since = sip-identity is only concerned with impersonation). Replaying the = message with a differnt display-name isn't really an option because the = replay would be exposed by the other reference indicators present in the = request. So at a high level, the fact that a message is signed at all = (with or without a display-name) could plausibly signify that either the = domain liked the display-name or that it doesn't care about = display-names, but it could never plausibly signify that the domain had = policies about display-names and that it didn't like the display name, = regardless of whether or not the display-name itself is included in the = identity-string. The issue with (G), of course, is that it does not disambiguate the case = where the domain has policies about domain names and authorized this = message from the case where the domain doesn't have policies. Jon Peterson NeuStar, Inc. > -----Original Message----- > From: Paul Kyzivat [mailto:pkyzivat@cisco.com] > Sent: Wednesday, April 06, 2005 2:31 PM > To: Peterson, Jon > Cc: sip@ietf.org > Subject: Re: [Sip] sip-identity-05: display-name woes >=20 [snip] >=20 > I don't much like any of those alternatives. >=20 > > Any better ideas, or barring that, any preferences among the above? >=20 > (F) If the display name is present but unauthorized, decline to sign = the=20 > message. If the display-name is present and authorized, include it. >=20 _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Wed Apr 6 20:49:57 2005 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA27861 for ; Wed, 6 Apr 2005 20:49:56 -0400 (EDT) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJLM3-0003oc-0r for sip-web-archive@ietf.org; Wed, 06 Apr 2005 20:58:43 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJLBd-0005mR-Qm; Wed, 06 Apr 2005 20:47:57 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJLBa-0005mI-Ke for sip@megatron.ietf.org; Wed, 06 Apr 2005 20:47:55 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA27674 for ; Wed, 6 Apr 2005 20:47:52 -0400 (EDT) Received: from sj-iport-5.cisco.com ([171.68.10.87]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJLK2-0003mG-Qu for sip@ietf.org; Wed, 06 Apr 2005 20:56:39 -0400 Received: from rtp-core-2.cisco.com (64.102.124.13) by sj-iport-5.cisco.com with ESMTP; 06 Apr 2005 17:47:45 -0700 Received: from flask.cisco.com (IDENT:mirapoint@flask.cisco.com [161.44.122.62]) by rtp-core-2.cisco.com (8.12.10/8.12.6) with ESMTP id j370lbjI020147; Wed, 6 Apr 2005 20:47:37 -0400 (EDT) Received: from cisco.com ([161.44.79.173]) by flask.cisco.com (MOS 3.4.6-GR) with ESMTP id AQK71801; Wed, 6 Apr 2005 20:47:36 -0400 (EDT) Message-ID: <42548328.6080702@cisco.com> Date: Wed, 06 Apr 2005 20:47:36 -0400 From: Paul Kyzivat User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.1) Gecko/20020826 X-Accept-Language: en-us, en MIME-Version: 1.0 To: "Peterson, Jon" Subject: Re: [Sip] sip-identity-05: display-name woes References: <24EAE5D4448B9D4592C6D234CBEBD59701502E14@stntexch03.cis.neustar.com> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Score: 0.0 (/) X-Scan-Signature: 0ddefe323dd869ab027dbfff7eff0465 Content-Transfer-Encoding: 7bit Cc: sip@ietf.org X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 82c9bddb247d9ba4471160a9a865a5f3 Content-Transfer-Encoding: 7bit The simple answer (but perhaps not a popular one) would be to mandate that the authentication service *must* have a policy wrt display names. (A degenerate policy would be that display names simply aren't permitted.) I suppose it is then necessary to be a little more demanding about what sort of policy is acceptable. (A policy of "you can use any display name you want" is probably not an acceptable policy.) Alternatively, perhaps there should be a standard way for discovering the (human and/or machine readable) authentication policy of a particular authentication service. It doesn't have to be part of the request, just derivable from the authentication service credentials. Paul Peterson, Jon wrote: > The problem with that, I think, is that it does not provide for the case where the display-name is present, but the authentication service has no policy with regard to display-names. What does the authentication service do then, and how is that behavior disambiguated from the other cases at the verifier? > > I agree that if the display-name is present and unauthorized, then the authentication service shouldn't sign the message. In fact, you don't even have to include the display-name in the identity-string in order to structure the mechanism like that. The mechanism in sip-identity-04 essentially reads: > > (G) If the domain has policies about display-names, and the display-name is present and unauthorized, decline to sign the message, sending back a 4xx suggesting that the display-name needs to be correct. Otherwise, sign the message (NOT including the display-name) and forward it. > > Ultimately, a signature over the display-name itself is not necessary unless you are concerned that the message is going to be modified in transit (which is outside the threat model of sip-identity, since sip-identity is only concerned with impersonation). Replaying the message with a differnt display-name isn't really an option because the replay would be exposed by the other reference indicators present in the request. So at a high level, the fact that a message is signed at all (with or without a display-name) could plausibly signify that either the domain liked the display-name or that it doesn't care about display-names, but it could never plausibly signify that the domain had policies about display-names and that it didn't like the display name, regardless of whether or not the display-name itself is included in the identity-string. > > The issue with (G), of course, is that it does not disambiguate the case where the domain has policies about domain names and authorized this message from the case where the domain doesn't have policies. > > Jon Peterson > NeuStar, Inc. > > >>-----Original Message----- >>From: Paul Kyzivat [mailto:pkyzivat@cisco.com] >>Sent: Wednesday, April 06, 2005 2:31 PM >>To: Peterson, Jon >>Cc: sip@ietf.org >>Subject: Re: [Sip] sip-identity-05: display-name woes >> > > [snip] > >>I don't much like any of those alternatives. >> >> >>>Any better ideas, or barring that, any preferences among the above? >> >>(F) If the display name is present but unauthorized, decline to sign the >>message. If the display-name is present and authorized, include it. >> > > _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Wed Apr 6 21:07:42 2005 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA29299 for ; Wed, 6 Apr 2005 21:07:42 -0400 (EDT) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJLdF-0004HI-Bg for sip-web-archive@ietf.org; Wed, 06 Apr 2005 21:16:29 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJLRz-00053V-9I; Wed, 06 Apr 2005 21:04:51 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJLRw-0004ze-8O for sip@megatron.ietf.org; Wed, 06 Apr 2005 21:04:48 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA29129 for ; Wed, 6 Apr 2005 21:04:46 -0400 (EDT) Received: from oak.neustar.com ([209.173.53.70]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJLaO-0004Ct-NL for sip@ietf.org; Wed, 06 Apr 2005 21:13:33 -0400 Received: from stntsmtp1.cis.neustar.com (smartexch.neustar.com [10.31.13.79]) by oak.neustar.com (8.12.8/8.11.0) with ESMTP id j3714cKD013802; Thu, 7 Apr 2005 01:04:38 GMT Received: from stntexch03.cis.neustar.com ([10.31.13.45]) by stntsmtp1.cis.neustar.com with Microsoft SMTPSVC(6.0.3790.211); Wed, 6 Apr 2005 21:04:38 -0400 X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Subject: RE: [Sip] sip-identity-05: display-name woes Date: Wed, 6 Apr 2005 21:04:37 -0400 Message-ID: <24EAE5D4448B9D4592C6D234CBEBD59701502E15@stntexch03.cis.neustar.com> Thread-Topic: [Sip] sip-identity-05: display-name woes Thread-Index: AcU7C2p0+AwSck03Qoq2AlKlPiwkIAAACDRg From: "Peterson, Jon" To: "Paul Kyzivat" X-OriginalArrivalTime: 07 Apr 2005 01:04:38.0481 (UTC) FILETIME=[C58BBC10:01C53B0D] X-Spam-Score: 0.0 (/) X-Scan-Signature: 825e642946eda55cd9bc654a36dab8c2 Content-Transfer-Encoding: quoted-printable Cc: sip@ietf.org X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: ff03b0075c3fc728d7d60a15b4ee1ad2 Content-Transfer-Encoding: quoted-printable > The simple answer (but perhaps not a popular one) would be to mandate=20 > that the authentication service *must* have a policy wrt display = names.=20 > (A degenerate policy would be that display names simply aren't = permitted.) I would feel more comfortable about that if anyone had any idea how a = domain might go about enforcing such policies and distributing = legitimate display-names to users. Currently, we're taking it on faith = that some domains will want to adopt such policies, and will figure out = appropriate operational ways to execute them. Not a small thing to take = on faith given the precedents in the email space, not to mention the = fact that the domains themselves seem to gain little by enforcing these = policies. > I suppose it is then necessary to be a little more demanding about = what=20 > sort of policy is acceptable. (A policy of "you can use any display = name=20 > you want" is probably not an acceptable policy.) Well, it's about as acceptable as the policy "you can use any username = in the addr-spec portion of the From header field that you want", but = that is effectively the state-of-the-art for SIP and email today. I = doubt that sip-identity can have any appreciable effect on what policies = domains want to use for this stuff. What is can do is specify a way, = through mechanism, for a domain to communicate "my policies, however = strict or lax, were followed with regards to this From header field".=20 > Alternatively, perhaps there should be a standard way for discovering=20 > the (human and/or machine readable) authentication policy of a=20 > particular authentication service. It doesn't have to be part of the=20 > request, just derivable from the authentication service credentials. In the end analysis, I can't think of any way that the authorization = decision made by a recipient would change if it had this information. = After all, a bad domain could lie about its policies, deluded domains = will tell you they have a good policy even though it is routinely = circumvented by clever users, and good domains will be good regardless = of whether or not they tell you your policies. As a verifier, I might be = willing to take the word of a third-party auditor, but I don't think we = can incorporate that into our protocol specification. Jon Peterson NeuStar, Inc. > Paul >=20 > Peterson, Jon wrote: > > The problem with that, I think, is that it does not provide=20 > for the case where the display-name is present, but the=20 > authentication service has no policy with regard to=20 > display-names. What does the authentication service do then,=20 > and how is that behavior disambiguated from the other cases=20 > at the verifier? > >=20 > > I agree that if the display-name is present and=20 > unauthorized, then the authentication service shouldn't sign=20 > the message. In fact, you don't even have to include the=20 > display-name in the identity-string in order to structure the=20 > mechanism like that. The mechanism in sip-identity-04=20 > essentially reads: > >=20 > > (G) If the domain has policies about display-names, and the=20 > display-name is present and unauthorized, decline to sign the=20 > message, sending back a 4xx suggesting that the display-name=20 > needs to be correct. Otherwise, sign the message (NOT=20 > including the display-name) and forward it. > >=20 > > Ultimately, a signature over the display-name itself is not=20 > necessary unless you are concerned that the message is going=20 > to be modified in transit (which is outside the threat model=20 > of sip-identity, since sip-identity is only concerned with=20 > impersonation). Replaying the message with a differnt=20 > display-name isn't really an option because the replay would=20 > be exposed by the other reference indicators present in the=20 > request. So at a high level, the fact that a message is=20 > signed at all (with or without a display-name) could=20 > plausibly signify that either the domain liked the=20 > display-name or that it doesn't care about display-names, but=20 > it could never plausibly signify that the domain had policies=20 > about display-names and that it didn't like the display name,=20 > regardless of whether or not the display-name itself is=20 > included in the identity-string. > >=20 > > The issue with (G), of course, is that it does not=20 > disambiguate the case where the domain has policies about=20 > domain names and authorized this message from the case where=20 > the domain doesn't have policies. > >=20 > > Jon Peterson > > NeuStar, Inc. > >=20 > >=20 > >>-----Original Message----- > >>From: Paul Kyzivat [mailto:pkyzivat@cisco.com] > >>Sent: Wednesday, April 06, 2005 2:31 PM > >>To: Peterson, Jon > >>Cc: sip@ietf.org > >>Subject: Re: [Sip] sip-identity-05: display-name woes > >> > >=20 > > [snip] > >=20 > >>I don't much like any of those alternatives. > >> > >> > >>>Any better ideas, or barring that, any preferences among the above? > >> > >>(F) If the display name is present but unauthorized,=20 > decline to sign the=20 > >>message. If the display-name is present and authorized, include it. > >> > >=20 > >=20 >=20 _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Thu Apr 7 02:29:52 2005 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA17002 for ; Thu, 7 Apr 2005 02:29:52 -0400 (EDT) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJQf3-0004No-7w for sip-web-archive@ietf.org; Thu, 07 Apr 2005 02:38:41 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJQVI-0003Vz-5j; Thu, 07 Apr 2005 02:28:36 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJQV6-0003Bv-Hl for sip@megatron.ietf.org; Thu, 07 Apr 2005 02:28:25 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA16799 for ; Thu, 7 Apr 2005 02:28:22 -0400 (EDT) Received: from motgate2.mot.com ([144.189.100.101]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJQdY-0004Kd-Fh for sip@ietf.org; Thu, 07 Apr 2005 02:37:11 -0400 Received: from az33exr03.mot.com (az33exr03.mot.com [10.64.251.233]) by motgate2.mot.com (8.12.11/Motgate2) with ESMTP id j376aUxY013835 for ; Wed, 6 Apr 2005 23:36:30 -0700 (MST) Received: from zin24exm01.ap.mot.com (zin24exm01.ap.mot.com [10.232.25.1]) by az33exr03.mot.com (8.13.1/8.13.0) with ESMTP id j376TADr013512 for ; Thu, 7 Apr 2005 01:29:12 -0500 (CDT) Received: by zin24exm01.ap.mot.com with Internet Mail Service (5.5.2657.72) id <2KKYGWDR>; Thu, 7 Apr 2005 11:58:00 +0530 Message-ID: <772BCEF88A1DD91191F80011856715F302585F7F@zin24exm01.ap.mot.com> From: Chadha Retesh-A19894 To: sip-implementors@cs.columbia.edu, sip@ietf.org Date: Thu, 7 Apr 2005 11:58:00 +0530 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2657.72) X-Spam-Score: 1.9 (+) X-Scan-Signature: 4b800b1eab964a31702fa68f1ff0e955 Subject: [Sip] crossover of 200 ok and PRACK X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============1448144316==" Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org X-Spam-Score: 2.0 (++) X-Scan-Signature: 386e0819b1192672467565a524848168 This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. --===============1448144316== Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C53B3A.F20260D2" This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. ------_=_NextPart_001_01C53B3A.F20260D2 Content-Type: text/plain Hi I think the following scenario is not discussed in the RFC 3262. What wil be the response to PRACK -- 481 or 200 ok??? INVITE (with 100 rel) ----> <----- 180 ringing (Rseq 1, without sdp) <----- 200 ok (INVITE), as user accepted the call, and since 180 didn't have sdp, 200 need not be delayed. PRACK (siince it first got 180) ----> ACK ----> This response will matter for interoperability with another Sip client. Thanks & rgds, Retesh ------_=_NextPart_001_01C53B3A.F20260D2 Content-Type: text/html Content-Transfer-Encoding: base64 PCFET0NUWVBFIEhUTUwgUFVCTElDICItLy9XM0MvL0RURCBIVE1MIDQuMCBUcmFuc2l0aW9uYWwv L0VOIj4NCjxIVE1MPjxIRUFEPg0KPE1FVEEgSFRUUC1FUVVJVj0iQ29udGVudC1UeXBlIiBDT05U RU5UPSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXMtYXNjaWkiPg0KPFRJVExFPk1lc3NhZ2U8L1RJVExF Pg0KDQo8TUVUQSBjb250ZW50PSJNU0hUTUwgNi4wMC4yODAwLjE0NzkiIG5hbWU9R0VORVJBVE9S PjwvSEVBRD4NCjxCT0RZPg0KPERJVj48U1BBTiBjbGFzcz03ODE0MjIxMDYtMDcwNDIwMDU+PEZP TlQgZmFjZT1BcmlhbCANCnNpemU9Mj5IaTwvRk9OVD48L1NQQU4+PC9ESVY+DQo8RElWPjxTUEFO IGNsYXNzPTc4MTQyMjEwNi0wNzA0MjAwNT48Rk9OVCBmYWNlPUFyaWFsIHNpemU9Mj5JIHRoaW5r IHRoZSANCmZvbGxvd2luZyBzY2VuYXJpbyBpcyBub3QgZGlzY3Vzc2VkIGluIHRoZSBSRkMgMzI2 Mi48L0ZPTlQ+PC9TUEFOPjwvRElWPg0KPERJVj48U1BBTiBjbGFzcz03ODE0MjIxMDYtMDcwNDIw MDU+PEZPTlQgZmFjZT1BcmlhbCBzaXplPTI+V2hhdCB3aWwgYmUgdGhlIA0KcmVzcG9uc2UgdG8g UFJBQ0sgLS0gNDgxIG9yIDIwMCBvaz8/PzwvRk9OVD48L1NQQU4+PC9ESVY+DQo8RElWPjxTUEFO IGNsYXNzPTc4MTQyMjEwNi0wNzA0MjAwNT48Rk9OVCBmYWNlPUFyaWFsIA0Kc2l6ZT0yPjwvRk9O VD48L1NQQU4+Jm5ic3A7PC9ESVY+DQo8RElWPjxTUEFOIGNsYXNzPTc4MTQyMjEwNi0wNzA0MjAw NT48Rk9OVCBmYWNlPUFyaWFsIHNpemU9Mj5JTlZJVEUgKHdpdGggMTAwIA0KcmVsKSAtLS0tJmd0 OzwvRk9OVD48L1NQQU4+PC9ESVY+DQo8RElWPjxTUEFOIA0KY2xhc3M9NzgxNDIyMTA2LTA3MDQy MDA1PiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOzxGT05UIA0KZmFjZT1BcmlhbCBzaXplPTI+Jmx0Oy0tLS0tIDE4MCByaW5n aW5nIChSc2VxIDEsIHdpdGhvdXQgDQpzZHApPC9GT05UPjwvU1BBTj48L0RJVj4NCjxESVY+PFNQ QU4gY2xhc3M9NzgxNDIyMTA2LTA3MDQyMDA1Pg0KPERJVj48U1BBTiBjbGFzcz03ODE0MjIxMDYt MDcwNDIwMDU+PEZPTlQgZmFjZT1BcmlhbCANCnNpemU9Mj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbHQ7LS0tLS0gDQoy MDAgb2sgKElOVklURSksIGFzIHVzZXIgYWNjZXB0ZWQgdGhlIGNhbGwsIGFuZCBzaW5jZSAxODAg ZGlkbid0IGhhdmUgc2RwLCAyMDAgDQpuZWVkIG5vdCBiZSBkZWxheWVkLjwvRk9OVD48L1NQQU4+ PC9ESVY+DQo8RElWPjxTUEFOIGNsYXNzPTc4MTQyMjEwNi0wNzA0MjAwNT4NCjxESVY+PFNQQU4g Y2xhc3M9NzgxNDIyMTA2LTA3MDQyMDA1PjxGT05UIGZhY2U9QXJpYWwgc2l6ZT0yPlBSQUNLIChz aWluY2UgaXQgDQpmaXJzdCBnb3QgMTgwKSZuYnNwOy0tLS0mZ3Q7PC9GT05UPjwvU1BBTj48L0RJ Vj48Rk9OVCBmYWNlPUFyaWFsPjxGT05UIHNpemU9Mj4NCjxESVY+PFNQQU4gY2xhc3M9NzgxNDIy MTA2LTA3MDQyMDA1PjxGT05UIGZhY2U9QXJpYWwgDQpzaXplPTI+QUNLJm5ic3A7LS0tLSZndDs8 L0ZPTlQ+PC9TUEFOPjwvRElWPg0KPERJVj48U1BBTiBjbGFzcz03ODE0MjIxMDYtMDcwNDIwMDU+ PC9TUEFOPiZuYnNwOzwvRElWPg0KPERJVj48U1BBTiBjbGFzcz03ODE0MjIxMDYtMDcwNDIwMDU+ VGhpcyByZXNwb25zZSB3aWxsIG1hdHRlciBmb3IgDQppbnRlcm9wZXJhYmlsaXR5IHdpdGggYW5v dGhlciBTaXAgY2xpZW50LjwvU1BBTj48L0RJVj4NCjxESVY+PFNQQU4gY2xhc3M9NzgxNDIyMTA2 LTA3MDQyMDA1PjwvU1BBTj4mbmJzcDs8L0RJVj4NCjxESVY+PFNQQU4gY2xhc3M9NzgxNDIyMTA2 LTA3MDQyMDA1PlRoYW5rcyAmYW1wOyByPC9TUEFOPjxTUEFOIA0KY2xhc3M9NzgxNDIyMTA2LTA3 MDQyMDA1PmdkcywgPC9TUEFOPjwvRElWPg0KPERJVj48U1BBTiBjbGFzcz03ODE0MjIxMDYtMDcw NDIwMDU+PC9TUEFOPjxTUEFOIA0KY2xhc3M9NzgxNDIyMTA2LTA3MDQyMDA1PlJldGVzaDwvU1BB Tj48L0RJVj48L0ZPTlQ+PC9GT05UPjwvU1BBTj48L0RJVj48L1NQQU4+PC9ESVY+PC9CT0RZPjwv SFRNTD4NCg== ------_=_NextPart_001_01C53B3A.F20260D2-- --===============1448144316== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline Content-Transfer-Encoding: 7bit _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip --===============1448144316==-- From sip-bounces@ietf.org Thu Apr 7 03:11:54 2005 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA21043 for ; Thu, 7 Apr 2005 03:11:54 -0400 (EDT) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJRJk-0005oK-4D for sip-web-archive@ietf.org; Thu, 07 Apr 2005 03:20:44 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJR5X-0007sI-Ec; Thu, 07 Apr 2005 03:06:03 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJR5S-0007s7-NK for sip@megatron.ietf.org; Thu, 07 Apr 2005 03:05:59 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA20563 for ; Thu, 7 Apr 2005 03:05:56 -0400 (EDT) Received: from mgw-x3.nokia.com ([131.228.20.26]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJRDw-0005bh-P4 for sip@ietf.org; Thu, 07 Apr 2005 03:14:46 -0400 Received: from esdks004.ntc.nokia.com (esdks004.ntc.nokia.com [172.21.138.159]) by mgw-x3.nokia.com (Switch-2.2.8/Switch-2.2.8) with ESMTP id j3775ju08593; Thu, 7 Apr 2005 10:05:45 +0300 (EET DST) X-Scanned: Thu, 7 Apr 2005 10:05:27 +0300 Nokia Message Protector V1.3.34 2004121512 - RELEASE Received: (from root@localhost) by esdks004.ntc.nokia.com (8.12.9/8.12.9) id j3775RYc007474; Thu, 7 Apr 2005 10:05:27 +0300 Received: from mgw-int2.ntc.nokia.com (172.21.143.97) by esdks004.ntc.nokia.com 004ZcBw8; Thu, 07 Apr 2005 10:05:25 EEST Received: from esebh002.NOE.Nokia.com (esebh002.ntc.nokia.com [172.21.138.77]) by mgw-int2.ntc.nokia.com (Switch-2.2.8/Switch-2.2.8) with ESMTP id j3775KU23302; Thu, 7 Apr 2005 10:05:20 +0300 (EET DST) Received: from [127.0.0.1] ([10.162.17.135]) by esebh002.NOE.Nokia.com with Microsoft SMTPSVC(5.0.2195.6881); Thu, 7 Apr 2005 10:05:04 +0300 Message-ID: <4254DBA0.2060306@nokia.com> Date: Thu, 07 Apr 2005 10:05:04 +0300 From: Miguel Garcia User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7.2) Gecko/20040804 Netscape/7.2 (ax) X-Accept-Language: en-us, en, es-es MIME-Version: 1.0 To: "Peterson, Jon" Subject: Re: [Sip] Question on SIPS and Contact URI References: <24EAE5D4448B9D4592C6D234CBEBD59701502E12@stntexch03.cis.neustar.com> In-Reply-To: <24EAE5D4448B9D4592C6D234CBEBD59701502E12@stntexch03.cis.neustar.com> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-OriginalArrivalTime: 07 Apr 2005 07:05:04.0420 (UTC) FILETIME=[1F9C2640:01C53B40] X-Spam-Score: 0.0 (/) X-Scan-Signature: 8b6657e60309a1317174c9db2ae5f227 Content-Transfer-Encoding: 7bit Cc: sip@ietf.org, "Elwell, John" X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: cdb443e3957ca9b4c5b55e78cfcf4b26 Content-Transfer-Encoding: 7bit I think it is widely agreed that SIPS is underspecified. Although this give us a hint for future work, probably we should provide guidelines for those facing problems in real deployments. I suspect Jon already mentioned those guidelines: a) if a proxy changes a transport protocol, it should double record route. In my opinion this does not apply to mandatory transport protocols in the UA, e.g, a proxy that changes from UDP to TCP, because both are implemented in User Agents. b) in case a UA receives a SIP request that creates a dialog, whose next hope (Contact or Record-Route) contains a non-supported transport protocol, the UA should reject the dialog. I would assume that a Warning header could provide further information about the failure. Is this reasonable for the time being? /Miguel "Peterson, Jon wrote: > Paul is certainly correct that SIPS is underspecified, and I think that with the advent of certain other tools for SIP (notably jennings-sipping-outbound) it will be possible for us to revisit SIPS and come up with a more coherent story. > > That much said, I think this issue of providing a Contact header in a dialog-forming request which uses a transport unsupported by the recipient is broader than SIPS. If the recipient only supports UDP, and receives a request with a Contact header containing a ;transport=TCP parameter, what is supposed to happen? This has been a much-discussed problem for some years. The conventional answer is that a proxy server that changes the transport (where this is understood to include converting from TLS to unsecured TCP, even) must Record-Route itself and remain in the path of future signaling within a dialog. This of course results in inefficiency when the recipient UA does in fact support the transport protocol given in the Contact, but the proxy has no way to anticipate this capability. > > The more transport protocols we specify for SIP (yes, I'm talking to you, SCTP), the more sorts of problems along these lines we will face. > > Jon Peterson > NeuStar, Inc. > > >>-----Original Message----- >>From: sip-bounces@ietf.org [mailto:sip-bounces@ietf.org]On Behalf Of >>Elwell, John >>Sent: Wednesday, April 06, 2005 5:20 AM >>To: Samuel Osorio Calvo; Miguel.An.Garcia@nokia.com; Elwell, John >>Cc: sip@ietf.org >>Subject: RE: [Sip] Question on SIPS and Contact URI >> >> >>Thanks Samuel and Miguel for your responses. >> >>Yes, it was the case where the UA does not support TLS that >>was the real >>driver for the question - non-support by a proxy was an >>afterthought and >>shouldn't (in theory) be a problem. >> >>So if I send an INVITE request (say) to a SIPS URI and place >>a SIPS URI in >>the Contact header field, if the last proxy forwards it on a >>non-TLS link to >>the UAS, then my real question is whether I can depend on >>that working, >>i.e., will the destination UA be able to send me subsequent >>requests in that >>dialog? >> >>Samuel suggests that the non-TLS UA would still use the SIPS URI for >>subsequent requests. My idea was that it might convert it to >>a SIP URI. I >>guess either should satisfy my concern that my UA will still >>be able to >>receive requests from the non-TLS UA. Any other opinions? >> >>John >> >> >> >>>-----Original Message----- >>>From: Samuel Osorio Calvo [mailto:samuel.osorio@nl.thalesgroup.com] >>>Sent: 06 April 2005 12:53 >>>To: Elwell@mgw-int1.ntc.nokia.com; >>>Miguel.An.Garcia@nokia.com; john.elwell@siemens.com >>>Cc: sip@ietf.org >>>Subject: Re: [Sip] Question on SIPS and Contact URI >>> >>>When the caller starts a dialog with a SIPS URI, it forces >>>that all proxies in the path use TLS and since TLS is a >>>mandatory feature for SIP proxies, the request MUST have >>>followed a TLS path. >>>However, RFC 3261 does not mandates anything about the last >>>hop (UA-->outbound proxy OR egress proxy-->remote UA). >>>Thus, the final proxy, applying local policies, might send >>>the SIPS request using another transport mechanism to the UA >>>because RFC 3261 does not mandates UAs to support TLS. >>> >>>Hence, as far as I know, the UA not supporting TLS will use >>>the standard SIP forwarding mechanisms (Via, Route, Contact, >>>...) and will probably insert sips: URI in the subsequent >>>replies and request. These messages will be taken by the >>>proxy, which will use TLS where applicable: >>>Something like: >>> >>>Dialog initiating request: >>>UA1---???--->outbound >>>proxy--TLS-->P1----TLS--->P2----TLS--->Egress proxy--????--->UA2 >>> >>>reply & within dialog messages: >>>UA2---???--->Egress proxy---TLS-->outbound proxy----???--->UA1 >>>(P1 and P2 have not inserted Record-Route headers). >>> >>>??? will be fixed by local policy and UA supported features, >>>it can be UDP, TCP, SCTP,......... >>> >>> >>>Hope it helps and please correct me if I am not right, >>> >>>Samuel Osorio. >>> >>> >>>Unclassified. >>> >>>>>>Miguel Garcia 04/06/05 12:23PM >>> >>> >>>The first proxy not supporting TLS? Hmmm... I thought that RFC 3261 >>>mandates proxies to support TLS (besides UDP and TCP), so the >>>case would >>>not exist. >>> >>>/Miguel >>> >>>Elwell, John wrote: >>> >>> >>>>I cannot find anything that specifies how a SIP UA should >>> >>>behave when it >>> >>>>receives a SIPS URI in a Contact header during a dialog >>> >>>(target refresh) or >>> >>>>during dialog establishment if the transport is not TLS. >>> >>>The implication is >>> >>>>that all future requests to that contact must be sent using >>> >>>TLS, even though >>> >>>>TLS has not been used up to now for this dialog. Is that >>> >>>correct? What would >>> >>>>a UA do that does not support TLS? What if the first >> >>proxy that has >> >>>>record-routed does not support TLS? One solution might be >>> >>>to convert the URI >>> >>>>to a SIP URI for sending future requests. >>>> >>>>John >>>> >>>> >>>>_______________________________________________ >>>>Sip mailing list https://www1.ietf.org/mailman/listinfo/sip >>>>This list is for NEW development of the core SIP Protocol >>>>Use sip-implementors@cs.columbia.edu for questions on current sip >>>>Use sipping@ietf.org for new developments on the >> >>application of sip >> >>>-- >>>Miguel A. Garcia tel:+358-50-4804586 >>>sip:miguel.an.garcia@openlaboratory.net >>>Nokia Research Center Helsinki, Finland >>> >>> >>>_______________________________________________ >>>Sip mailing list https://www1.ietf.org/mailman/listinfo/sip >>>This list is for NEW development of the core SIP Protocol >>>Use sip-implementors@cs.columbia.edu for questions on current sip >>>Use sipping@ietf.org for new developments on the application of sip >>> >>> >>>_______________________________________________ >>>Sip mailing list https://www1.ietf.org/mailman/listinfo/sip >>>This list is for NEW development of the core SIP Protocol >>>Use sip-implementors@cs.columbia.edu for questions on current sip >>>Use sipping@ietf.org for new developments on the application of sip >>> >> >>_______________________________________________ >>Sip mailing list https://www1.ietf.org/mailman/listinfo/sip >>This list is for NEW development of the core SIP Protocol >>Use sip-implementors@cs.columbia.edu for questions on current sip >>Use sipping@ietf.org for new developments on the application of sip > > -- Miguel A. Garcia tel:+358-50-4804586 sip:miguel.an.garcia@openlaboratory.net Nokia Research Center Helsinki, Finland _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Thu Apr 7 03:57:13 2005 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA24306 for ; Thu, 7 Apr 2005 03:57:13 -0400 (EDT) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJS1b-0007ML-Jb for sip-web-archive@ietf.org; Thu, 07 Apr 2005 04:06:04 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJRrW-0004BV-43; Thu, 07 Apr 2005 03:55:38 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJRrQ-0004BO-VI for sip@megatron.ietf.org; Thu, 07 Apr 2005 03:55:33 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA24201 for ; Thu, 7 Apr 2005 03:55:30 -0400 (EDT) Received: from david.siemens.de ([192.35.17.14]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJRzw-0007L1-H5 for sip@ietf.org; Thu, 07 Apr 2005 04:04:21 -0400 Received: from mail2.siemens.de (mail2.siemens.de [139.25.208.11]) by david.siemens.de (8.12.6/8.12.6) with ESMTP id j377tUOU004196; Thu, 7 Apr 2005 09:55:30 +0200 Received: from moody.mchh.siemens.de (moody.mchh.siemens.de [139.21.205.85]) by mail2.siemens.de (8.12.6/8.12.6) with ESMTP id j377tT7a003258; Thu, 7 Apr 2005 09:55:29 +0200 Received: from mchh253e.mchh.siemens.de (mchh253e.mchh.siemens.de [139.21.200.63]) by moody.mchh.siemens.de (8.12.6/8.12.6) with ESMTP id j377tQoJ004145; Thu, 7 Apr 2005 09:55:26 +0200 Received: by mchh253e.mchh.siemens.de with Internet Mail Service (5.5.2657.72) id ; Thu, 7 Apr 2005 09:52:09 +0200 Message-ID: <79D5F4B2D775204D9C7852EE41C5477305D0B45F@mchh2a1e.mchh.siemens.de> From: Milinski Alexander To: "'Miguel Garcia'" Subject: "next hope", was: RE: [Sip] Question on SIPS and Contact URI Date: Thu, 7 Apr 2005 09:55:06 +0200 Importance: low X-Priority: 5 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2657.72) Content-Type: text/plain X-Spam-Score: 0.0 (/) X-Scan-Signature: bacfc6c7290e34d410f9bc22b825ce96 Cc: sip@ietf.org X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: e367d58950869b6582535ddf5a673488 Hi Miguel, "next hope" is a nice typo in this context :-) Alex -----Original Message----- From: sip-bounces@ietf.org [mailto:sip-bounces@ietf.org] On Behalf Of Miguel Garcia Sent: Thursday, April 07, 2005 9:05 AM To: Peterson, Jon Cc: sip@ietf.org; Elwell John Subject: Re: [Sip] Question on SIPS and Contact URI I think it is widely agreed that SIPS is underspecified. Although this give us a hint for future work, probably we should provide guidelines for those facing problems in real deployments. I suspect Jon already mentioned those guidelines: a) if a proxy changes a transport protocol, it should double record route. In my opinion this does not apply to mandatory transport protocols in the UA, e.g, a proxy that changes from UDP to TCP, because both are implemented in User Agents. b) in case a UA receives a SIP request that creates a dialog, whose next hope (Contact or Record-Route) contains a non-supported transport protocol, the UA should reject the dialog. I would assume that a Warning header could provide further information about the failure. Is this reasonable for the time being? /Miguel "Peterson, Jon wrote: > Paul is certainly correct that SIPS is underspecified, and I think that with the advent of certain other tools for SIP (notably jennings-sipping-outbound) it will be possible for us to revisit SIPS and come up with a more coherent story. > > That much said, I think this issue of providing a Contact header in a dialog-forming request which uses a transport unsupported by the recipient is broader than SIPS. If the recipient only supports UDP, and receives a request with a Contact header containing a ;transport=TCP parameter, what is supposed to happen? This has been a much-discussed problem for some years. The conventional answer is that a proxy server that changes the transport (where this is understood to include converting from TLS to unsecured TCP, even) must Record-Route itself and remain in the path of future signaling within a dialog. This of course results in inefficiency when the recipient UA does in fact support the transport protocol given in the Contact, but the proxy has no way to anticipate this capability. > > The more transport protocols we specify for SIP (yes, I'm talking to you, SCTP), the more sorts of problems along these lines we will face. > > Jon Peterson > NeuStar, Inc. > > >>-----Original Message----- >>From: sip-bounces@ietf.org [mailto:sip-bounces@ietf.org]On Behalf Of >>Elwell, John >>Sent: Wednesday, April 06, 2005 5:20 AM >>To: Samuel Osorio Calvo; Miguel.An.Garcia@nokia.com; Elwell, John >>Cc: sip@ietf.org >>Subject: RE: [Sip] Question on SIPS and Contact URI >> >> >>Thanks Samuel and Miguel for your responses. >> >>Yes, it was the case where the UA does not support TLS that >>was the real >>driver for the question - non-support by a proxy was an >>afterthought and >>shouldn't (in theory) be a problem. >> >>So if I send an INVITE request (say) to a SIPS URI and place >>a SIPS URI in >>the Contact header field, if the last proxy forwards it on a >>non-TLS link to >>the UAS, then my real question is whether I can depend on >>that working, >>i.e., will the destination UA be able to send me subsequent >>requests in that >>dialog? >> >>Samuel suggests that the non-TLS UA would still use the SIPS URI for >>subsequent requests. My idea was that it might convert it to >>a SIP URI. I >>guess either should satisfy my concern that my UA will still >>be able to >>receive requests from the non-TLS UA. Any other opinions? >> >>John >> >> >> >>>-----Original Message----- >>>From: Samuel Osorio Calvo [mailto:samuel.osorio@nl.thalesgroup.com] >>>Sent: 06 April 2005 12:53 >>>To: Elwell@mgw-int1.ntc.nokia.com; >>>Miguel.An.Garcia@nokia.com; john.elwell@siemens.com >>>Cc: sip@ietf.org >>>Subject: Re: [Sip] Question on SIPS and Contact URI >>> >>>When the caller starts a dialog with a SIPS URI, it forces >>>that all proxies in the path use TLS and since TLS is a >>>mandatory feature for SIP proxies, the request MUST have >>>followed a TLS path. >>>However, RFC 3261 does not mandates anything about the last >>>hop (UA-->outbound proxy OR egress proxy-->remote UA). >>>Thus, the final proxy, applying local policies, might send >>>the SIPS request using another transport mechanism to the UA >>>because RFC 3261 does not mandates UAs to support TLS. >>> >>>Hence, as far as I know, the UA not supporting TLS will use >>>the standard SIP forwarding mechanisms (Via, Route, Contact, >>>...) and will probably insert sips: URI in the subsequent >>>replies and request. These messages will be taken by the >>>proxy, which will use TLS where applicable: >>>Something like: >>> >>>Dialog initiating request: >>>UA1---???--->outbound >>>proxy--TLS-->P1----TLS--->P2----TLS--->Egress proxy--????--->UA2 >>> >>>reply & within dialog messages: >>>UA2---???--->Egress proxy---TLS-->outbound proxy----???--->UA1 >>>(P1 and P2 have not inserted Record-Route headers). >>> >>>??? will be fixed by local policy and UA supported features, >>>it can be UDP, TCP, SCTP,......... >>> >>> >>>Hope it helps and please correct me if I am not right, >>> >>>Samuel Osorio. >>> >>> >>>Unclassified. >>> >>>>>>Miguel Garcia 04/06/05 12:23PM >>> >>> >>>The first proxy not supporting TLS? Hmmm... I thought that RFC 3261 >>>mandates proxies to support TLS (besides UDP and TCP), so the >>>case would >>>not exist. >>> >>>/Miguel >>> >>>Elwell, John wrote: >>> >>> >>>>I cannot find anything that specifies how a SIP UA should >>> >>>behave when it >>> >>>>receives a SIPS URI in a Contact header during a dialog >>> >>>(target refresh) or >>> >>>>during dialog establishment if the transport is not TLS. >>> >>>The implication is >>> >>>>that all future requests to that contact must be sent using >>> >>>TLS, even though >>> >>>>TLS has not been used up to now for this dialog. Is that >>> >>>correct? What would >>> >>>>a UA do that does not support TLS? What if the first >> >>proxy that has >> >>>>record-routed does not support TLS? One solution might be >>> >>>to convert the URI >>> >>>>to a SIP URI for sending future requests. >>>> >>>>John >>>> >>>> >>>>_______________________________________________ >>>>Sip mailing list https://www1.ietf.org/mailman/listinfo/sip >>>>This list is for NEW development of the core SIP Protocol >>>>Use sip-implementors@cs.columbia.edu for questions on current sip >>>>Use sipping@ietf.org for new developments on the >> >>application of sip >> >>>-- >>>Miguel A. Garcia tel:+358-50-4804586 >>>sip:miguel.an.garcia@openlaboratory.net >>>Nokia Research Center Helsinki, Finland >>> >>> >>>_______________________________________________ >>>Sip mailing list https://www1.ietf.org/mailman/listinfo/sip >>>This list is for NEW development of the core SIP Protocol >>>Use sip-implementors@cs.columbia.edu for questions on current sip >>>Use sipping@ietf.org for new developments on the application of sip >>> >>> >>>_______________________________________________ >>>Sip mailing list https://www1.ietf.org/mailman/listinfo/sip >>>This list is for NEW development of the core SIP Protocol >>>Use sip-implementors@cs.columbia.edu for questions on current sip >>>Use sipping@ietf.org for new developments on the application of sip >>> >> >>_______________________________________________ >>Sip mailing list https://www1.ietf.org/mailman/listinfo/sip >>This list is for NEW development of the core SIP Protocol >>Use sip-implementors@cs.columbia.edu for questions on current sip >>Use sipping@ietf.org for new developments on the application of sip > > -- Miguel A. Garcia tel:+358-50-4804586 sip:miguel.an.garcia@openlaboratory.net Nokia Research Center Helsinki, Finland _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Thu Apr 7 04:10:20 2005 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id EAA25455 for ; Thu, 7 Apr 2005 04:10:20 -0400 (EDT) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJSEI-0007tK-DP for sip-web-archive@ietf.org; Thu, 07 Apr 2005 04:19:10 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJS3z-0007lX-3H; Thu, 07 Apr 2005 04:08:31 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJS3p-0007ku-Bv for sip@megatron.ietf.org; Thu, 07 Apr 2005 04:08:21 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id EAA25304 for ; Thu, 7 Apr 2005 04:08:19 -0400 (EDT) Received: from mgw-x4.nokia.com ([131.228.20.27]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJSCJ-0007oO-Ql for sip@ietf.org; Thu, 07 Apr 2005 04:17:08 -0400 Received: from esdks003.ntc.nokia.com (esdks003.ntc.nokia.com [172.21.138.158]) by mgw-x4.nokia.com (Switch-2.2.8/Switch-2.2.8) with ESMTP id j3788AP12699; Thu, 7 Apr 2005 11:08:11 +0300 (EET DST) X-Scanned: Thu, 7 Apr 2005 11:06:57 +0300 Nokia Message Protector V1.3.34 2004121512 - RELEASE Received: (from root@localhost) by esdks003.ntc.nokia.com (8.12.9/8.12.9) id j3786vXF031921; Thu, 7 Apr 2005 11:06:57 +0300 Received: from mgw-int1.ntc.nokia.com (172.21.143.96) by esdks003.ntc.nokia.com 00oBdt3i; Thu, 07 Apr 2005 11:06:16 EEST Received: from esebh003.NOE.Nokia.com (esebh003.ntc.nokia.com [172.21.138.82]) by mgw-int1.ntc.nokia.com (Switch-2.2.8/Switch-2.2.8) with ESMTP id j3786FM03020; Thu, 7 Apr 2005 11:06:15 +0300 (EET DST) Received: from [127.0.0.1] ([10.162.17.135]) by esebh003.NOE.Nokia.com with Microsoft SMTPSVC(5.0.2195.6881); Thu, 7 Apr 2005 11:05:58 +0300 Message-ID: <4254E9E6.3030205@nokia.com> Date: Thu, 07 Apr 2005 11:05:58 +0300 From: Miguel Garcia User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7.2) Gecko/20040804 Netscape/7.2 (ax) X-Accept-Language: en-us, en, es-es MIME-Version: 1.0 To: Milinski Alexander Subject: Re: "next hope", was: RE: [Sip] Question on SIPS and Contact URI References: <79D5F4B2D775204D9C7852EE41C5477305D0B45F@mchh2a1e.mchh.siemens.de> In-Reply-To: <79D5F4B2D775204D9C7852EE41C5477305D0B45F@mchh2a1e.mchh.siemens.de> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-OriginalArrivalTime: 07 Apr 2005 08:05:58.0907 (UTC) FILETIME=[A1DA9CB0:01C53B48] X-Spam-Score: 0.0 (/) X-Scan-Signature: 8a85b14f27c9dcbe0719e27d46abc1f8 Content-Transfer-Encoding: 7bit Cc: sip@ietf.org X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: ed68cc91cc637fea89623888898579ba Content-Transfer-Encoding: 7bit It was on purpose ;-) /Miguel Milinski Alexander wrote: > Hi Miguel, > "next hope" is a nice typo in this context :-) > Alex > > -----Original Message----- > From: sip-bounces@ietf.org [mailto:sip-bounces@ietf.org] On Behalf Of Miguel Garcia > Sent: Thursday, April 07, 2005 9:05 AM > To: Peterson, Jon > Cc: sip@ietf.org; Elwell John > Subject: Re: [Sip] Question on SIPS and Contact URI > > > I think it is widely agreed that SIPS is underspecified. Although this > give us a hint for future work, probably we should provide guidelines > for those facing problems in real deployments. I suspect Jon already > mentioned those guidelines: > > a) if a proxy changes a transport protocol, it should double record > route. In my opinion this does not apply to mandatory transport > protocols in the UA, e.g, a proxy that changes from UDP to TCP, because > both are implemented in User Agents. > > b) in case a UA receives a SIP request that creates a dialog, whose next > hope (Contact or Record-Route) contains a non-supported transport > protocol, the UA should reject the dialog. I would assume that a Warning > header could provide further information about the failure. > > Is this reasonable for the time being? > > /Miguel > > "Peterson, Jon wrote: > > >>Paul is certainly correct that SIPS is underspecified, and I think that with the advent of certain other tools for SIP (notably jennings-sipping-outbound) it will be possible for us to revisit SIPS and come up with a more coherent story. >> >>That much said, I think this issue of providing a Contact header in a dialog-forming request which uses a transport unsupported by the recipient is broader than SIPS. If the recipient only supports UDP, and receives a request with a Contact header containing a ;transport=TCP parameter, what is supposed to happen? This has been a much-discussed problem for some years. The conventional answer is that a proxy server that changes the transport (where this is understood to include converting from TLS to unsecured TCP, even) must Record-Route itself and remain in the path of future signaling within a dialog. This of course results in inefficiency when the recipient UA does in fact support the transport protocol given in the Contact, but the proxy has no way to anticipate this capability. >> >>The more transport protocols we specify for SIP (yes, I'm talking to you, SCTP), the more sorts of problems along these lines we will face. >> >>Jon Peterson >>NeuStar, Inc. >> >> >> >>>-----Original Message----- >>>From: sip-bounces@ietf.org [mailto:sip-bounces@ietf.org]On Behalf Of >>>Elwell, John >>>Sent: Wednesday, April 06, 2005 5:20 AM >>>To: Samuel Osorio Calvo; Miguel.An.Garcia@nokia.com; Elwell, John >>>Cc: sip@ietf.org >>>Subject: RE: [Sip] Question on SIPS and Contact URI >>> >>> >>>Thanks Samuel and Miguel for your responses. >>> >>>Yes, it was the case where the UA does not support TLS that >>>was the real >>>driver for the question - non-support by a proxy was an >>>afterthought and >>>shouldn't (in theory) be a problem. >>> >>>So if I send an INVITE request (say) to a SIPS URI and place >>>a SIPS URI in >>>the Contact header field, if the last proxy forwards it on a >>>non-TLS link to >>>the UAS, then my real question is whether I can depend on >>>that working, >>>i.e., will the destination UA be able to send me subsequent >>>requests in that >>>dialog? >>> >>>Samuel suggests that the non-TLS UA would still use the SIPS URI for >>>subsequent requests. My idea was that it might convert it to >>>a SIP URI. I >>>guess either should satisfy my concern that my UA will still >>>be able to >>>receive requests from the non-TLS UA. Any other opinions? >>> >>>John >>> >>> >>> >>> >>>>-----Original Message----- >>>>From: Samuel Osorio Calvo [mailto:samuel.osorio@nl.thalesgroup.com] >>>>Sent: 06 April 2005 12:53 >>>>To: Elwell@mgw-int1.ntc.nokia.com; >>>>Miguel.An.Garcia@nokia.com; john.elwell@siemens.com >>>>Cc: sip@ietf.org >>>>Subject: Re: [Sip] Question on SIPS and Contact URI >>>> >>>>When the caller starts a dialog with a SIPS URI, it forces >>>>that all proxies in the path use TLS and since TLS is a >>>>mandatory feature for SIP proxies, the request MUST have >>>>followed a TLS path. >>>>However, RFC 3261 does not mandates anything about the last >>>>hop (UA-->outbound proxy OR egress proxy-->remote UA). >>>>Thus, the final proxy, applying local policies, might send >>>>the SIPS request using another transport mechanism to the UA >>>>because RFC 3261 does not mandates UAs to support TLS. >>>> >>>>Hence, as far as I know, the UA not supporting TLS will use >>>>the standard SIP forwarding mechanisms (Via, Route, Contact, >>>>...) and will probably insert sips: URI in the subsequent >>>>replies and request. These messages will be taken by the >>>>proxy, which will use TLS where applicable: >>>>Something like: >>>> >>>>Dialog initiating request: >>>>UA1---???--->outbound >>>>proxy--TLS-->P1----TLS--->P2----TLS--->Egress proxy--????--->UA2 >>>> >>>>reply & within dialog messages: >>>>UA2---???--->Egress proxy---TLS-->outbound proxy----???--->UA1 >>>>(P1 and P2 have not inserted Record-Route headers). >>>> >>>>??? will be fixed by local policy and UA supported features, >>>>it can be UDP, TCP, SCTP,......... >>>> >>>> >>>>Hope it helps and please correct me if I am not right, >>>> >>>>Samuel Osorio. >>>> >>>> >>>>Unclassified. >>>> >>>> >>>>>>>Miguel Garcia 04/06/05 12:23PM >>> >>>> >>>>The first proxy not supporting TLS? Hmmm... I thought that RFC 3261 >>>>mandates proxies to support TLS (besides UDP and TCP), so the >>>>case would >>>>not exist. >>>> >>>>/Miguel >>>> >>>>Elwell, John wrote: >>>> >>>> >>>> >>>>>I cannot find anything that specifies how a SIP UA should >>>> >>>>behave when it >>>> >>>> >>>>>receives a SIPS URI in a Contact header during a dialog >>>> >>>>(target refresh) or >>>> >>>> >>>>>during dialog establishment if the transport is not TLS. >>>> >>>>The implication is >>>> >>>> >>>>>that all future requests to that contact must be sent using >>>> >>>>TLS, even though >>>> >>>> >>>>>TLS has not been used up to now for this dialog. Is that >>>> >>>>correct? What would >>>> >>>> >>>>>a UA do that does not support TLS? What if the first >>> >>>proxy that has >>> >>> >>>>>record-routed does not support TLS? One solution might be >>>> >>>>to convert the URI >>>> >>>> >>>>>to a SIP URI for sending future requests. >>>>> >>>>>John >>>>> >>>>> >>>>>_______________________________________________ >>>>>Sip mailing list https://www1.ietf.org/mailman/listinfo/sip >>>>>This list is for NEW development of the core SIP Protocol >>>>>Use sip-implementors@cs.columbia.edu for questions on current sip >>>>>Use sipping@ietf.org for new developments on the >>> >>>application of sip >>> >>> >>>>-- >>>>Miguel A. Garcia tel:+358-50-4804586 >>>>sip:miguel.an.garcia@openlaboratory.net >>>>Nokia Research Center Helsinki, Finland >>>> >>>> >>>>_______________________________________________ >>>>Sip mailing list https://www1.ietf.org/mailman/listinfo/sip >>>>This list is for NEW development of the core SIP Protocol >>>>Use sip-implementors@cs.columbia.edu for questions on current sip >>>>Use sipping@ietf.org for new developments on the application of sip >>>> >>>> >>>>_______________________________________________ >>>>Sip mailing list https://www1.ietf.org/mailman/listinfo/sip >>>>This list is for NEW development of the core SIP Protocol >>>>Use sip-implementors@cs.columbia.edu for questions on current sip >>>>Use sipping@ietf.org for new developments on the application of sip >>>> >>> >>>_______________________________________________ >>>Sip mailing list https://www1.ietf.org/mailman/listinfo/sip >>>This list is for NEW development of the core SIP Protocol >>>Use sip-implementors@cs.columbia.edu for questions on current sip >>>Use sipping@ietf.org for new developments on the application of sip >> >> > -- Miguel A. Garcia tel:+358-50-4804586 sip:miguel.an.garcia@openlaboratory.net Nokia Research Center Helsinki, Finland _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Thu Apr 7 06:06:49 2005 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id GAA03944 for ; Thu, 7 Apr 2005 06:06:49 -0400 (EDT) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJU33-0003Ia-8l for sip-web-archive@ietf.org; Thu, 07 Apr 2005 06:15:41 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJTle-0005ti-Dv; Thu, 07 Apr 2005 05:57:42 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJTlb-0005ta-PS for sip@megatron.ietf.org; Thu, 07 Apr 2005 05:57:40 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id FAA03529 for ; Thu, 7 Apr 2005 05:57:36 -0400 (EDT) Received: from rproxy.gmail.com ([64.233.170.194]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJTu7-00032u-V0 for sip@ietf.org; Thu, 07 Apr 2005 06:06:29 -0400 Received: by rproxy.gmail.com with SMTP id j1so384687rnf for ; Thu, 07 Apr 2005 02:57:37 -0700 (PDT) DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com; h=received:message-id:date:from:reply-to:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:references; b=D47fx2SeZ0jVe7brPik271jE4Ia3Lz10rvwjnbu4SKUT+XSdrM3YfyMbfUVByXfv6ILR38Djuqy5YjRBbnF3ZL7pv94IhL/uxj185R9xLtuZAt0Wl9SQ6s/PLh22WcbvwxislnFToZ8BKWB4cmu54XObSZcBgN4UMKNtEMWPcDM= Received: by 10.39.3.48 with SMTP id f48mr590343rni; Thu, 07 Apr 2005 02:57:37 -0700 (PDT) Received: by 10.38.11.14 with HTTP; Thu, 7 Apr 2005 02:57:37 -0700 (PDT) Message-ID: <3fe6b864050407025746733f94@mail.gmail.com> Date: Thu, 7 Apr 2005 15:27:37 +0530 From: Malleswara Rao Ankem To: Chadha Retesh-A19894 Subject: Re: [Sip] crossover of 200 ok and PRACK In-Reply-To: <772BCEF88A1DD91191F80011856715F302585F7F@zin24exm01.ap.mot.com> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit References: <772BCEF88A1DD91191F80011856715F302585F7F@zin24exm01.ap.mot.com> X-Spam-Score: 0.0 (/) X-Scan-Signature: 7baded97d9887f7a0c7e8a33c2e3ea1b Content-Transfer-Encoding: 7bit Cc: sip@ietf.org, sip-implementors@cs.columbia.edu X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: Malleswara Rao Ankem List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 4adaf050708fb13be3316a9eee889caa Content-Transfer-Encoding: 7bit Plz go thru this Sec.3 of 3262 " If the UAS does send a final response when reliable responses are still unacknowledged, it SHOULD NOT continue to retransmit the unacknowledged reliable provisional responses, but it MUST be prepared to process PRACK requests for those outstanding responses. A UAS MUST NOT send new reliable provisional responses (as opposed to retransmissions of unacknowledged ones) after sending a final response to a request." >From above it is quite clear that the UAS MUST be prepared to handle the PRACK which (ofcourse implicitly) means to respond with a 200Ok. regds Mallesh On Apr 7, 2005 11:58 AM, Chadha Retesh-A19894 wrote: > Hi > I think the following scenario is not discussed in the RFC 3262. > What wil be the response to PRACK -- 481 or 200 ok??? > > INVITE (with 100 rel) ----> > <----- 180 ringing (Rseq 1, without sdp) > <----- 200 ok (INVITE), as > user accepted the call, and since 180 didn't have sdp, 200 need not be > delayed. > PRACK (siince it first got 180) ----> > ACK ----> > > This response will matter for interoperability with another Sip client. > > Thanks & rgds, > Retesh > _______________________________________________ > Sip mailing list > https://www1.ietf.org/mailman/listinfo/sip > This list is for NEW development of the core SIP Protocol > Use sip-implementors@cs.columbia.edu for questions on > current sip > Use sipping@ietf.org for new developments on the application of sip > > _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Thu Apr 7 09:16:18 2005 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA20395 for ; Thu, 7 Apr 2005 09:16:18 -0400 (EDT) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJX0R-0001nK-El for sip-web-archive@ietf.org; Thu, 07 Apr 2005 09:25:11 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJWlr-0004GV-4D; Thu, 07 Apr 2005 09:10:07 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJWlo-0004G9-G4 for sip@megatron.ietf.org; Thu, 07 Apr 2005 09:10:04 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA19618 for ; Thu, 7 Apr 2005 09:10:02 -0400 (EDT) Received: from sj-iport-4.cisco.com ([171.68.10.86]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJWuM-0001Ty-EQ for sip@ietf.org; Thu, 07 Apr 2005 09:18:55 -0400 Received: from sj-core-3.cisco.com (171.68.223.137) by sj-iport-4.cisco.com with ESMTP; 07 Apr 2005 06:09:54 -0700 Received: from flask.cisco.com (IDENT:mirapoint@flask.cisco.com [161.44.122.62]) by sj-core-3.cisco.com (8.12.10/8.12.6) with ESMTP id j37D9ngS010930; Thu, 7 Apr 2005 06:09:49 -0700 (PDT) Received: from cisco.com ([161.44.79.173]) by flask.cisco.com (MOS 3.4.6-GR) with ESMTP id AQK94360; Thu, 7 Apr 2005 09:09:48 -0400 (EDT) Message-ID: <4255311C.3050409@cisco.com> Date: Thu, 07 Apr 2005 09:09:48 -0400 From: Paul Kyzivat User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.1) Gecko/20020826 X-Accept-Language: en-us, en MIME-Version: 1.0 To: "Peterson, Jon" Subject: Re: [Sip] sip-identity-05: display-name woes References: <24EAE5D4448B9D4592C6D234CBEBD59701502E15@stntexch03.cis.neustar.com> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Score: 0.0 (/) X-Scan-Signature: 36b1f8810cb91289d885dc8ab4fc8172 Content-Transfer-Encoding: 7bit Cc: sip@ietf.org X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 42e3ed3f10a1d8bef690f09da16f507a Content-Transfer-Encoding: 7bit Peterson, Jon wrote: >>The simple answer (but perhaps not a popular one) would be to mandate >>that the authentication service *must* have a policy wrt display names. >>(A degenerate policy would be that display names simply aren't permitted.) > > > I would feel more comfortable about that if anyone had any idea how a domain might go about enforcing such policies and distributing legitimate display-names to users. Currently, we're taking it on faith that some domains will want to adopt such policies, and will figure out appropriate operational ways to execute them. Not a small thing to take on faith given the precedents in the email space, not to mention the fact that the domains themselves seem to gain little by enforcing these policies. We shouldn't try to boil the ocean, but I think we should be looking to put a framework in place that will let the players do the right thing. I have the impression there is some appreciation that callerid (both number and name) should be somewhat trustworthy. That notion just has to be embraced for SIP. If callee devices don't trust, and hence don't display, untrusted display names, that might eventually provide a competitive advantage to those that provide trusted names. ("Alice, when you call me your name is never displayed. Why don't you switch to a service that provides the name?") Or it may be that once there are some highly publicized abuses, there will be legal action to require reliable callerid from IP phones. >>I suppose it is then necessary to be a little more demanding about what >>sort of policy is acceptable. (A policy of "you can use any display name >>you want" is probably not an acceptable policy.) > > > Well, it's about as acceptable as the policy "you can use any username in the addr-spec portion of the From header field that you want", but that is effectively the state-of-the-art for SIP and email today. I doubt that sip-identity can have any appreciable effect on what policies domains want to use for this stuff. What is can do is specify a way, through mechanism, for a domain to communicate "my policies, however strict or lax, were followed with regards to this From header field". > > >>Alternatively, perhaps there should be a standard way for discovering >>the (human and/or machine readable) authentication policy of a >>particular authentication service. It doesn't have to be part of the >>request, just derivable from the authentication service credentials. > > > In the end analysis, I can't think of any way that the authorization decision made by a recipient would change if it had this information. After all, a bad domain could lie about its policies, deluded domains will tell you they have a good policy even though it is routinely circumvented by clever users, and good domains will be good regardless of whether or not they tell you your policies. As a verifier, I might be willing to take the word of a third-party auditor, but I don't think we can incorporate that into our protocol specification. I think I take advantage of such info by configuring my system about what domains to accept names from. In principle, I would think it might eventually be possible to arrange things so that the signer of the authorization service's cert vouched for the policy of the authentication service. Then it would be easier to configure who you trust. (But in practice this sounds hard.) Regarding lying about policy - at least being on the record provides the basis for legal action against those that lie. Paul > Jon Peterson > NeuStar, Inc. > > >> Paul >> >>Peterson, Jon wrote: >> >>>The problem with that, I think, is that it does not provide >> >>for the case where the display-name is present, but the >>authentication service has no policy with regard to >>display-names. What does the authentication service do then, >>and how is that behavior disambiguated from the other cases >>at the verifier? >> >>>I agree that if the display-name is present and >> >>unauthorized, then the authentication service shouldn't sign >>the message. In fact, you don't even have to include the >>display-name in the identity-string in order to structure the >>mechanism like that. The mechanism in sip-identity-04 >>essentially reads: >> >>>(G) If the domain has policies about display-names, and the >> >>display-name is present and unauthorized, decline to sign the >>message, sending back a 4xx suggesting that the display-name >>needs to be correct. Otherwise, sign the message (NOT >>including the display-name) and forward it. >> >>>Ultimately, a signature over the display-name itself is not >> >>necessary unless you are concerned that the message is going >>to be modified in transit (which is outside the threat model >>of sip-identity, since sip-identity is only concerned with >>impersonation). Replaying the message with a differnt >>display-name isn't really an option because the replay would >>be exposed by the other reference indicators present in the >>request. So at a high level, the fact that a message is >>signed at all (with or without a display-name) could >>plausibly signify that either the domain liked the >>display-name or that it doesn't care about display-names, but >>it could never plausibly signify that the domain had policies >>about display-names and that it didn't like the display name, >>regardless of whether or not the display-name itself is >>included in the identity-string. >> >>>The issue with (G), of course, is that it does not >> >>disambiguate the case where the domain has policies about >>domain names and authorized this message from the case where >>the domain doesn't have policies. >> >>>Jon Peterson >>>NeuStar, Inc. >>> >>> >>> >>>>-----Original Message----- >>>>From: Paul Kyzivat [mailto:pkyzivat@cisco.com] >>>>Sent: Wednesday, April 06, 2005 2:31 PM >>>>To: Peterson, Jon >>>>Cc: sip@ietf.org >>>>Subject: Re: [Sip] sip-identity-05: display-name woes >>>> >>> >>>[snip] >>> >>> >>>>I don't much like any of those alternatives. >>>> >>>> >>>> >>>>>Any better ideas, or barring that, any preferences among the above? >>>> >>>>(F) If the display name is present but unauthorized, >>> >>decline to sign the >> >>>>message. If the display-name is present and authorized, include it. >>>> >>> >>> > _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Thu Apr 7 09:44:48 2005 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA23313 for ; Thu, 7 Apr 2005 09:44:48 -0400 (EDT) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJXS1-0002xD-QU for sip-web-archive@ietf.org; Thu, 07 Apr 2005 09:53:42 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJXBB-0006Dk-MX; Thu, 07 Apr 2005 09:36:17 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJXB9-0006Df-VL for sip@megatron.ietf.org; Thu, 07 Apr 2005 09:36:16 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA22655 for ; Thu, 7 Apr 2005 09:36:13 -0400 (EDT) Message-Id: <200504071336.JAA22655@ietf.org> Received: from dx28.winwebhosting.com ([70.85.77.84]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJXJi-0002eC-B2 for sip@ietf.org; Thu, 07 Apr 2005 09:45:06 -0400 Received: from acs-24-154-127-163.zoominternet.net ([24.154.127.163] helo=ROSENHOME2) by dx28.winwebhosting.com with esmtpa (Exim 4.44) id 1DJXAt-0001YI-Pa; Thu, 07 Apr 2005 08:36:00 -0500 From: "Brian Rosen" To: "'Paul Kyzivat'" , "'Peterson, Jon'" Subject: RE: [Sip] sip-identity-05: display-name woes Date: Thu, 7 Apr 2005 09:35:55 -0400 MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Office Outlook, Build 11.0.6353 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180 Thread-Index: AcU7c/9GG0eWG2ekQ3eisZWhl6sSngAASxCg In-Reply-To: <4255311C.3050409@cisco.com> X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - dx28.winwebhosting.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - brianrosen.net X-Spam-Score: 0.0 (/) X-Scan-Signature: 612a16ba5c5f570bfc42b3ac5606ac53 Content-Transfer-Encoding: 7bit Cc: sip@ietf.org X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org X-Spam-Score: 0.8 (/) X-Scan-Signature: d008c19e97860b8641c1851f84665a75 Content-Transfer-Encoding: 7bit Maybe we want to step back and ask: What is the purpose of a display name? And What is the purpose of the Identity work? We might find that there is no point in trying to assert anything about display name ever. A display name is something used to LABEL a caller. It's displayed to the user. Identity is used to Identify a caller, primarily to provide a reasonably reliable indication of who called, and how to call them back. If you go to a telephone company and get a phone line, and you tell them that your name is George Bush, they might kid you, but they aren't going to give you the third degree because there really are a few other George Bush's out there. It's more work than doing something with the display name on your SIP phone, maybe, but it's not something that is assertable. The phone company REPORTS the name on appropriate caller ID, but does not assert it means anything. The phone number, on the other hand, is an identifier, and it does mean something. Perhaps we simply do not ever include display name in the Identity signature. I think our email experience suggests that there is not a lot of harm when you get a forged email display name. We have harm with a forged email address. There is probably more concern over indecent names than forged names, but as always YMMV. Brian -----Original Message----- From: sip-bounces@ietf.org [mailto:sip-bounces@ietf.org] On Behalf Of Paul Kyzivat Sent: Thursday, April 07, 2005 8:10 AM To: Peterson, Jon Cc: sip@ietf.org Subject: Re: [Sip] sip-identity-05: display-name woes Peterson, Jon wrote: >>The simple answer (but perhaps not a popular one) would be to mandate >>that the authentication service *must* have a policy wrt display names. >>(A degenerate policy would be that display names simply aren't permitted.) > > > I would feel more comfortable about that if anyone had any idea how a domain might go about enforcing such policies and distributing legitimate display-names to users. Currently, we're taking it on faith that some domains will want to adopt such policies, and will figure out appropriate operational ways to execute them. Not a small thing to take on faith given the precedents in the email space, not to mention the fact that the domains themselves seem to gain little by enforcing these policies. We shouldn't try to boil the ocean, but I think we should be looking to put a framework in place that will let the players do the right thing. I have the impression there is some appreciation that callerid (both number and name) should be somewhat trustworthy. That notion just has to be embraced for SIP. If callee devices don't trust, and hence don't display, untrusted display names, that might eventually provide a competitive advantage to those that provide trusted names. ("Alice, when you call me your name is never displayed. Why don't you switch to a service that provides the name?") Or it may be that once there are some highly publicized abuses, there will be legal action to require reliable callerid from IP phones. >>I suppose it is then necessary to be a little more demanding about what >>sort of policy is acceptable. (A policy of "you can use any display name >>you want" is probably not an acceptable policy.) > > > Well, it's about as acceptable as the policy "you can use any username in the addr-spec portion of the From header field that you want", but that is effectively the state-of-the-art for SIP and email today. I doubt that sip-identity can have any appreciable effect on what policies domains want to use for this stuff. What is can do is specify a way, through mechanism, for a domain to communicate "my policies, however strict or lax, were followed with regards to this From header field". > > >>Alternatively, perhaps there should be a standard way for discovering >>the (human and/or machine readable) authentication policy of a >>particular authentication service. It doesn't have to be part of the >>request, just derivable from the authentication service credentials. > > > In the end analysis, I can't think of any way that the authorization decision made by a recipient would change if it had this information. After all, a bad domain could lie about its policies, deluded domains will tell you they have a good policy even though it is routinely circumvented by clever users, and good domains will be good regardless of whether or not they tell you your policies. As a verifier, I might be willing to take the word of a third-party auditor, but I don't think we can incorporate that into our protocol specification. I think I take advantage of such info by configuring my system about what domains to accept names from. In principle, I would think it might eventually be possible to arrange things so that the signer of the authorization service's cert vouched for the policy of the authentication service. Then it would be easier to configure who you trust. (But in practice this sounds hard.) Regarding lying about policy - at least being on the record provides the basis for legal action against those that lie. Paul > Jon Peterson > NeuStar, Inc. > > >> Paul >> >>Peterson, Jon wrote: >> >>>The problem with that, I think, is that it does not provide >> >>for the case where the display-name is present, but the >>authentication service has no policy with regard to >>display-names. What does the authentication service do then, >>and how is that behavior disambiguated from the other cases >>at the verifier? >> >>>I agree that if the display-name is present and >> >>unauthorized, then the authentication service shouldn't sign >>the message. In fact, you don't even have to include the >>display-name in the identity-string in order to structure the >>mechanism like that. The mechanism in sip-identity-04 >>essentially reads: >> >>>(G) If the domain has policies about display-names, and the >> >>display-name is present and unauthorized, decline to sign the >>message, sending back a 4xx suggesting that the display-name >>needs to be correct. Otherwise, sign the message (NOT >>including the display-name) and forward it. >> >>>Ultimately, a signature over the display-name itself is not >> >>necessary unless you are concerned that the message is going >>to be modified in transit (which is outside the threat model >>of sip-identity, since sip-identity is only concerned with >>impersonation). Replaying the message with a differnt >>display-name isn't really an option because the replay would >>be exposed by the other reference indicators present in the >>request. So at a high level, the fact that a message is >>signed at all (with or without a display-name) could >>plausibly signify that either the domain liked the >>display-name or that it doesn't care about display-names, but >>it could never plausibly signify that the domain had policies >>about display-names and that it didn't like the display name, >>regardless of whether or not the display-name itself is >>included in the identity-string. >> >>>The issue with (G), of course, is that it does not >> >>disambiguate the case where the domain has policies about >>domain names and authorized this message from the case where >>the domain doesn't have policies. >> >>>Jon Peterson >>>NeuStar, Inc. >>> >>> >>> >>>>-----Original Message----- >>>>From: Paul Kyzivat [mailto:pkyzivat@cisco.com] >>>>Sent: Wednesday, April 06, 2005 2:31 PM >>>>To: Peterson, Jon >>>>Cc: sip@ietf.org >>>>Subject: Re: [Sip] sip-identity-05: display-name woes >>>> >>> >>>[snip] >>> >>> >>>>I don't much like any of those alternatives. >>>> >>>> >>>> >>>>>Any better ideas, or barring that, any preferences among the above? >>>> >>>>(F) If the display name is present but unauthorized, >>> >>decline to sign the >> >>>>message. If the display-name is present and authorized, include it. >>>> >>> >>> > _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Thu Apr 7 10:42:11 2005 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA29484 for ; Thu, 7 Apr 2005 10:42:11 -0400 (EDT) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJYLZ-0005AB-9j for sip-web-archive@ietf.org; Thu, 07 Apr 2005 10:51:05 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJYAB-0005T1-Rn; Thu, 07 Apr 2005 10:39:19 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJYA9-0005St-Id for sip@megatron.ietf.org; Thu, 07 Apr 2005 10:39:17 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA29153 for ; Thu, 7 Apr 2005 10:39:15 -0400 (EDT) Received: from sj-iport-3-in.cisco.com ([171.71.176.72] helo=sj-iport-3.cisco.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJYIg-00053T-Ug for sip@ietf.org; Thu, 07 Apr 2005 10:48:09 -0400 Received: from sj-core-1.cisco.com (171.71.177.237) by sj-iport-3.cisco.com with ESMTP; 07 Apr 2005 07:39:05 -0700 X-IronPort-AV: i="3.92,84,1112598000"; d="asc'?scan'208"; a="246978732:sNHT46796636" Received: from imail.cisco.com (imail.cisco.com [128.107.200.91]) by sj-core-1.cisco.com (8.12.10/8.12.6) with ESMTP id j37Ed2Dr020811; Thu, 7 Apr 2005 07:39:03 -0700 (PDT) Received: from thomasm-lnx.cisco.com (thomasm-lnx.cisco.com [171.71.96.50]) by imail.cisco.com (8.12.11/8.12.10) with ESMTP id j37EUqrk021260; Thu, 7 Apr 2005 07:30:52 -0700 Subject: RE: [Sip] sip-identity-05: display-name woes From: Michael Thomas To: Brian Rosen In-Reply-To: <200504071336.JAA22655@ietf.org> References: <200504071336.JAA22655@ietf.org> Organization: Cisco Systems Message-Id: <1112884741.6101.12.camel@thomasm-lnx.cisco.com> Mime-Version: 1.0 X-Mailer: Ximian Evolution 1.4.6 Date: Thu, 07 Apr 2005 07:39:02 -0700 IIM-SIG: v:"1.1"; h:"imail.cisco.com"; d:"cisco.com"; z:"home"; m:"krs"; t:"1112884252.199935"; x:"432200"; a:"rsa-sha1"; b:"nofws:1570"; e:"Iw=="; n:"sQYarK2E51MdcTiUqeif3F7cWdxIfoCiXhdfb9vD5ee/j0jXL15gbFxF2p" "XIweAblu0N6XAgK7k+wrbr7bQDJaCDqOmzqpRUBjIRQAXQ7NzadpmR3pUL6wxaRUtW+c43sl9jC" "50Qg1sXHpPjt8Y+Y16ioyQAQAdSunM4YhevURc="; s:"j3IdtIqB6Auq7pMZpPyToL5/oAghabL4a3lYt5MgAIgAPVURZTsVAhjOUwEg3JfvH8c6dofT" "dyGuya3hDpcOYYSQCaORMLRUyZd6AEWCAFczs9TiCPz8c78BBFdDAhGOx1p7WQyyJC4PmFU5gAi" "mD8Y8WUM8avTLWX2P73RVutQ="; c:"Subject: RE: [Sip] sip-identity-05: display-name woes"; c:"From: Michael Thomas "; c:"Date: Thu, 07 Apr 2005 07:39:02 -0700" IIM-VERIFY: s:"y"; v:"y"; r:"60"; h:"imail.cisco.com"; c:"message from imail.cisco.com verified; " X-Spam-Score: 0.0 (/) X-Scan-Signature: 4d87d2aa806f79fed918a62e834505ca Cc: sip@ietf.org, "'Paul Kyzivat'" , "'Peterson, Jon'" X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============1411958919==" Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: fb6060cb60c0cea16e3f7219e40a0a81 --===============1411958919== Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="=-ncdh/hbr4COAcaqQ5Vpi" --=-ncdh/hbr4COAcaqQ5Vpi Content-Type: text/plain Content-Transfer-Encoding: quoted-printable On Thu, 2005-04-07 at 06:35, Brian Rosen wrote: > Perhaps we simply do not ever include display name in the Identity > I think our email experience suggests that there is not a lot of harm whe= n > you get a forged email display name. We have harm with a forged email > address. There is probably more concern over indecent names than forged > names, but as always YMMV.=20 Oh really? I'm pretty sure that Wamu, eBay, and the rest of the phished set would disagree with that. In any case, something that doesn't account for human factors is likely to be more harmful than nothing at all. If I've been told that the sip call has been=20 "authenticated", I'm not going to remember that that doesn't have anything to do whatsoever with the name that's been put in front of me. That's a problem. A big one. Domain level identities aren't perfect, but they=20 don't have to be to still be useful. If I get a call from gwb@whitehouse.gov and it turns out not to be gwb on the line, I can call whitehouse.gov and tell them they have a problem. Without some cryptographic identity to gate who uses the=20 whitehouse.gov domain, that phone call will -- and currently is with email -- useless. But with it, they can at least in theory check their logs, blah, blah, blah, before they cover it up.=20 Mike --=-ncdh/hbr4COAcaqQ5Vpi Content-Type: application/pgp-signature; name=signature.asc Content-Description: This is a digitally signed message part -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.3 (GNU/Linux) iQCVAwUAQlVGBbMsDAj/Eq++AQJgxgP+NmIAbmqScdr6yVshLbV+AhGd1kO9gWpH d0z3kt3UhnFvBRoZtP8PJflcJm1zTJhKdkR8XrhvKFJ4EUar847wnuqfyHDsqGas H6EPwprjwxeqNvQsDAuC5Btp+1A4FajA8B00gNfJ+kjVo/SNU7gcj+i8s9gCT9eN J8pNoAU+p6k= =Su3C -----END PGP SIGNATURE----- --=-ncdh/hbr4COAcaqQ5Vpi-- --===============1411958919== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline Content-Transfer-Encoding: 7bit _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip --===============1411958919==-- From sip-bounces@ietf.org Thu Apr 7 10:45:00 2005 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA29740 for ; Thu, 7 Apr 2005 10:45:00 -0400 (EDT) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJYOI-0005Gz-BQ for sip-web-archive@ietf.org; Thu, 07 Apr 2005 10:53:54 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJY4m-00053U-IT; Thu, 07 Apr 2005 10:33:44 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJY4c-0004tU-VL for sip@megatron.ietf.org; Thu, 07 Apr 2005 10:33:35 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA28387 for ; Thu, 7 Apr 2005 10:33:32 -0400 (EDT) Received: from rtp-iport-1.cisco.com ([64.102.122.148]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJYCm-0004lZ-Lm for sip@ietf.org; Thu, 07 Apr 2005 10:42:01 -0400 Received: from rtp-core-1.cisco.com (64.102.124.12) by rtp-iport-1.cisco.com with ESMTP; 07 Apr 2005 10:54:29 -0400 X-IronPort-AV: i="3.92,84,1112587200"; d="scan'208"; a="43529543:sNHT31929836" Received: from flask.cisco.com (IDENT:mirapoint@flask.cisco.com [161.44.122.62]) by rtp-core-1.cisco.com (8.12.10/8.12.6) with ESMTP id j37EWq1j002267; Thu, 7 Apr 2005 10:32:53 -0400 (EDT) Received: from cisco.com ([161.44.79.173]) by flask.cisco.com (MOS 3.4.6-GR) with ESMTP id AQL02361; Thu, 7 Apr 2005 10:32:49 -0400 (EDT) Message-ID: <42554491.7080600@cisco.com> Date: Thu, 07 Apr 2005 10:32:49 -0400 From: Paul Kyzivat User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.1) Gecko/20020826 X-Accept-Language: en-us, en MIME-Version: 1.0 To: Brian Rosen Subject: Re: [Sip] sip-identity-05: display-name woes References: <3q2adc$1p7qck@sj-inbound-d.cisco.com> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Score: 0.0 (/) X-Scan-Signature: 410b68b37343617c6913e76d02180b14 Content-Transfer-Encoding: 7bit Cc: sip@ietf.org, "'Peterson, Jon'" X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 025f8c5000216988bfe31585db759250 Content-Transfer-Encoding: 7bit Brian Rosen wrote: > Maybe we want to step back and ask: > What is the purpose of a display name? > And > What is the purpose of the Identity work? > > We might find that there is no point in trying to assert anything about > display name ever. I agree it is worthwhile to thoughtfully consider the alternatives. > A display name is something used to LABEL a caller. It's displayed to the > user. > > Identity is used to Identify a caller, primarily to provide a reasonably > reliable indication of who called, and how to call them back. We have (at least) two precedents here that seem relevant to some degree: - callerid in the public telephone network - addressing in email Superficially, sip at the protocol level looks more like email, so that perhaps might argue it is a better precedent. But operationally sip looks more like the telephone network. And significantly it must interoperate with the telephone network. That argues that the callerid precedent should be preferred. > If you go to a telephone company and get a phone line, and you tell them > that your name is George Bush, they might kid you, but they aren't going to > give you the third degree because there really are a few other George Bush's > out there. It's more work than doing something with the display name on > your SIP phone, maybe, but it's not something that is assertable. I find the difference here to be quite significant. You are on the record, in a way that can be used in a court, as having asserted your name is George Bush. And while they might not give you too hard a time saying that is your name, they would probably give you a much harder time if you tried to sign up as "George Bush, President of the United States". And generally, when you sign up you are also tied to a billing or contact address, providing some accountability. > The phone > company REPORTS the name on appropriate caller ID, but does not assert it > means anything. The phone number, on the other hand, is an identifier, and > it does mean something. I think the phone company does assert it means something: it is a name that you have registered and attested to. > Perhaps we simply do not ever include display name in the Identity > signature. The most immediate problem I can see comes when your call lands on a gateway to the PSTN. At that point the identification conventions of the SIP network must be interworked with those of the public telephone network. The gateway must decide whether to populate the calling name and number fields on the PSTN side. If it has no authentication that the information is correct, should it populate it? On the PSTN side there is an expectation that "trusted" information is usually provided, for number and often for name. Calling systems that are not able to provide this are considered second rate. If we want sip systems to be considered first rate, then those systems had better be able to provide this information in a form that is as trustworthy as that from traditional phone systems. If a gateway provides the information even though it isn't trusted, then it *will* be exploited. Once this starts to be generally known, the sip systems may be branded as "second rate", and there might even be legal action to force them to "fix the problem". > I think our email experience suggests that there is not a lot of harm when > you get a forged email display name. We have harm with a forged email > address. There is probably more concern over indecent names than forged > names, but as always YMMV. People have learned to live with this for email. But it does present problems to the more naive users. And it is compounded by email clients that display only the display name, not the actual address. And the spam problem is very visible evidence of problems with the email implementation. I think there is some evidence that people are abandoning email because of problems with it. So it isn't necessarily a good precedent to follow. And, as I pointed out above, there are other reasons to think it is not the preferred precedent. Paul > Brian > > -----Original Message----- > From: sip-bounces@ietf.org [mailto:sip-bounces@ietf.org] On Behalf Of Paul > Kyzivat > Sent: Thursday, April 07, 2005 8:10 AM > To: Peterson, Jon > Cc: sip@ietf.org > Subject: Re: [Sip] sip-identity-05: display-name woes > > > > Peterson, Jon wrote: > >>>The simple answer (but perhaps not a popular one) would be to mandate >>>that the authentication service *must* have a policy wrt display names. >>>(A degenerate policy would be that display names simply aren't permitted.) >> >> >>I would feel more comfortable about that if anyone had any idea how a > > domain might go about enforcing such policies and distributing legitimate > display-names to users. Currently, we're taking it on faith that some > domains will want to adopt such policies, and will figure out appropriate > operational ways to execute them. Not a small thing to take on faith given > the precedents in the email space, not to mention the fact that the domains > themselves seem to gain little by enforcing these policies. > > We shouldn't try to boil the ocean, but I think we should be looking to > put a framework in place that will let the players do the right thing. > > I have the impression there is some appreciation that callerid (both > number and name) should be somewhat trustworthy. That notion just has to > be embraced for SIP. > > If callee devices don't trust, and hence don't display, untrusted > display names, that might eventually provide a competitive advantage to > those that provide trusted names. ("Alice, when you call me your name is > never displayed. Why don't you switch to a service that provides the name?") > > Or it may be that once there are some highly publicized abuses, there > will be legal action to require reliable callerid from IP phones. > > >>>I suppose it is then necessary to be a little more demanding about what >>>sort of policy is acceptable. (A policy of "you can use any display name >>>you want" is probably not an acceptable policy.) >> >> >>Well, it's about as acceptable as the policy "you can use any username in > > the addr-spec portion of the From header field that you want", but that is > effectively the state-of-the-art for SIP and email today. I doubt that > sip-identity can have any appreciable effect on what policies domains want > to use for this stuff. What is can do is specify a way, through mechanism, > for a domain to communicate "my policies, however strict or lax, were > followed with regards to this From header field". > >> >>>Alternatively, perhaps there should be a standard way for discovering >>>the (human and/or machine readable) authentication policy of a >>>particular authentication service. It doesn't have to be part of the >>>request, just derivable from the authentication service credentials. >> >> >>In the end analysis, I can't think of any way that the authorization > > decision made by a recipient would change if it had this information. After > all, a bad domain could lie about its policies, deluded domains will tell > you they have a good policy even though it is routinely circumvented by > clever users, and good domains will be good regardless of whether or not > they tell you your policies. As a verifier, I might be willing to take the > word of a third-party auditor, but I don't think we can incorporate that > into our protocol specification. > > I think I take advantage of such info by configuring my system about > what domains to accept names from. > > In principle, I would think it might eventually be possible to arrange > things so that the signer of the authorization service's cert vouched > for the policy of the authentication service. Then it would be easier to > configure who you trust. (But in practice this sounds hard.) > > Regarding lying about policy - at least being on the record provides the > basis for legal action against those that lie. > > Paul > > >>Jon Peterson >>NeuStar, Inc. >> >> >> >>> Paul >>> >>>Peterson, Jon wrote: >>> >>> >>>>The problem with that, I think, is that it does not provide >>> >>>for the case where the display-name is present, but the >>>authentication service has no policy with regard to >>>display-names. What does the authentication service do then, >>>and how is that behavior disambiguated from the other cases >>>at the verifier? >>> >>> >>>>I agree that if the display-name is present and >>> >>>unauthorized, then the authentication service shouldn't sign >>>the message. In fact, you don't even have to include the >>>display-name in the identity-string in order to structure the >>>mechanism like that. The mechanism in sip-identity-04 >>>essentially reads: >>> >>> >>>>(G) If the domain has policies about display-names, and the >>> >>>display-name is present and unauthorized, decline to sign the >>>message, sending back a 4xx suggesting that the display-name >>>needs to be correct. Otherwise, sign the message (NOT >>>including the display-name) and forward it. >>> >>> >>>>Ultimately, a signature over the display-name itself is not >>> >>>necessary unless you are concerned that the message is going >>>to be modified in transit (which is outside the threat model >>>of sip-identity, since sip-identity is only concerned with >>>impersonation). Replaying the message with a differnt >>>display-name isn't really an option because the replay would >>>be exposed by the other reference indicators present in the >>>request. So at a high level, the fact that a message is >>>signed at all (with or without a display-name) could >>>plausibly signify that either the domain liked the >>>display-name or that it doesn't care about display-names, but >>>it could never plausibly signify that the domain had policies >>>about display-names and that it didn't like the display name, >>>regardless of whether or not the display-name itself is >>>included in the identity-string. >>> >>> >>>>The issue with (G), of course, is that it does not >>> >>>disambiguate the case where the domain has policies about >>>domain names and authorized this message from the case where >>>the domain doesn't have policies. >>> >>> >>>>Jon Peterson >>>>NeuStar, Inc. >>>> >>>> >>>> >>>> >>>>>-----Original Message----- >>>>>From: Paul Kyzivat [mailto:pkyzivat@cisco.com] >>>>>Sent: Wednesday, April 06, 2005 2:31 PM >>>>>To: Peterson, Jon >>>>>Cc: sip@ietf.org >>>>>Subject: Re: [Sip] sip-identity-05: display-name woes >>>>> >>>> >>>>[snip] >>>> >>>> >>>> >>>>>I don't much like any of those alternatives. >>>>> >>>>> >>>>> >>>>> >>>>>>Any better ideas, or barring that, any preferences among the above? >>>>> >>>>>(F) If the display name is present but unauthorized, >>>> >>>decline to sign the >>> >>> >>>>>message. If the display-name is present and authorized, include it. >>>>> >>>> >>>> > > _______________________________________________ > Sip mailing list https://www1.ietf.org/mailman/listinfo/sip > This list is for NEW development of the core SIP Protocol > Use sip-implementors@cs.columbia.edu for questions on current sip > Use sipping@ietf.org for new developments on the application of sip > > _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Thu Apr 7 11:16:03 2005 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA03594 for ; Thu, 7 Apr 2005 11:16:03 -0400 (EDT) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJYsL-0006ks-Pd for sip-web-archive@ietf.org; Thu, 07 Apr 2005 11:24:58 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJYQo-0007Dt-7I; Thu, 07 Apr 2005 10:56:30 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJYQm-0007Do-GT for sip@megatron.ietf.org; Thu, 07 Apr 2005 10:56:28 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA00888 for ; Thu, 7 Apr 2005 10:56:25 -0400 (EDT) Received: from thoth.sbs.de ([192.35.17.2]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJYZL-0005kt-Vy for sip@ietf.org; Thu, 07 Apr 2005 11:05:20 -0400 Received: from mail2.siemens.de (mail2.siemens.de [139.25.208.11]) by thoth.sbs.de (8.12.6/8.12.6) with ESMTP id j37EuMT9005142; Thu, 7 Apr 2005 16:56:22 +0200 Received: from mchp9daa.mch.sbs.de (mchp9daa.mch.sbs.de [139.25.137.99]) by mail2.siemens.de (8.12.6/8.12.6) with ESMTP id j37EuM2n005774; Thu, 7 Apr 2005 16:56:22 +0200 Received: by mchp9daa.mch.sbs.de with Internet Mail Service (5.5.2657.72) id <2A169TTD>; Thu, 7 Apr 2005 16:56:22 +0200 Message-ID: From: Fries Steffen To: "Peterson, Jon" , fluffy@cisco.com Date: Thu, 7 Apr 2005 16:56:18 +0200 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2657.72) Content-Type: text/plain X-Spam-Score: 0.0 (/) X-Scan-Signature: f66b12316365a3fe519e75911daf28a8 Cc: IETF SIP List Subject: [Sip] RE: Question to Identity draft X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 14582b0692e7f70ce7111d04db3781c8 Hi Jon, > > [stf] yes, RFC3261 talks about certificate exchhange. But > here it is > > only possible to take certificates, which are (more or > less) bound to a person. > > Assume that you use certificates, which are bound to the > host used for > > phone calls. Then you would need some instance assuring, that this > > certificate is connected with the registration under some AOR. > > > > What I had in mind is an inband certificate exchange from, > e.g., self > > signed certificates, were the authentication services basically > > assures that the message (and thus the certificate) came > from a person > > registered under a certain AOR. > > RFC3261 does in fact describe the self-signed certificate case. [stf] Okay, I put it in a wrong way, I meant the certificate must follow some dedicated syntax, connected with the domain you are registering in. When you have something like device certificates, which are issued by a corporate CA on the base of machine names, these certificates may be used in SIP scenarios. After successful registering, the Proxy knows, that a user, who authenticated himself using digest authentication over a TLS link that he uses the dedicated device certificate for the duration of his registration for security purposes. That means next time he registers, his identity may be connected with a different certificate, as he may use a different phone. Sure, the user could publish the certificate to a cert server, as described in the certs draft, but I was thinking of some kind of "inband provisioning" for such a scenario. > > > The certificate itself may then be used for end-to-end integrity > > services. > > In what respect would using this certificates for an > end-to-end integrity service be superior to just using > sip-identity-04 for integrity? Note that that strength of a > self-signed credential is necessarily equivalent to the > strength of the security mechanism used to deliver that > self-signed credential to potential users. So, if > sip-identity-04 is used to secure the cert, it isn't clear > how the cert provides a stronger or more attractive assurance > than sip-identity-04 itself would provide. [stf]Using the certificate would require to send just one message over the authentication service and use the supplied certificate for the rest of the communication. > > A usage example would be the key management for SRTP using > MIKEY, were > > one option is the usage of certificates. When here a certificate is > > used, which is completely unknown to the receiver, then there is no > > real value. But when a trusted component (the > authentication service) > > assures, that a person registered with a dedicated AOR is connected > > with this certificate, then it gets a meaning. It would basically > > provide the assurance, that for the time I am in the call, > I am using > > this certificate, which may be sufficient. > > No question that using sip-identity-04 would guarantee the > integrity of the certificate contained in a SIP message body. > But why not have sip-identity-04 secure the SDP body > containing the keymgmt attribute for MIKEY, rather than going > through a certificate exchange phase in order to subsequently > use the a cert (whose strength is equivalent to > sip-identity-04) to secure the SDP body containing the > keymgmt? In what respect is this not a redundant step? [stf] as stated above, the authentication server would only be needed for one message, to support the establishment of a session security context. The other thing is that for the key management for SRTP the client itself needs to include the appropriate message body for MIKEY, as the MIKEY container is protected. The same would be true in scenarios were S/MIME would be required to protect sdescriptions. Regards Steffen > > Jon Peterson > NeuStar, Inc. > > > Regards > > Steffen > > > > > _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Thu Apr 7 15:34:07 2005 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA00544 for ; Thu, 7 Apr 2005 15:34:06 -0400 (EDT) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJcu6-0007tI-C4 for sip-web-archive@ietf.org; Thu, 07 Apr 2005 15:43:03 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJckE-0000CM-T8; Thu, 07 Apr 2005 15:32:50 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJckC-0000CF-D8 for sip@megatron.ietf.org; Thu, 07 Apr 2005 15:32:48 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA00387 for ; Thu, 7 Apr 2005 15:32:46 -0400 (EDT) Received: from sj-iport-5.cisco.com ([171.68.10.87]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJcsn-0007oo-KP for sip@ietf.org; Thu, 07 Apr 2005 15:41:42 -0400 Received: from sj-core-5.cisco.com (171.71.177.238) by sj-iport-5.cisco.com with ESMTP; 07 Apr 2005 12:32:38 -0700 Received: from imail.cisco.com (imail.cisco.com [128.107.200.91]) by sj-core-5.cisco.com (8.12.10/8.12.6) with ESMTP id j37JWZZV015479; Thu, 7 Apr 2005 12:32:35 -0700 (PDT) Received: from thomasm-lnx.cisco.com (thomasm-lnx.cisco.com [171.71.96.50]) by imail.cisco.com (8.12.11/8.12.10) with ESMTP id j37JONcw024392; Thu, 7 Apr 2005 12:24:24 -0700 Subject: RE: [Sip] sip-identity-05: display-name woes From: Michael Thomas To: "Peterson, Jon" In-Reply-To: <24EAE5D4448B9D4592C6D234CBEBD59701502E15@stntexch03.cis.neustar.com> References: <24EAE5D4448B9D4592C6D234CBEBD59701502E15@stntexch03.cis.neustar.com> Organization: Cisco Systems Message-Id: <1112902354.8315.14.camel@thomasm-lnx.cisco.com> Mime-Version: 1.0 X-Mailer: Ximian Evolution 1.4.6 Date: Thu, 07 Apr 2005 12:32:34 -0700 IIM-SIG: v:"1.1"; h:"imail.cisco.com"; d:"cisco.com"; z:"home"; m:"krs"; t:"1112901864.52606"; x:"432200"; a:"rsa-sha1"; b:"nofws:1669"; e:"Iw=="; n:"sQYarK2E51MdcTiUqeif3F7cWdxIfoCiXhdfb9vD5ee/j0jXL15gbFxF2p" "XIweAblu0N6XAgK7k+wrbr7bQDJaCDqOmzqpRUBjIRQAXQ7NzadpmR3pUL6wxaRUtW+c43sl9jC" "50Qg1sXHpPjt8Y+Y16ioyQAQAdSunM4YhevURc="; s:"Voq1V6VPHmHiIlkdGtAvFp41AT7dQLUH88yw6L2KoddY15qtPdaf0Lz6+JUA9TPMOdFHrFJJ" "6DN8hVruGkaY1CuKHpi5E75q3RobfmbPSSU61Bmn9+gNjhBKf1lNK6BoJgxm2YV7K7MJ/LwQSQX" "mPsfvgw/6lIFURkS+rH+K2zI="; c:"Subject: RE: [Sip] sip-identity-05: display-name woes"; c:"From: Michael Thomas "; c:"Date: Thu, 07 Apr 2005 12:32:34 -0700" IIM-VERIFY: s:"y"; v:"y"; r:"60"; h:"imail.cisco.com"; c:"message from imail.cisco.com verified; " X-Spam-Score: 0.0 (/) X-Scan-Signature: 50a516d93fd399dc60588708fd9a3002 Cc: sip@ietf.org, Paul Kyzivat X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============1585197754==" Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 4b800b1eab964a31702fa68f1ff0e955 --===============1585197754== Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="=-4I2ta+69RG+5CEVI3Smk" --=-4I2ta+69RG+5CEVI3Smk Content-Type: text/plain Content-Transfer-Encoding: quoted-printable On Wed, 2005-04-06 at 18:04, Peterson, Jon wrote: > > The simple answer (but perhaps not a popular one) would be to mandate=20 > > that the authentication service *must* have a policy wrt display names.= =20 > > (A degenerate policy would be that display names simply aren't permitte= d.) >=20 > I would feel more comfortable about that if anyone had any idea how a dom= ain might go about enforcing such policies and distributing legitimate disp= lay-names to users. Currently, we're taking it on faith that some domains w= ill want to adopt such policies, and will figure out appropriate operationa= l ways to execute them. Not a small thing to take on faith given the preced= ents in the email space, not to mention the fact that the domains themselve= s seem to gain little by enforcing these policies. In the email space there is absolutely no consequence to having bad onramp polices because a domain has absolutely no control over who uses their name. I think that basic fact is far more important than the lack of ability to police users. The general theory behind IIM is that when=20 those domains regain control over who uses their name in=20 email, there will be a lot of incentive to police their=20 users lest their name be sullied. The actual mechanics of user policing is pretty well understood, I think: you take them behind the barn and horsewhip them when they misbehave. Right? Mike --=-4I2ta+69RG+5CEVI3Smk Content-Type: application/pgp-signature; name=signature.asc Content-Description: This is a digitally signed message part -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.3 (GNU/Linux) iQCVAwUAQlWK0rMsDAj/Eq++AQL7rAP/VBQWQWgL7gSBmHbB3ImImkV9TJMaqoXQ jCTGao/hatrN3Awd2IQSaQhvdAM4RvmFqSO3HvWdQ3zyynZAUgaQZws89lm8Jf/L YVVv/PPFoQRMAsgouiPtuoWJ4vS16QHkdneI1t5Jkei8dSzL8RlIZmFn8UkV6H0/ Ib2TKHsilQY= =FcZc -----END PGP SIGNATURE----- --=-4I2ta+69RG+5CEVI3Smk-- --===============1585197754== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline Content-Transfer-Encoding: 7bit _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip --===============1585197754==-- From sip-bounces@ietf.org Thu Apr 7 17:14:52 2005 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA08891 for ; Thu, 7 Apr 2005 17:14:52 -0400 (EDT) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJeTe-00030h-3z for sip-web-archive@ietf.org; Thu, 07 Apr 2005 17:23:50 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJeEg-0004EO-91; Thu, 07 Apr 2005 17:08:22 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJeEd-0004Dl-Ra for sip@megatron.ietf.org; Thu, 07 Apr 2005 17:08:19 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA08259 for ; Thu, 7 Apr 2005 17:08:16 -0400 (EDT) Received: from voyager.coretrek.no ([212.33.142.2]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJeNG-0002lU-0h for sip@ietf.org; Thu, 07 Apr 2005 17:17:15 -0400 Received: from localhost (localhost [127.0.0.1]) by voyager.coretrek.no (Postfix) with ESMTP id 3EA8BA9884; Thu, 7 Apr 2005 23:08:06 +0200 (CEST) Received: from [72.29.231.70] (unknown [72.29.231.70]) by voyager.coretrek.no (Postfix) with ESMTP id E27DDA987B; Thu, 7 Apr 2005 23:07:59 +0200 (CEST) Mime-Version: 1.0 (Apple Message framework v619.2) Content-Type: text/plain; charset=US-ASCII; format=flowed Message-Id: Content-Transfer-Encoding: 7bit From: Hisham Khartabil Date: Thu, 7 Apr 2005 23:07:39 +0200 To: IETF SIP List X-Mailer: Apple Mail (2.619.2) X-Virus-Scanned: by AMaViS perl-11 (CoreTrek clamav patch 1) X-Spam-Score: 0.0 (/) X-Scan-Signature: a7d6aff76b15f3f56fcb94490e1052e4 Content-Transfer-Encoding: 7bit Cc: "Sip-implementors@cs.columbia.edu" Subject: [Sip] Session Timer: UAC populating the refresher parameter X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 769a46790fb42fbb0b0cc700c82f7081 Content-Transfer-Encoding: 7bit This came up at sipit 16. draft-ietf-sip-session-timer-15.txt says in section 7.1: "The UAC MAY include the refresher parameter with value 'uac' if it wishes to perform the refreshes. However, it is RECOMMENDED that the parameter be omitted, so that it can be selected by the negotiation mechanisms described below." I came across an implantation that sets the refresher parameter to 'uas' when initiating the INVITE. The claim was that the draft does not explicitly forbid that. The problem with that is: what if the UAS does not support session timer. The spec says in section 8.2 (proxy processing responses) "If, however, the proxy remembers that the UAC did support session timer, additional processing is needed. Because there is no Session-Expires or Require header field in the response, the proxy knows it is the first session-timer-aware proxy to receive the response. This proxy MUST insert a Session-Expires header field into the response with the value it remembered from the forwarded request." Some proxies may interpret that to mean the whole value, including the refresher parameter that contained 'uas' which will cause all sorts of funny things to happen. Now, the draft does go on to say " It (the proxy) MUST set the value of the 'refresher' parameter to 'uac'." so the problem my fix itself, but i think we need to clarify this: either say that the UAC MUST NOT set the refresh parameter to 'uas' (which is what I prefer) or add some text clarifying the scenario and behaviour for proxies. Regards, Hisham _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Thu Apr 7 17:30:34 2005 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA10437 for ; Thu, 7 Apr 2005 17:30:34 -0400 (EDT) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJeiq-0003dB-FZ for sip-web-archive@ietf.org; Thu, 07 Apr 2005 17:39:33 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJeYb-00047T-NR; Thu, 07 Apr 2005 17:28:57 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJeYY-000462-Na for sip@megatron.ietf.org; Thu, 07 Apr 2005 17:28:54 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA10293 for ; Thu, 7 Apr 2005 17:28:51 -0400 (EDT) Received: from zrtps0kn.nortelnetworks.com ([47.140.192.55]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJeh6-0003X6-NN for sip@ietf.org; Thu, 07 Apr 2005 17:37:50 -0400 Received: from zrtpd0jn.us.nortel.com (zrtpd0jn.us.nortel.com [47.140.202.35]) by zrtps0kn.nortelnetworks.com (Switch-2.2.6/Switch-2.2.0) with ESMTP id j37LSSi20453; Thu, 7 Apr 2005 17:28:28 -0400 (EDT) Received: by zrtpd0jn.us.nortel.com with Internet Mail Service (5.5.2653.19) id <2KL1RQYX>; Thu, 7 Apr 2005 17:28:28 -0400 Message-ID: <1ECE0EB50388174790F9694F77522CCF01E39357@zrc2hxm0.corp.nortel.com> From: "Francois Audet" To: "'Peterson, Jon'" , "'Fries Steffen'" , "'fluffy@cisco.com'" Subject: RE: [Sip] RE: Question to Identity draft Date: Thu, 7 Apr 2005 17:28:12 -0400 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2653.19) X-Spam-Score: 0.8 (/) X-Scan-Signature: 025f8c5000216988bfe31585db759250 Cc: "'IETF SIP List'" X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============0546302129==" Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org X-Spam-Score: 0.8 (/) X-Scan-Signature: dd887a8966a4c4c217a52303814d0b5f This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. --===============0546302129== Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C53BB8.B442C777" This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. ------_=_NextPart_001_01C53BB8.B442C777 Content-Type: text/plain Hi Jon, Your draft peterson-sipping-retarget-00 describes very well the issues at hand. I don't view the use of INVITE as a "fetch". To me the SUBSCRIBE mechanism is the fetch mechanism, and it should definitively be used whenever it is possible. There is a very strong incentive to use SUBSCRIBE to fetch the certificates of the "people you know" because it will result in session setup in ONE round-trip (which will not be the case when there is a failure, as with unanticipated respondents). What I am saying is that there are a lot of cases where the SUBSCRIBE mechanism will NOT work, but where you may still have a need for either/both Identity and/or Privacy (encryption). We absolutely need to acknowlege that this will happen (and it will happen a lot). I've listed a few cases where SUBSCRIBE won't work. It boils down to cases where the responder is unpredictable which is extremly common. Going through the specifics of the retarging-draft regarding identity: - To me the logical choice for the connected party information would be to use the far-end certificate (especially if we need to do encryption as well). It fact, it seems to be the only choice as, as you point out, it is impossible to enforce a rule that prohibits proxies from retargeting in a domain it is not responsible for. - It seems to me that it would solve the unanticipated respondent problem (2.2.1). The sender of the request would have many choices, depending of the application, on what to do before sending a request: - In the case of sending a request that does NOT include an encrypted body, the sender needs to decide if there is any information that is sensitive before it sends the request. For example, if it is a SIP INVITE, it may decide that it will NOT send an SDP body (because it doesn't want to advertize the information to anybody) in the INVITE (which means it is doing delayed offer/answer. That particular mechanism has some advantage, including avoiding a re-negotiation later on (what you call the fetch). There are some cases where this makes sense. - In most cases, I would say that you would use encryption (S/MIME) to send the body. This means that there is no unanticipated respondent problem because the unintendent respondent won't be able to decrypt the body in the first place. Perhaps, we should highly recommend this approach (as opposed to "depopulate the message" as above. - Again, if for specific requests, it only makes sense to reach a specific recipient (e.g., MESSAGE), you still have the option to rely strictly on SUBSCRIBE. To me the real important use case where SUBSCRIBE is not enought is INVITEs (and more importantly, for sRTP). It is important to acknowledge in advance that there is no way for the sender to know in advance that there will be an unanticipated responder. Even if a SUBSCRIBE was successful earlier, it may still be retargeted. - In section 2.3, you talk about using 493. Personally, I would think that a 3XX code (possibly a new one) would be more appropriate. In case of forking for example, it is more likely that the forking proxy would redirect than a 4XX code which would be very likely to be dropped. You talk about a potential problem that the new INVITE could still be routed to a different users (just like SUBSCRIBE). Why not use a URI that specifically refers to a specific user as a Contact (perhaps a GRUU)? This essentially transforms a retargeting into a redirection, which solves a lot of issues (the To: would of course remain as per the original INVITE). - The second to last paragraph of 2.3 says that "This whole class of failure would be preventable if Alice were able to guess who would eventually receive her request." I would say that it is quite unrealistic to think that this is feasible all the time. There are countless examples where this is not possible, and where you would still want to know (1) who responds, and (2) you may still want to do encryption. - In section 2.4 you talk about consent of the UAC. You are right: this is absolutely crucial. My take is that the UAC could clear the session. I would say that would be appropriate for INVITEs for example (keep in mind that normally, the receiver wouldn't understand the SDP if it is not authorized, so no harm is done). I would agree that you probably don't want to do this for MESSAGE. We could also do some sort of precondition if we really have to. - Section 5 is where I was a little puzzled... The way I read the document, I was convinced the conclusion would be to use a "Connected party" approach, but instead it suggests that the entities doing the retargeting would have to do some new procedures. I think this is not enforceable. Even if it was enforceable, it would be increadibly complicated when multiple retargeting occur. I'd much rather rely on the certificate of the responder, and let the sender decide how to proceed. This would also allow for supporting sRTP to unanticipated respondents. Note: I will point out that MIKEY allows for this today because the certificates can be included in the MIKEY message. Not so for SDESC. If we "pop up 2 levels" the certificates to the SIP level (instead of inside MIKEY inside SDP in SIP), then we could have a solution that would work for both mechanisms, allowing a UAC to advertize support for both mechanism. You could use S/MIME with both mechanisms. > -----Original Message----- > From: Peterson, Jon [mailto:jon.peterson@neustar.biz] > Sent: Wednesday, April 06, 2005 12:39 > To: Audet, Francois [SC100:9T51:EXCH]; Fries Steffen; fluffy@cisco.com > Cc: IETF SIP List > Subject: RE: [Sip] RE: Question to Identity draft > > > > I agree that the problems you describe below are all > retargeting problems. The retargeting draft > (peterson-sipping-retarget-00 Section 2.3) notes that this > problem applies to the RFC3261 INVITE-like certificate > exchange mechanism. All in all, though, I'm pretty sure that > these sorts of problems are more tractable in a > SUBSCRIBE-like model for certificate acquisition than they > are in an INVITE-like model for certificate acquisition. [rest trimmed] ------_=_NextPart_001_01C53BB8.B442C777 Content-Type: text/html RE: [Sip] RE: Question to Identity draft

Hi Jon,

Your draft peterson-sipping-retarget-00 describes very well the
issues at hand.

I don't view the use of INVITE as a "fetch". To me the SUBSCRIBE mechanism
is the fetch mechanism, and it should definitively be used whenever it
is possible. There is a very strong incentive to use SUBSCRIBE to fetch the
certificates of the "people you know" because it will result in session setup
in ONE round-trip (which will not be the case when there is a failure, as with
unanticipated respondents).

What I am saying is that there are a lot of cases where the
SUBSCRIBE mechanism will NOT work, but where you may still have a need for
either/both Identity and/or Privacy (encryption). We absolutely need to
acknowlege that this will happen (and it will happen a lot).

I've listed a few cases where SUBSCRIBE won't work. It boils down to cases
where the responder is unpredictable which is extremly common.

Going through the specifics of the retarging-draft regarding identity:

- To me the logical choice for the connected party information would be
  to use the far-end certificate (especially if we need to do encryption
  as well). It fact, it seems to be the only choice as, as you point out,
  it is impossible to enforce a rule that prohibits proxies from
  retargeting in a domain it is not responsible for.

- It seems to me that it would solve the unanticipated respondent problem
  (2.2.1). The sender of the request would have many choices, depending
  of the application, on what to do before sending a request:

  - In the case of sending a request that does NOT include an encrypted
    body, the sender needs to decide if there is any information that is
    sensitive before it sends the request. For example, if it is a SIP
    INVITE, it may decide that it will NOT send an SDP body (because it
    doesn't want to advertize the information to anybody) in the INVITE
    (which means it is doing delayed offer/answer. That particular mechanism
    has some advantage, including avoiding a re-negotiation later on (what you
    call the fetch). There are some cases where this makes sense.

  - In most cases, I would say that you would use encryption (S/MIME) to
    send the body. This means that there is no unanticipated respondent
    problem because the unintendent respondent won't be able to decrypt
    the body in the first place. Perhaps, we should highly recommend
    this approach (as opposed to "depopulate the message" as above.

  - Again, if for specific requests, it only makes sense to reach a specific
    recipient (e.g., MESSAGE), you still have the option to rely strictly on
    SUBSCRIBE. To me the real important use case where SUBSCRIBE is not
    enought is INVITEs (and more importantly, for sRTP).

  It is important to acknowledge in advance that there is no way for the
  sender to know in advance that there will be an unanticipated responder.
  Even if a SUBSCRIBE was successful earlier, it may still be retargeted.

- In section 2.3, you talk about using 493. Personally, I would think that
  a 3XX code (possibly a new one) would be more appropriate. In case of
  forking for example, it is more likely that the forking proxy would redirect
  than a 4XX code which would be very likely to be dropped. You talk about a
  potential problem that the new INVITE could still be routed to a different
  users (just like SUBSCRIBE). Why not use a URI that specifically refers to
  a specific user as a Contact (perhaps a GRUU)? This essentially transforms
  a retargeting into a redirection, which solves a lot of issues (the To:
  would of course remain as per the original INVITE).

- The second to last paragraph of 2.3 says that "This whole class of failure
  would be preventable if Alice were able to guess who would eventually receive
  her request." I would say that it is quite unrealistic to think that this
  is feasible all the time. There are countless examples where this is not
  possible, and where you would still want to know (1) who responds, and (2) you
  may still want to do encryption.

- In section 2.4 you talk about consent of the UAC. You are right: this is
  absolutely crucial. My take is that the UAC could clear the session.
  I would say that would be appropriate for INVITEs for example (keep in mind
  that normally, the receiver wouldn't understand the SDP if it is not
  authorized, so no harm is done). I would agree that you probably don't want
  to do this for MESSAGE. We could also do some sort of precondition if
  we really have to.

- Section 5 is where I was a little puzzled... The way I read the document,
  I was convinced the conclusion would be to use a "Connected party" approach, but
  instead it suggests that the entities doing the retargeting would have to
  do some new procedures. I think this is not enforceable. Even if it was enforceable,
  it would be increadibly complicated when multiple retargeting occur. I'd much rather
  rely on the certificate of the responder, and let the sender decide how to proceed.

This would also allow for supporting sRTP to unanticipated respondents.

Note: I will point out that MIKEY allows for this today because the certificates
      can be included in the MIKEY message. Not so for SDESC. If we "pop up 2 levels"
      the certificates to the SIP level (instead of inside MIKEY inside SDP in SIP), then
      we could have a solution that would work for both mechanisms, allowing a UAC to
      advertize support for both mechanism. You could use S/MIME with both mechanisms.

> -----Original Message-----
> From: Peterson, Jon [mailto:jon.peterson@neustar.biz]
> Sent: Wednesday, April 06, 2005 12:39
> To: Audet, Francois [SC100:9T51:EXCH]; Fries Steffen; fluffy@cisco.com
> Cc: IETF SIP List
> Subject: RE: [Sip] RE: Question to Identity draft
>
>
>
> I agree that the problems you describe below are all
> retargeting problems. The retargeting draft
> (peterson-sipping-retarget-00 Section 2.3) notes that this
> problem applies to the RFC3261 INVITE-like certificate
> exchange mechanism. All in all, though, I'm pretty sure that
> these sorts of problems are more tractable in a
> SUBSCRIBE-like model for certificate acquisition than they
> are in an INVITE-like model for certificate acquisition.

[rest trimmed]

------_=_NextPart_001_01C53BB8.B442C777-- --===============0546302129== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline Content-Transfer-Encoding: 7bit _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip --===============0546302129==-- From sip-bounces@ietf.org Thu Apr 7 17:56:10 2005 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA12215 for ; Thu, 7 Apr 2005 17:56:10 -0400 (EDT) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJf7d-0004To-0x for sip-web-archive@ietf.org; Thu, 07 Apr 2005 18:05:09 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJexb-0000sg-0O; Thu, 07 Apr 2005 17:54:47 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJexY-0000ol-EK for sip@megatron.ietf.org; Thu, 07 Apr 2005 17:54:44 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA12073 for ; Thu, 7 Apr 2005 17:54:41 -0400 (EDT) Received: from sj-iport-3-in.cisco.com ([171.71.176.72] helo=sj-iport-3.cisco.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJf6B-0004QI-RZ for sip@ietf.org; Thu, 07 Apr 2005 18:03:40 -0400 Received: from sj-core-1.cisco.com (171.71.177.237) by sj-iport-3.cisco.com with ESMTP; 07 Apr 2005 14:54:33 -0700 X-IronPort-AV: i="3.92,85,1112598000"; d="scan'208"; a="247202608:sNHT307786498" Received: from flask.cisco.com (IDENT:mirapoint@flask.cisco.com [161.44.122.62]) by sj-core-1.cisco.com (8.12.10/8.12.6) with ESMTP id j37LsUDr023064; Thu, 7 Apr 2005 14:54:31 -0700 (PDT) Received: from cisco.com ([161.44.79.173]) by flask.cisco.com (MOS 3.4.6-GR) with ESMTP id AQL48059; Thu, 7 Apr 2005 17:54:29 -0400 (EDT) Message-ID: <4255AC15.7000700@cisco.com> Date: Thu, 07 Apr 2005 17:54:29 -0400 From: Paul Kyzivat User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.1) Gecko/20020826 X-Accept-Language: en-us, en MIME-Version: 1.0 To: Hisham Khartabil References: Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Score: 0.0 (/) X-Scan-Signature: 5a9a1bd6c2d06a21d748b7d0070ddcb8 Content-Transfer-Encoding: 7bit Cc: IETF SIP List , "Sip-implementors@cs.columbia.edu" Subject: [Sip] Re: [Sip-implementors] Session Timer: UAC populating the refresher parameter X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: e8a67952aa972b528dd04570d58ad8fe Content-Transfer-Encoding: 7bit I think the implementation is just being stupid. The whole point is to negotiate who does refreshes, so you discover someone who can if there is anybody who can. Declaring that the other guy should do it violates that. So I think this is clearly not within the intent of the spec, even if the wording could be better. Paul Hisham Khartabil wrote: > This came up at sipit 16. > > draft-ietf-sip-session-timer-15.txt says in section 7.1: > > "The UAC MAY include the refresher parameter with value 'uac' if it > wishes to perform the refreshes. However, it is RECOMMENDED that the > parameter be omitted, so that it can be selected by the negotiation > mechanisms described below." > > I came across an implantation that sets the refresher parameter to 'uas' > when initiating the INVITE. The claim was that the draft does not > explicitly forbid that. > > The problem with that is: what if the UAS does not support session > timer. The spec says in section 8.2 (proxy processing responses) > > "If, however, the proxy remembers that the UAC did > support session timer, additional processing is needed. > > Because there is no Session-Expires or Require header field in the > response, the proxy knows it is the first session-timer-aware proxy > to receive the response. This proxy MUST insert a Session-Expires > header field into the response with the value it remembered from the > forwarded request." > > Some proxies may interpret that to mean the whole value, including the > refresher parameter that contained 'uas' which will cause all sorts of > funny things to happen. > > Now, the draft does go on to say > > " It (the proxy) MUST set the value of the 'refresher' > parameter to 'uac'." > > so the problem my fix itself, but i think we need to clarify this: > either say that the UAC MUST NOT set the refresh parameter to 'uas' > (which is what I prefer) or add some text clarifying the scenario and > behaviour for proxies. > > Regards, > Hisham > > _______________________________________________ > Sip-implementors mailing list > Sip-implementors@cs.columbia.edu > http://lists.cs.columbia.edu/mailman/listinfo/sip-implementors > _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Thu Apr 7 18:05:46 2005 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA13161 for ; Thu, 7 Apr 2005 18:05:46 -0400 (EDT) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJfGu-0004nA-NT for sip-web-archive@ietf.org; Thu, 07 Apr 2005 18:14:45 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJf7e-0004Lz-I4; Thu, 07 Apr 2005 18:05:10 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJf7a-0004LC-PT for sip@megatron.ietf.org; Thu, 07 Apr 2005 18:05:06 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA13042 for ; Thu, 7 Apr 2005 18:05:03 -0400 (EDT) Received: from sj-iport-4.cisco.com ([171.68.10.86]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJfGD-0004mB-2C for sip@ietf.org; Thu, 07 Apr 2005 18:14:02 -0400 Received: from sj-core-4.cisco.com (171.68.223.138) by sj-iport-4.cisco.com with ESMTP; 07 Apr 2005 15:04:56 -0700 Received: from whoami.cisco.com (IDENT:mirapoint@whoami.cisco.com [64.101.128.102]) by sj-core-4.cisco.com (8.12.10/8.12.6) with ESMTP id j37M4r3S028011 for ; Thu, 7 Apr 2005 15:04:54 -0700 (PDT) Received: from kasnarayw2k05 ([64.101.172.153]) by whoami.cisco.com (MOS 3.4.5-GR) with ESMTP id AHS99862; Thu, 7 Apr 2005 17:04:52 -0500 (CDT) Message-Id: <200504072204.AHS99862@whoami.cisco.com> From: "Kasturi Narayanan" To: Date: Thu, 7 Apr 2005 17:04:52 -0500 MIME-Version: 1.0 X-Mailer: Microsoft Office Outlook, Build 11.0.5510 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106 Thread-Index: AcU7vdLLaAFoBCTvSu6eZvaUfK4jbQ== X-Spam-Score: 0.1 (/) X-Scan-Signature: a4a24b484706be629f915bfb1a3e4771 Subject: [Sip] RFC3262 -The Offer/Answer Model and PRACK (question) X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============1737561878==" Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org X-Spam-Score: 0.2 (/) X-Scan-Signature: 65bc4909d78e8b10349def623cf7a1d1 This is a multi-part message in MIME format. --===============1737561878== Content-Type: multipart/alternative; boundary="----=_NextPart_000_009F_01C53B93.EA47C310" This is a multi-part message in MIME format. ------=_NextPart_000_009F_01C53B93.EA47C310 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit I have a question related to the following sentence in the RFC3262. Here is the sentence in Section 5 of the RFC 3262 "Similarly, if a reliable provisional response is the first reliable message sent back to the UAC, and the INVITE did not contain an offer, one MUST appear in that reliable provisional response." Why is it made mandatory that, when INVITE(without offer) should always result in a 18x(with Offer) if 18x is reliably sent? However in the RFC it is not mandatory to include Answer in 18x if Invite is sent with an OFFER. If there are cases where a Sip UAS wants to send 180 Ringing reliably (without Offer) so that the remote UAC can generate local Ring back and at the same time wants to send Offer in 200 OK only and get the answer in ACK only. Why the above condition is not a valid condition? Please clarify Thanks Kasturi Narayanan, ------=_NextPart_000_009F_01C53B93.EA47C310 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

I have a question related to the following sentence = in the RFC3262.

 

Here is the sentence in Section 5 of the RFC = 3262

 

Similarly, if a reliable provisional response is the first reliable message sent back to = the UAC, and the

INVITE did not contain an = offer, one MUST appear in that reliable provisional = response.”

 

Why is it made mandatory = that, when INVITE(without offer) should always result in a 18x(with Offer) if 18x is reliably = sent?

 

However in the RFC it is = not mandatory to include Answer in 18x if Invite is sent with an = OFFER.

 

If there are cases where a = Sip UAS wants to send 180 Ringing reliably (without Offer) so that the remote UAC can generate local Ring back and at the same time wants to send Offer in 200 = OK only   and get the answer in ACK = only.

 

Why the above condition is = not a valid condition?  Please clarify

 

Thanks

Kasturi = Narayanan,

 =

 

------=_NextPart_000_009F_01C53B93.EA47C310-- --===============1737561878== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline Content-Transfer-Encoding: 7bit _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip --===============1737561878==-- From sip-bounces@ietf.org Thu Apr 7 20:46:46 2005 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA24076 for ; Thu, 7 Apr 2005 20:46:46 -0400 (EDT) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJhmi-0001CI-J7 for sip-web-archive@ietf.org; Thu, 07 Apr 2005 20:55:45 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJhP4-0001f1-6o; Thu, 07 Apr 2005 20:31:18 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJhP2-0001dF-Be for sip@megatron.ietf.org; Thu, 07 Apr 2005 20:31:16 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA23062 for ; Thu, 7 Apr 2005 20:31:14 -0400 (EDT) Received: from sj-iport-3-in.cisco.com ([171.71.176.72] helo=sj-iport-3.cisco.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJhXh-0000gV-6t for sip@ietf.org; Thu, 07 Apr 2005 20:40:13 -0400 Received: from sj-core-2.cisco.com (171.71.177.254) by sj-iport-3.cisco.com with ESMTP; 07 Apr 2005 17:31:07 -0700 X-IronPort-AV: i="3.92,85,1112598000"; d="scan'208"; a="247272840:sNHT28845632" Received: from flask.cisco.com (IDENT:mirapoint@flask.cisco.com [161.44.122.62]) by sj-core-2.cisco.com (8.12.10/8.12.6) with ESMTP id j380UvgE007278; Thu, 7 Apr 2005 17:30:58 -0700 (PDT) Received: from cisco.com ([161.44.79.173]) by flask.cisco.com (MOS 3.4.6-GR) with ESMTP id AQL57918; Thu, 7 Apr 2005 20:31:02 -0400 (EDT) Message-ID: <4255D0C6.5080606@cisco.com> Date: Thu, 07 Apr 2005 20:31:02 -0400 From: Paul Kyzivat User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.1) Gecko/20020826 X-Accept-Language: en-us, en MIME-Version: 1.0 To: Kasturi Narayanan Subject: Re: [Sip] RFC3262 -The Offer/Answer Model and PRACK (question) References: <200504072204.AHS99862@whoami.cisco.com> Content-Type: text/plain; charset=windows-1252; format=flowed X-Spam-Score: 0.0 (/) X-Scan-Signature: c0bedb65cce30976f0bf60a0a39edea4 Content-Transfer-Encoding: quoted-printable X-MIME-Autoconverted: from 8bit to quoted-printable by ietf.org id UAA23062 Cc: sip@ietf.org X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 0fa76816851382eb71b0a882ccdc29ac Content-Transfer-Encoding: quoted-printable There was a long discussion of this several months ago. I don't know why this requirement is there, and I don't recall that the=20 discussion explained why. As I recall the discussion, the outcome was=20 more or less: That is the way it was specified and it is too late and=20 hard to change. There are ways for everybody to comply, so just do it. I'm sure somebody will correct me if my memory is bad. (I could probably=20 find the thread if I tried hard enough, but I've got other things to do=20 now.) Paul Kasturi Narayanan wrote: > I have a question related to the following sentence in the RFC3262. >=20 > =20 >=20 > Here is the sentence in Section 5 of the RFC 3262 >=20 > =20 >=20 > =93Similarly, if a reliable provisional response is the first reliable=20 > message sent back to the UAC, and the >=20 > INVITE did not contain an offer, one MUST appear in that reliable=20 > provisional response.=94 >=20 > =20 >=20 > Why is it made mandatory that, when INVITE(without offer) should always= =20 > result in a 18x(with Offer) if 18x is reliably sent? >=20 > =20 >=20 > However in the RFC it is not mandatory to include Answer in 18x if=20 > Invite is sent with an OFFER. >=20 > =20 >=20 > If there are cases where a Sip UAS wants to send 180 Ringing reliably=20 > (without Offer) so that the remote UAC can generate local Ring back and= =20 > at the same time wants to send Offer in 200 OK only and get the answe= r=20 > in ACK only. >=20 > =20 >=20 > Why the above condition is not a valid condition? Please clarify >=20 > =20 >=20 > Thanks >=20 > */Kasturi Narayanan,/* >=20 > */ /* >=20 > =20 >=20 >=20 > -----------------------------------------------------------------------= - >=20 > _______________________________________________ > Sip mailing list https://www1.ietf.org/mailman/listinfo/sip > This list is for NEW development of the core SIP Protocol > Use sip-implementors@cs.columbia.edu for questions on current sip > Use sipping@ietf.org for new developments on the application of sip _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Thu Apr 7 20:46:49 2005 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA24100 for ; Thu, 7 Apr 2005 20:46:49 -0400 (EDT) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJhmm-0001CZ-QS for sip-web-archive@ietf.org; Thu, 07 Apr 2005 20:55:49 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJhWS-00029U-DX; Thu, 07 Apr 2005 20:38:56 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJhWQ-00029J-9C; Thu, 07 Apr 2005 20:38:54 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA23611; Thu, 7 Apr 2005 20:38:51 -0400 (EDT) From: Wayne.Davies@mmv.vic.gov.au Received: from doi-fire.doi.vic.gov.au ([203.34.63.1] helo=ndoigwy01.doi.vic.gov.au) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJhf3-0000t9-SA; Thu, 07 Apr 2005 20:47:50 -0400 In-Reply-To: <4255AC15.7000700@cisco.com> Subject: Re: [Sip] Re: [Sip-implementors] Session Timer: UAC populating the refresher parameter To: Paul Kyzivat X-Mailer: Lotus Notes Release 6.5.1 January 21, 2004 Message-ID: Date: Fri, 8 Apr 2005 10:38:35 +1000 X-MIMETrack: Serialize by Router on nDOIGWY01/Server/DOI(Release 6.5.1|January 21, 2004) at 08/04/2005 10:38:52 AM MIME-Version: 1.0 Content-type: text/plain; charset=US-ASCII X-Spam-Score: 0.3 (/) X-Scan-Signature: a8a20a483a84f747e56475e290ee868e Cc: IETF SIP List , sip-bounces@ietf.org, "Sip-implementors@cs.columbia.edu" X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org X-Spam-Score: 0.3 (/) X-Scan-Signature: 6d95a152022472c7d6cdf886a0424dc6 Paul, Let me start by saying that I agree that the simplest implementation (preferred) would be to leave the refresher parameter not specificied in the request, it is what is recommended in the draft. But I do not think specifying the refresher in the request is stupid and to me it seems clearly allowed in the draft. Leaving the refresher unspecified in the request is deemed 'negotiation' but the UAS can set the refresher in the response to either UAC or UAS, so it is set by local policy at the UAS yeah ?, which is not really a negotiation it is just letting the other guy choose. Both UAC and UAS that support session timer are to be capable of performing the session refreshes so I don't really see the harm. The behaviour in section 8.2 queried below does indeed seem to sort itself out for the given scenario. Regards - Wayne. >I think the implementation is just being stupid. > >The whole point is to negotiate who does refreshes, so you discover >someone who can if there is anybody who can. Declaring that the other >guy should do it violates that. So I think this is clearly not within >the intent of the spec, even if the wording could be better. > > Paul > >Hisham Khartabil wrote: >> This came up at sipit 16. >> >> draft-ietf-sip-session-timer-15.txt says in section 7.1: >> >> "The UAC MAY include the refresher parameter with value 'uac' if it >> wishes to perform the refreshes. However, it is RECOMMENDED that the >> parameter be omitted, so that it can be selected by the negotiation >> mechanisms described below." >> >> I came across an implantation that sets the refresher parameter to 'uas' >> when initiating the INVITE. The claim was that the draft does not >> explicitly forbid that. >> >> The problem with that is: what if the UAS does not support session >> timer. The spec says in section 8.2 (proxy processing responses) >> >> "If, however, the proxy remembers that the UAC did >> support session timer, additional processing is needed. >> >> Because there is no Session-Expires or Require header field in the >> response, the proxy knows it is the first session-timer-aware proxy >> to receive the response. This proxy MUST insert a Session-Expires >> header field into the response with the value it remembered from the >> forwarded request." >> >> Some proxies may interpret that to mean the whole value, including the >> refresher parameter that contained 'uas' which will cause all sorts of >> funny things to happen. >> >> Now, the draft does go on to say >> >> " It (the proxy) MUST set the value of the 'refresher' >> parameter to 'uac'." >> >> so the problem my fix itself, but i think we need to clarify this: >> either say that the UAC MUST NOT set the refresh parameter to 'uas' >> (which is what I prefer) or add some text clarifying the scenario and >> behaviour for proxies. >> >> Regards, >> Hisham >> >> _______________________________________________ >> Sip-implementors mailing list >> Sip-implementors@cs.columbia.edu >> http://lists.cs.columbia.edu/mailman/listinfo/sip-implementors >> _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip ********************************************************************** Any personal or sensitive information contained in this email and attachments must be handled in accordance with the Victorian Information Privacy Act 2000, the Health Records Act 2001 or the Privacy Act 1988 (Commonwealth), as applicable. This email, including all attachments, is confidential. If you are not the intended recipient, you must not disclose, distribute, copy or use the information contained in this email or attachments. Any confidentiality or privilege is not waived or lost because this email has been sent to you in error. If you have received it in error, please let us know by reply email, delete it from your system and destroy any copies. ********************************************************************** _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Thu Apr 7 23:15:45 2005 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA05125 for ; Thu, 7 Apr 2005 23:15:45 -0400 (EDT) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJk6v-0005qs-QA for sip-web-archive@ietf.org; Thu, 07 Apr 2005 23:24:47 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJjxN-0007Pr-DL; Thu, 07 Apr 2005 23:14:53 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJjxL-0007Ov-6r for sip@megatron.ietf.org; Thu, 07 Apr 2005 23:14:51 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA05067 for ; Thu, 7 Apr 2005 23:14:48 -0400 (EDT) Received: from sj-iport-1-in.cisco.com ([171.71.176.70] helo=sj-iport-1.cisco.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJk61-0005mg-A2 for sip@ietf.org; Thu, 07 Apr 2005 23:23:49 -0400 Received: from sj-core-1.cisco.com (171.71.177.237) by sj-iport-1.cisco.com with ESMTP; 07 Apr 2005 20:14:41 -0700 X-IronPort-AV: i="3.92,85,1112598000"; d="scan'208"; a="626805417:sNHT36536276" Received: from whoami.cisco.com (IDENT:mirapoint@whoami.cisco.com [64.101.128.102]) by sj-core-1.cisco.com (8.12.10/8.12.6) with ESMTP id j383EbDr011564; Thu, 7 Apr 2005 20:14:37 -0700 (PDT) Received: from kasnarayw2k05 (sjc-vpn2-593.cisco.com [10.21.114.81]) by whoami.cisco.com (MOS 3.4.5-GR) with ESMTP id AHT04757; Thu, 7 Apr 2005 22:14:38 -0500 (CDT) Message-Id: <200504080314.AHT04757@whoami.cisco.com> From: "Kasturi Narayanan" To: "'Paul Kyzivat'" Subject: RE: [Sip] RFC3262 -The Offer/Answer Model and PRACK (question) Date: Thu, 7 Apr 2005 22:14:37 -0500 MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Office Outlook, Build 11.0.5510 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106 Thread-Index: AcU70kXKQ4HiyWNsSl+OYCWPObKPwwAFiTkA In-Reply-To: <4255D0C6.5080606@cisco.com> X-Spam-Score: 0.0 (/) X-Scan-Signature: b7b9551d71acde901886cc48bfc088a6 Content-Transfer-Encoding: 7bit Cc: sip@ietf.org X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: f66b12316365a3fe519e75911daf28a8 Content-Transfer-Encoding: 7bit Thanks Paul for the reply, Even though it is not very convincing that why it should be left as it is, if no reason can be attributed to it and also does not seem right to put across an argument that somehow that requirement can be complied so why undo the mistake. -regards Kasturi -----Original Message----- From: Paul Kyzivat [mailto:pkyzivat@cisco.com] Sent: Thursday, April 07, 2005 7:31 PM To: Kasturi Narayanan Cc: sip@ietf.org Subject: Re: [Sip] RFC3262 -The Offer/Answer Model and PRACK (question) There was a long discussion of this several months ago. I don't know why this requirement is there, and I don't recall that the discussion explained why. As I recall the discussion, the outcome was more or less: That is the way it was specified and it is too late and hard to change. There are ways for everybody to comply, so just do it. I'm sure somebody will correct me if my memory is bad. (I could probably find the thread if I tried hard enough, but I've got other things to do now.) Paul Kasturi Narayanan wrote: > I have a question related to the following sentence in the RFC3262. > > > > Here is the sentence in Section 5 of the RFC 3262 > > > > "Similarly, if a reliable provisional response is the first reliable > message sent back to the UAC, and the > > INVITE did not contain an offer, one MUST appear in that reliable > provisional response." > > > > Why is it made mandatory that, when INVITE(without offer) should always > result in a 18x(with Offer) if 18x is reliably sent? > > > > However in the RFC it is not mandatory to include Answer in 18x if > Invite is sent with an OFFER. > > > > If there are cases where a Sip UAS wants to send 180 Ringing reliably > (without Offer) so that the remote UAC can generate local Ring back and > at the same time wants to send Offer in 200 OK only and get the answer > in ACK only. > > > > Why the above condition is not a valid condition? Please clarify > > > > Thanks > > */Kasturi Narayanan,/* > > */ /* > > > > > ------------------------------------------------------------------------ > > _______________________________________________ > Sip mailing list https://www1.ietf.org/mailman/listinfo/sip > This list is for NEW development of the core SIP Protocol > Use sip-implementors@cs.columbia.edu for questions on current sip > Use sipping@ietf.org for new developments on the application of sip _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Thu Apr 7 23:57:37 2005 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA08766 for ; Thu, 7 Apr 2005 23:57:37 -0400 (EDT) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJklS-0007Nf-Lc for sip-web-archive@ietf.org; Fri, 08 Apr 2005 00:06:39 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJkSX-0003z2-UM; Thu, 07 Apr 2005 23:47:05 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJkSV-0003yx-0X for sip@megatron.ietf.org; Thu, 07 Apr 2005 23:47:03 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA07429 for ; Thu, 7 Apr 2005 23:46:59 -0400 (EDT) Received: from mail1.microsoft.com ([131.107.3.125]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJkbA-0006mH-RQ for sip@ietf.org; Thu, 07 Apr 2005 23:56:01 -0400 Received: from mailout2.microsoft.com ([157.54.1.120]) by mail1.microsoft.com with Microsoft SMTPSVC(6.0.3790.1802); Thu, 7 Apr 2005 20:46:51 -0700 Received: from RED-MSG-52.redmond.corp.microsoft.com ([157.54.12.12]) by mailout2.microsoft.com with Microsoft SMTPSVC(6.0.3790.1824); Thu, 7 Apr 2005 20:46:50 -0700 X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Subject: RE: [Sip] Draft minutes of SIP meeting at IETF 62 Date: Thu, 7 Apr 2005 20:47:20 -0700 Message-ID: Thread-Topic: [Sip] Draft minutes of SIP meeting at IETF 62 Thread-Index: AcU6Zvj2Ln9hWJYxTiyPh3UyFdIeCABhhMog From: "Orit Levin" To: "Dean Willis" , X-OriginalArrivalTime: 08 Apr 2005 03:46:50.0405 (UTC) FILETIME=[98A33D50:01C53BED] X-Spam-Score: 0.0 (/) X-Scan-Signature: d2bb8c7db26f2d12109e0cd8e454db52 Content-Transfer-Encoding: quoted-printable Cc: rohan@ekabal.com, Gonzalo Camarillo , Allison Mankin X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: f251f249fc9a04067ce354aa0943ab98 Content-Transfer-Encoding: quoted-printable The REFER extension topic reads: "Add a new Refer-To header field" According to my understanding it should be: "Add a new header to be used with REFER request and the corresponding response" Comments? Orit. > -----Original Message----- > From: sip-bounces@ietf.org [mailto:sip-bounces@ietf.org] On Behalf Of Dean > Willis > Sent: Tuesday, April 05, 2005 10:20 PM > To: sip@ietf.org > Cc: rohan@ekabal.com; Gonzalo Camarillo; Allison Mankin > Subject: [Sip] Draft minutes of SIP meeting at IETF 62 >=20 > The following are the draft minutes. Please send any required > corrections by COB August 7, 2005. >=20 > Revisions will be posted as processed at: >=20 > http://www.softarmor.com/sipwg/meets/ietf62/notes/minutes-sip-ietf62.htm l >=20 > ----- >=20 > Minutes edited by Dean Willis based on notes by Paul Kyzivat, Spencer > Dawkins, Vijay Gurbani, Amy Pendleton, and Migual Angel Garcia-Martin. >=20 > Monday, 1930-2200 >=20 > Topic: Agenda Bash and Status > by Chairs > Slides presented and to be included in proceedings. >=20 > Agenda accepted as presented. >=20 > Chairs reviewed status of current work. It was noted that the current > charter and milestones are completely obsolete, despite having had > changes submitted several times by the chairs and the ADs. Apparently > there is some sort of process problem with the IETF web site. >=20 >=20 >=20 >=20 > Topic: GRUU Remaining Issues (Knowing AOR, Rewriting by SBC, etc.) > by Jonathan Rosenberg > see draft-ietf-sip-gruu-03.txt > Slides presented and to be included in proceedings. >=20 > Changes to previous doc reviewed. The redundancy issue has been > declared out of scope, and discussion suggested that this should > perhaps be placed into the Jennings "outbound" draft. The current > model assumes that both "sip" and "sips" versions of a GRUU are > created when a GRUU is, and that they route to the same resource. The > URI scheme of the "To:" header is used to select the appropriate > GRUU. It was suggested that this should be clarified in RFC 3261, > perhaps as an errata. >=20 > Several record-routing cases were discussed based on slides. There was > inconclusive discussion of a scenario where the use of GRUU creates an > undesirable "tromboning" effect back to the upstream entity after > resolution >=20 > 1) Open Issue: Discovering AoR from A GRUU >=20 > Discussed issue about getting AOR from gruu - why this is/isn't a > need. Objections were raised to the proposed compromise in the > draft. Various other alternatives discussed. Cullen Jennings didn't > see a compelling reason for it. Paul Kyzivat (who had raised the issue > initially) said he no longer found this a need- solutions other than > GRUU were sufficient. Aki Niemi and Orit Levin still expressed a > desire for this feature. Dean, as chair, said we have no requirement > for this, and a domain can do it anyway if it wants. Inconclusive > discussion followed. >=20 > 2 )Open Issue: relationship of Identity to GRUU >=20 > The relationship between these two elements was discussed without > conclusion, although Jon Peterson (author of the Identity work) > asserted an pinion that a GRUU and an identity are not the same thing. >=20 >=20 >=20 >=20 > Topic: Non-Invite Transactions > by Robert Sparks > see draft-sparks-sip-nit-future-01.txt > Slides were presented and should be included in the proceedings. >=20 > 1) Proposed that we accept and refine Time left concept, and not define > general "Try again later" behavior. This approach uses a new header > indicating how much time the downstream element has left. Adam roach > argued that it was not a good idea - if we don't get any hints from > proxies who are not aware of this extension, we will go round in > circles. Robert called for a hum on if this work should continue or > not. The consensus was for neither the timeline nor the "try again > later" work to continue. >=20 > 2) Proposed that we pursue address success and failure caching. The > goal is to allow next NIT to avoid non-responding address. Question > is how often to probe the non-responding address? No concrete way. > Jonathan Rosenberg proposed that we use Jenning's outbound I-D. Cullen > Jennings stated that this may work for UA - Proxy, but Proxy-Proxy may > not quite work. Robert Sparks proposed that for now we carry a > blacklist; put these addresses in a cache with a timeout (let the > developer determine the timeout). And we continue to pursue Cullen's > outbound I-D as a possible better answer. Discussion followed. The > conclusion was that for now we will use some weighted back to list > algorithm that will be fleshed out on the mailing list. >=20 >=20 >=20 > Topic: REFER Extensions > by Orit Levin > see draft-ietf-sip-refer-with-norefersub-01.txt > Slides were presented that should be included in proceedings. >=20 > Only one open issue remained for the draft since its WGLC. This was > "How does a REFER-Issuer enable the feature?". Alternatives include: > a) Commonly preceded by OPTIONS, b) supported header in the request, > c) required header in the response, d) require header in the request. >=20 > Discussion agreed that the Supported header is the wrong approach, as > it indicates which features are supported by the sender, not required > for the respondent. >=20 > Discussion became prolonged, and the participants were moved to the > hallway for a focused discussion. This discussion reached the > following conclusion: >=20 > 1) Add a new Refer-To header field > 2) Keep option tag > 3) Including this option tag in Require header is NOT RECOMMENDED. >=20 > This conclusion was shared with the WG, and no objections were noted. >=20 > The "hallway" conversation necessitated a slight juggling of the > agenda, with resource Priority being discussed during the hallway > discussion. >=20 >=20 > Topic SIP Resource Priority > by James Polk > See: draft-ietf-sip-resource-priority-06.txt > Slides were presented and should be included in proceedings >=20 > It was noted that this draft is just 2 weeks shy of its 5th > anniversary, making it one of our longer-lived discussions. Changes > since previous version were discussed. The plan of record is to submit > and WGLC a revision of this draft with minor cleanup as proposed > here. The authors requested: "For those who care, please approach us > and let us know of any concerns. If someone can read this as an > innocent bystander and provide comments, please do". >=20 > The chairs polled the room: "Does everyone who cares about this draft > think their issue have essentially been met?" The consensus of the > room was favorable and no issues were raised. It should be noted that > Mike Pierce, a long time participant in this discussion, was not > present as of this poll. >=20 >=20 >=20 > Topic: Request Identity > by Jon Peterson > See: draft-ietf-sip-identity-04.txt > Slides were presented and should be included in the proceedings. >=20 >=20 > New open issues: >=20 > 1) Display name handling - should identity signature > cover the display name? All clients (MS Outlook, > for instance) use the display name, and not the name-addr. >=20 > Jonathan noted that this is usually a good thing; the service provider > bears the burden of coming up with the display name and the client is > provided a bit-by-bit rendering of the display name. Following > discussion indicated a strong consensus to protect the display name if > feasible. >=20 > The consensus was to protect display name, and in the display name, > just put quoted strings and prohibit LWS. In the security section of > the draft there should be a discussion of the disadvantages of > including display names (account minting a la Yahoo!)...) >=20 > 2) Applicability to REGISTER - why provide authentication info to a > authentication server as well as to the registrar? Jonathan Rosenberg > presented an acceptable use case, and the authors concluded that they > would amend the draft to indicate the usability of Identity in > REGISTER transactions. >=20 >=20 >=20 > Topic: Response Identity > by Jon Peterson >=20 > No slides presented. >=20 > Jon lead a discussion about the meaning and critical aspects of > response identity. >=20 > Jon says he has lost his way on this draft. The sip-identity work > doesn't work for responses because of retargeting. Who do responses > actually come from? What are intermediaries allowed to do when > routing SIP requests? How would a UAC make authentication decisions > based on response identity? Anyone can impersonate a requester, but > impersonating a responder is a lot harder - need dialog identifiers, > etc. Improve channel security to make it even harder to impersonate a > responder? Provide causal trace after-the-fact? Let UAC explore new > targets for a request? Assume bar is high enough for impersonators > now? - what if the real responder tries to impersonate someone else? >=20 > Jonathan Rosenberg said major threat is if someone fakes a connected > party id, assuming we had that, and that such is a requirement. Rohan > Mahy thought History-Info is the right solution and said he plans to > write up something about it. >=20 >=20 > Consensus: We're generally headed in the right direction but have a > long way to go. >=20 >=20 >=20 > Topic: Accept-Disposition > by Gonzalo Camarillo > See: draft-camarillo-sip-accept-disposition-00.txt > Slides presented and should be included in proceedings >=20 >=20 > open question: How do we say we don't understand content-disposition? > Add Accept-Disposition (equivalent to Accept header)? We have several > ways to require support for something - method, option tag, body with > handling=3Drequired. Want to pick one and clarify content disposition > handling Combining two problems - Accept is used as hint about how you > goofed. Isn't Warning closer to what we're getting at? Accept headers > became useless because everyone Accept: * (everything). Don't we > really want an explicit code that tells us what we want to know? How > to tell refusal from lack of comprehension? What is scope of > Accept-Disposition? >=20 >=20 > Conclusion: Rather than pursue this approach, for the application > (exploder) that stimulated this draft there was a decision to use an > option tag to negotiate support for the needed combination of > features. >=20 > Separately, there was interest by some (at least Gonzalo and Paul) in > starting to investigate the underspecification of Content-Disposition. >=20 >=20 >=20 >=20 >=20 > Tuesday, 1300-1500 >=20 >=20 > Agenda by Chairs Agenda accepted as proposed in slides. The proposed > topic of "Connection Reuse" was withdrawn by author Rohan Mahy. If > time allows, a discussion of retargeting led by Jon Peterson will be > undertaken. >=20 >=20 >=20 > Topic: SIP Interaction Framework > by Jonathan Rosenberg > See: draft-ietf-sipping-app-interaction-framework-04.txt > Slides presented and should be included in proceedings >=20 > The current state of the draft has raised a requirement for other work > that Jonathan calls the "target dialog" approach and has fleshed > out. Discussion of this approach ensued. Alan Johnston noted that an > option tag is needed. Robert Sparks spoke in favor of the > approach. Following discussion, the chairs polled the room and a > consensus to proceed with this approach was reported. The chairs are > instructed to work with the Area Director to add the target dialog > draft to the working group charter. >=20 >=20 > Topic; Management of Outbound Connections > by Cullen Jennings > See: draft-jennings-sipping-outbound-01.txt > Slides were presented and should be included in proceedings >=20 > Open issue: Do we need an option tag to know if registrar supports > flow-id and if UA supports this. Rohan argued against the option > tag. Jonathan proposed that it would be needed it in the Require in > the REGISTER. Rohan countered that one could check in the response > what it came back, and perhaps add a Contact header field parameter to > discover if the functionality is supported by the registrar. Alan H. > noted that if the registrar does not support the functionality, you > end up with a wrong binding that you have to fix later. >=20 > After discussion, there were no sustained objections to adding an > option tag, and a quick poll indicated consensus for this > approach. Cullen agreed to make this change in the next revision. >=20 >=20 > Topic: Using Certificates with SIP > by Cullen Jennings > see draft-ietf-sipping-certs-01.txt > Slides were presented and should be included in proceedings >=20 > 1) Robert Sparks commented that the draft needs further text about > caching certs, and checking certificate revocation. >=20 > 2) Jon Peterson suggested that we make sure to clarify subscription > duration, which Cullen noted should not cache beyond validity time >=20 > 3) Rohan observed that we need to refresh the subscription even if the > cert is still is valid, when there hasn't been a NOTIFY for some long > period of time. >=20 > 4) Francois Audet noted issues with retargeting and forking. For > example,the sales group example does not work properly. An other case > is retargeting. Use case: the help desk. You don't care who is going > to answer, but the requirement is the conversation to be > encrypted. Cullen observed that the assumption of this draft is indeed > that all devices for the ID have the same credentials. Jon Peterson > suggested that RFC 3261 with SIPS resolves theses cases. Cullen > observed that there are separate problems: a) to determine who the > certificate belongs to, and b) acquiring the certs. This draft > addresses only b. It was resolved that the scope of the draft should > be clarified, and that we should change the name to "credential > management" instead of "certificate management". >=20 > 5) Jonathan asked:"What happens if I send a SUBSCRIBE for a GRUU? Do I > get the cert for the AOR?" Cullen responded that the draft discusses > users, not devices. Jon Peterson stated that this problem should be > resolved in the identity draft, not here. >=20 >=20 >=20 > Topic: End-to-middle security > by Kumiko Ono > see draft-ono-sipping-end2middle-security-04.txt > Slides were presented and should be included in proceedings >=20 > Chairs noted that they expect this work to migrate from SIPPING to SIP > fairly soon, as has gone beyond the requirements consensus and into > implementation. >=20 > 1) Open issue: Signatures inside, encryption outside or the other way > around? >=20 > Jon reported that we did some analysis about this when drafting RFC > 3261, and think the signature should go inside, the encryption > outside. Cullen believes that signature inside the encrypting part > will give better security properties (from the security group). > Catherine also stated that the crypto community thinks signature > inside is generally better, although there are sometimes exceptions. >=20 > Conclusion: consensus to have signature inside. >=20 > 2 )Open issue: How a proxy can tell a UA to disclose a body while > protecting data integrity? >=20 > Options include new error response, existing resp with warning header, > or existing resp instruct UA one task at a time. >=20 >=20 > James Polk asked if we could use CID and Reason header? Jon Peterson > noted that CID is valid is the scope is a partial body of the > multipart, but if you talk about the whole body, you don't need a CID. >=20 > Dean asked: can the proxy request a body? Jon responded: if it is > undecipherable, how can it point to one body? The proxy only knows the > whole multipart body, not the individual parts. It is better to do it > at the high level -- the proxy says I need to read this body, without > indicating which one. >=20 > Dean and Jonathan noted that Content-Disposition may also be applicable. >=20 > No conclusion noted for this issue. >=20 >=20 > Chairs Poll: This is a proposal for an implementation of the > end-to-middle requirements established by SIPPING. Do we wish to adopt > this as a working group item? A consensus in favor of adoption was > reported, and the chairs are instructed to work with the D to get this > item added to the SIP WG milestone list. >=20 >=20 >=20 > Topic: Extension Negotiation > by Volker Hilt > See: draft-hilt-sip-ext-neg-00.txt >=20 > Slides were presented and should be included in the proceedings. >=20 > Discussion followed. >=20 > Paul K noted that this aggregates on not being clear of what is the > scope of what an Accept header is. Does it apply to OPTIONS? Severe > discussion about when to include or not the Accept header, in which > methods. Jonathan replied: There is not a not clear answer, but > interoperability is maximized when you put everything you support in > the header. OPTIONS carries a permanent scope: this is what I support. > Gonzalo observed that, at the end of the day what we want to disclose > is the desired Content-Disposition. Dean also observed that RFC 3261 > scopes the Accept header to the duration of a dialog and that RFC 3264 > scopes the Accept header for the duration of a SUBSCRIBE dialog. >=20 > Dean suggested that this would be a good time time to have guidelines > for Accept headers. Cullen and Jonathan maintain that it is simpler to > populate the Accept header with everything that is supported, even if > this set becomes very large. >=20 > Jonathan clarifies that the use case is when the server can provide an > alternative extension in case the client does not support a given > extension. The example: if the presence server knows that the client > does not support RPID, then the server might put the contents of > activity elements in note elements. >=20 > Adam noted that there is currently no way for the server to determine > that something is not supported at the client. >=20 > There does not seem to be a clear path forward, and we should perhaps > look more closely at use cases. >=20 >=20 >=20 > Topic: Retargeting > by Jon Peterson > Slides presented and should be included in proceedings. >=20 > Discussion followed. >=20 > Rohan Mahy observed that sometimes an unanticipated respondent is a > desirable outcome. And sometimes it isn't. >=20 > Keith Drage proposed that response identity should be connected party > ID. >=20 >=20 > Jon observed that the response identity problem is defined as the > ability from the UAC to determine that the response came from an > impersonator. Implementation of connected party is likely to occur > security problems, and a UAC doing wrong authorizations. >=20 > Jonathan suggested that we reduce the scope of the requirements to > something that we can solve today. There are other harder problems > that we can't solve today. >=20 > Jon proposed that we need to solve the problem that ends up in SRTP, > starting from SIP identity, SIP certs, Mikey, SRTP. >=20 > Discussion of endpoint vs proxy trust followed, with the general > consensus being that, at least to some extent, proxies must be > trusted, because "the SIP proxy allocates you with a SIP URI and can > take it out of you at any time". >=20 > Jon proposed that we takes this work as an informational document in > SIPPING discussing the kind of attacks. >=20 > Jonathan noted that we need to update the SIPS behavior in SIP, there > are a few open holes. >=20 > Jon restated that the scope of this work is to detect that there has > been a retargeting, not to prevent that retargeting to happen. >=20 > No further conclusions were noted. >=20 >=20 > The meeting of the SIP working group concluded on schedule. >=20 >=20 >=20 > _______________________________________________ > Sip mailing list https://www1.ietf.org/mailman/listinfo/sip > This list is for NEW development of the core SIP Protocol > Use sip-implementors@cs.columbia.edu for questions on current sip > Use sipping@ietf.org for new developments on the application of sip _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Fri Apr 8 01:41:16 2005 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA15114 for ; Fri, 8 Apr 2005 01:41:16 -0400 (EDT) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJmNk-0001wi-JN for sip-web-archive@ietf.org; Fri, 08 Apr 2005 01:50:16 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJmDn-0005At-NJ; Fri, 08 Apr 2005 01:39:59 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJmDm-0005Ak-0y for sip@megatron.ietf.org; Fri, 08 Apr 2005 01:39:58 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA15002 for ; Fri, 8 Apr 2005 01:39:57 -0400 (EDT) Received: from motgate6.mot.com ([144.189.100.106]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJmMK-0001tn-AL for sip@ietf.org; Fri, 08 Apr 2005 01:48:48 -0400 Received: from il06exr02.mot.com (il06exr02.mot.com [129.188.137.132]) by motgate6.mot.com (Motorola/Motgate6) with ESMTP id j385dklN029958 for ; Thu, 7 Apr 2005 22:39:46 -0700 (MST) Received: from zin24exm01.ap.mot.com (zin24exm01.ap.mot.com [10.232.25.1]) by il06exr02.mot.com (8.13.1/8.13.0) with ESMTP id j385ff4W015302 for ; Fri, 8 Apr 2005 00:41:42 -0500 (CDT) Received: by zin24exm01.ap.mot.com with Internet Mail Service (5.5.2657.72) id <2KKYHBKD>; Fri, 8 Apr 2005 11:09:38 +0530 Message-ID: <772BCEF88A1DD91191F80011856715F302586695@zin24exm01.ap.mot.com> From: Chadha Retesh-A19894 To: Kasturi Narayanan , "'Paul Kyzivat'" Subject: RE: [Sip] RFC3262 -The Offer/Answer Model and PRACK (question) Date: Fri, 8 Apr 2005 11:09:36 +0530 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2657.72) Content-Type: text/plain X-Spam-Score: 0.0 (/) X-Scan-Signature: 1676547e4f33b5e63227e9c02bd359e3 Cc: sip@ietf.org X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 6ffdee8af20de249c24731d8414917d3 I think the requirement in RFC3262, just comes from the following rule in RFC3261... o The initial offer MUST be in either an INVITE or, if not there, in the first reliable non-failure message from the UAS back to the UAC. In this specification, that is the final 2xx response. In rfc3262, the first reliable message is 1xx... So, what should be questioned is that why RFC 3261 wants the offer to be sent in the first reliable response... I think this is probably because, it wants the 2 Uas to know each other capabilities as early as possible, may be for early media, or for say rejecting the call earlier than 200 ok in case capabilities are not supported.. not sure, if this is correct. Rgds Retesh -----Original Message----- From: sip-bounces@ietf.org [mailto:sip-bounces@ietf.org] On Behalf Of Kasturi Narayanan Sent: Friday, April 08, 2005 8:45 AM To: 'Paul Kyzivat' Cc: sip@ietf.org Subject: RE: [Sip] RFC3262 -The Offer/Answer Model and PRACK (question) Thanks Paul for the reply, Even though it is not very convincing that why it should be left as it is, if no reason can be attributed to it and also does not seem right to put across an argument that somehow that requirement can be complied so why undo the mistake. -regards Kasturi -----Original Message----- From: Paul Kyzivat [mailto:pkyzivat@cisco.com] Sent: Thursday, April 07, 2005 7:31 PM To: Kasturi Narayanan Cc: sip@ietf.org Subject: Re: [Sip] RFC3262 -The Offer/Answer Model and PRACK (question) There was a long discussion of this several months ago. I don't know why this requirement is there, and I don't recall that the discussion explained why. As I recall the discussion, the outcome was more or less: That is the way it was specified and it is too late and hard to change. There are ways for everybody to comply, so just do it. I'm sure somebody will correct me if my memory is bad. (I could probably find the thread if I tried hard enough, but I've got other things to do now.) Paul Kasturi Narayanan wrote: > I have a question related to the following sentence in the RFC3262. > > > > Here is the sentence in Section 5 of the RFC 3262 > > > > "Similarly, if a reliable provisional response is the first reliable > message sent back to the UAC, and the > > INVITE did not contain an offer, one MUST appear in that reliable > provisional response." > > > > Why is it made mandatory that, when INVITE(without offer) should > always > result in a 18x(with Offer) if 18x is reliably sent? > > > > However in the RFC it is not mandatory to include Answer in 18x if > Invite is sent with an OFFER. > > > > If there are cases where a Sip UAS wants to send 180 Ringing reliably > (without Offer) so that the remote UAC can generate local Ring back and > at the same time wants to send Offer in 200 OK only and get the answer > in ACK only. > > > > Why the above condition is not a valid condition? Please clarify > > > > Thanks > > */Kasturi Narayanan,/* > > */ /* > > > > > ---------------------------------------------------------------------- > -- > > _______________________________________________ > Sip mailing list https://www1.ietf.org/mailman/listinfo/sip > This list is for NEW development of the core SIP Protocol > Use sip-implementors@cs.columbia.edu for questions on current sip Use > sipping@ietf.org for new developments on the application of sip _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Fri Apr 8 09:11:23 2005 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA15883 for ; Fri, 8 Apr 2005 09:11:22 -0400 (EDT) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJtPP-0004dC-G3 for sip-web-archive@ietf.org; Fri, 08 Apr 2005 09:20:27 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJtFo-0006r2-K4; Fri, 08 Apr 2005 09:10:32 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJtFm-0006qk-Mm for sip@megatron.ietf.org; Fri, 08 Apr 2005 09:10:30 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA15742 for ; Fri, 8 Apr 2005 09:10:29 -0400 (EDT) Received: from sj-iport-3-in.cisco.com ([171.71.176.72] helo=sj-iport-3.cisco.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJtOX-0004b3-V3 for sip@ietf.org; Fri, 08 Apr 2005 09:19:34 -0400 Received: from sj-core-2.cisco.com (171.71.177.254) by sj-iport-3.cisco.com with ESMTP; 08 Apr 2005 06:10:21 -0700 X-IronPort-AV: i="3.92,87,1112598000"; d="scan'208"; a="247533011:sNHT37585680" Received: from flask.cisco.com (IDENT:mirapoint@flask.cisco.com [161.44.122.62]) by sj-core-2.cisco.com (8.12.10/8.12.6) with ESMTP id j38DA5gE003843; Fri, 8 Apr 2005 06:10:06 -0700 (PDT) Received: from cisco.com ([161.44.79.173]) by flask.cisco.com (MOS 3.4.6-GR) with ESMTP id AQL81268; Fri, 8 Apr 2005 09:10:09 -0400 (EDT) Message-ID: <425682B1.6000002@cisco.com> Date: Fri, 08 Apr 2005 09:10:09 -0400 From: Paul Kyzivat User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.1) Gecko/20020826 X-Accept-Language: en-us, en MIME-Version: 1.0 To: Wayne.Davies@mmv.vic.gov.au Subject: Re: [Sip] Re: [Sip-implementors] Session Timer: UAC populating the refresher parameter References: Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Score: 0.0 (/) X-Scan-Signature: 21bf7a2f1643ae0bf20c1e010766eb78 Content-Transfer-Encoding: 7bit Cc: IETF SIP List , "Sip-implementors@cs.columbia.edu" X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 6ba8aaf827dcb437101951262f69b3de Content-Transfer-Encoding: 7bit Wayne.Davies@mmv.vic.gov.au wrote: > > > > Paul, > Let me start by saying that I agree that the simplest implementation > (preferred) would be to leave the refresher parameter not specificied in > the request, it is what is recommended in the draft. But I do not think > specifying the refresher in the request is stupid and to me it seems > clearly allowed in the draft. I'm not saying that setting the refresher parameter in the request is stupid in general. I am saying that setting the the *uac* setting the refresher parameter to *uas* is contrary to the spirit, if not the letter, of the spec, so doing *that* is stupid. > Leaving the refresher unspecified in the request is deemed > 'negotiation' but the UAS can set the refresher in the response to either > UAC or UAS, The UAS has the information to know that the UAC is capable of carrying out the task - it has been presented with an option and the ability to choose. The same situation does not hold for the UAC - it has no way of knowing if the UAS will be capable of carrying out the task. If it were legal for the UAC to do this (specify UAS as refresher), then in cases where the UAS is incapable of this the negotiation would fail, even though the UAC is presumably capable (though not desiring) of doing so. By doing this, if it is considered legal, the UAC is saying "I understand session timer, I would like session timer to be used, but I am unwilling to be responsible for doing it and would rather not have it than take responsibility for doing it." > so it is set by local policy at the UAS yeah ?, which is not > really a negotiation it is just letting the other guy choose. No, it is more complex than that. The interesting case is when only one end is capable of doing it, but somebody in the middle wants it. In that case, the guy in the middle gets to choose. > Both UAC and UAS that support session timer are to be capable of > performing the session refreshes so I don't really see the harm. The > behaviour in section 8.2 queried below does indeed seem to sort itself out > for the given scenario. Something people keep forgetting (or don't realize) is that session timer is of no particular benefit to UAs - it is there for the benefit of proxies that record-route and need a way of knowing that the dialog has not died. In the absence of a proxy that cares, UAs are free to test liveness of the dialog any time they want, by sending a request in the dialog. So there is no good reason for a UA to propose use of session timer on its own. Cases of importance are: - proxy wants, uac & uas support => uas choses who does - proxy wants, uac support, uas doesn't => proxy nominates uac - proxy wants, uac doesn't support, uas does => proxy nominates uas - proxy wants, neither uac nor uas support => doesn't happen The case being discussed here adds another case: - uac wants uas to do, proxy wants, uas doesn't do => doesn't happen Paul > Regards - Wayne. > > >>I think the implementation is just being stupid. >> >>The whole point is to negotiate who does refreshes, so you discover >>someone who can if there is anybody who can. Declaring that the other >>guy should do it violates that. So I think this is clearly not within >>the intent of the spec, even if the wording could be better. >> >> Paul >> >>Hisham Khartabil wrote: >> >>>This came up at sipit 16. >>> >>>draft-ietf-sip-session-timer-15.txt says in section 7.1: >>> >>>"The UAC MAY include the refresher parameter with value 'uac' if it >>> wishes to perform the refreshes. However, it is RECOMMENDED that the >>> parameter be omitted, so that it can be selected by the negotiation >>> mechanisms described below." >>> >>>I came across an implantation that sets the refresher parameter to 'uas' >> > >>>when initiating the INVITE. The claim was that the draft does not >>>explicitly forbid that. >>> >>>The problem with that is: what if the UAS does not support session >>>timer. The spec says in section 8.2 (proxy processing responses) >>> >>>"If, however, the proxy remembers that the UAC did >>> support session timer, additional processing is needed. >>> >>> Because there is no Session-Expires or Require header field in the >>> response, the proxy knows it is the first session-timer-aware proxy >>> to receive the response. This proxy MUST insert a Session-Expires >>> header field into the response with the value it remembered from the >>> forwarded request." >>> >>>Some proxies may interpret that to mean the whole value, including the >>>refresher parameter that contained 'uas' which will cause all sorts of >>>funny things to happen. >>> >>>Now, the draft does go on to say >>> >>>" It (the proxy) MUST set the value of the 'refresher' >>> parameter to 'uac'." >>> >>>so the problem my fix itself, but i think we need to clarify this: >>>either say that the UAC MUST NOT set the refresh parameter to 'uas' >>>(which is what I prefer) or add some text clarifying the scenario and >>>behaviour for proxies. >>> >>>Regards, >>>Hisham >>> >>>_______________________________________________ >>>Sip-implementors mailing list >>>Sip-implementors@cs.columbia.edu >>>http://lists.cs.columbia.edu/mailman/listinfo/sip-implementors >>> >> > > _______________________________________________ > Sip mailing list https://www1.ietf.org/mailman/listinfo/sip > This list is for NEW development of the core SIP Protocol > Use sip-implementors@cs.columbia.edu for questions on current sip > Use sipping@ietf.org for new developments on the application of sip > > ********************************************************************** > Any personal or sensitive information contained in this email and > attachments must be handled in accordance with the Victorian Information > Privacy Act 2000, the Health Records Act 2001 or the Privacy Act 1988 > (Commonwealth), as applicable. > > This email, including all attachments, is confidential. If you are not the > intended recipient, you must not disclose, distribute, copy or use the > information contained in this email or attachments. Any confidentiality or > privilege is not waived or lost because this email has been sent to you in > error. If you have received it in error, please let us know by reply > email, delete it from your system and destroy any copies. > ********************************************************************** > _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Fri Apr 8 09:38:55 2005 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA19375 for ; Fri, 8 Apr 2005 09:38:55 -0400 (EDT) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJtq4-0006LS-H4 for sip-web-archive@ietf.org; Fri, 08 Apr 2005 09:48:01 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJtTv-0002OX-A4; Fri, 08 Apr 2005 09:25:07 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJtTs-0002OJ-A0 for sip@megatron.ietf.org; Fri, 08 Apr 2005 09:25:04 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA17118 for ; Fri, 8 Apr 2005 09:25:02 -0400 (EDT) Received: from goliath.siemens.de ([192.35.17.28]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJtcd-0005P8-4C for sip@ietf.org; Fri, 08 Apr 2005 09:34:07 -0400 Received: from mail2.siemens.de (mail2.siemens.de [139.25.208.11]) by goliath.siemens.de (8.12.6/8.12.6) with ESMTP id j38DOjtv003662; Fri, 8 Apr 2005 15:24:45 +0200 Received: from mchp9daa.mch.sbs.de (mchp9daa.mch.sbs.de [139.25.137.99]) by mail2.siemens.de (8.12.6/8.12.6) with ESMTP id j38DOiu4010352; Fri, 8 Apr 2005 15:24:44 +0200 Received: by mchp9daa.mch.sbs.de with Internet Mail Service (5.5.2657.72) id <2A160B36>; Fri, 8 Apr 2005 15:24:44 +0200 Message-ID: From: Fries Steffen To: Francois Audet , "'Peterson, Jon'" , "'fluffy@cisco.com'" Subject: RE: [Sip] RE: Question to Identity draft Date: Fri, 8 Apr 2005 15:24:38 +0200 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2657.72) Content-Type: text/plain X-Spam-Score: 0.8 (/) X-Scan-Signature: fe105289edd72640d9f392da880eefa2 Cc: "'IETF SIP List'" X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org X-Spam-Score: 0.8 (/) X-Scan-Signature: 343d06d914165ffd9d590a64755216ca Hi Francois, > This would also allow for supporting sRTP to unanticipated > respondents. > > Note: I will point out that MIKEY allows for this today > because the certificates > can be included in the MIKEY message. Not so for SDESC. > If we "pop up 2 levels" > the certificates to the SIP level (instead of inside > MIKEY inside SDP in SIP), then > we could have a solution that would work for both > mechanisms, allowing a UAC to > advertize support for both mechanism. You could use > S/MIME with both mechanisms. You could provide your certificates also as part of the S/MIME body. We discussed that in a parallel threat. The only thing, that I'm not convinced with is, if it is possible to use certificates, which are not directly related to the FROM field in terms of a user name but a machine name for instance. As far as I understand RFC3261, the subject name should correspond to what is signaled in the FROM (AoR)field. That was actually my though to use the authentication service of the identity draft to associate the AoR with the certificate used for the session. Regards Steffen > > > > > > -----Original Message----- > > From: Peterson, Jon [mailto:jon.peterson@neustar.biz] > > Sent: Wednesday, April 06, 2005 12:39 > > To: Audet, Francois [SC100:9T51:EXCH]; Fries Steffen; > fluffy@cisco.com > > Cc: IETF SIP List > > Subject: RE: [Sip] RE: Question to Identity draft > > > > > > > > I agree that the problems you describe below are all retargeting > > problems. The retargeting draft > (peterson-sipping-retarget-00 Section > > 2.3) notes that this problem applies to the RFC3261 INVITE-like > > certificate exchange mechanism. All in all, though, I'm pretty sure > > that these sorts of problems are more tractable in a SUBSCRIBE-like > > model for certificate acquisition than they are in an INVITE-like > > model for certificate acquisition. > > > > In an INVITE-like model, you are sending the content that > you want to > > encrypt - that is, a session request - to an > unanticipatable target. > > In a SUBSCRIBE-like model, you are merely sending a request for a > > certificate to an unanticipatable target. The second is at least > > superficially better. If you strip everything out of the > INVITE that > > might be considered sensitive before you send your request, in the > > hopes of just soliciting a certificate in a response, then > basically > > you are using the INVITE as a makeshift fetch. > > Using SUBSCRIBE has decided advantages over a fetch - > namely, you can > > establish persistent relationships and get notifications when the > > target's certificate changes. > > > > Speaking at a high level, there is no technical reason why a > > subscription to a certificate service could not be > > redirected/retargeted or somehow trickle down to the right > service for > > the apparently destination of the call. The tough part, of > course, is > > synchronizing the path traversed by the subscription with the path > > that would be traveled by an INVITE, so that the > certificate held by > > the UAC will always correspond with the appropriate UAS > target. I can > > imagine publication models, though, in which users publishing > > certificates to a certificate service will cause the cert to > > propagate, through multiple publications, to where it needs > to go for > > the purposes of certificate acquisition. There are also > possible ways > > this could be addressed with presence. > > > > So, regardless of whether or not sipping-certs solves all of the > > conceivable problems, I think it's a more promising direction than > > INVITEs. Of course, if a UA for whatever reason receives a request > > that is undecipherable, it can reply with a 493 Undecipherable > > message, as decribed in RFC3261, and return its certificate in that > > response. So, I think the functionality that you describe > at the end > > of your message is indeed already available in RFC3261. The issues > > rasied in the sipping-retargeting draft, though, illustrate > why this > > might not be sufficient. To address those sorts of > problems, I think > > you'll need something closer to sipping-certs. > > > > Jon Peterson > > NeuStar, Inc. > > > > -----Original Message----- > > From: Francois Audet [mailto:audet@nortel.com] > > Sent: Tuesday, April 05, 2005 5:04 PM > > To: Peterson, Jon; 'Fries Steffen'; 'fluffy@cisco.com' > > Cc: 'IETF SIP List' > > Subject: RE: [Sip] RE: Question to Identity draft > > > > > > There is still many cases where the sipping-certs does not work > > properly, which I think could be addressed by something along the > > lines of sip-identity and what Steffen is talking about. > > I think it would complement sipping-certs very well. > > For example, it is often not the case that sipping-certs > will be able > > to fetch the certificate of the UA that will answer the > session. For > > example: > > - The target corresponds to a group of people, say in > > a call center, a hunt group or something along those > > lines. In many cases, it may not be feasible, or > > even desireable that all these people share the same > > certificate. > > - Retargeting will also not work. By retargetting, I am > > including any time of forking, forwarding and so forth > > where the targets correspond to people with different > > certificates. > > - The target is a "moving target". For example, it could > > be a bank of gateways, media servers, IVR systems or > > whatever. > > (I guess all those cases are a form of retargeting because the > > responder is not who was in the initial request). > > In those cases, you can send SUBSCRIBEs as much as you > want, but you > > won't get a usable certificate because the INVITE after the > SUBSCRIBE > > is not going to land at the same place. > > If instead something along lines of sip-indentity was used (even in > > conjunction with sipping-certs), I think we can get rid of the > > bootstrap problem you refer to, by having a two-pass process. > > What I am pointing out is the bootstrap problem may exist > as well with > > sipping-certs. In fact, it can be worst in the sense that > it would get > > in an infinite loop of retrying because the target keeps on moving. > > Assume A always includes it's certificate when it calls B. > > If A had access to B's certificate beforehand (using > certs), then no > > problem. It works exactly as per sipping-certs. > > If A couldn't get access to B's certificate beforehand, or > if it turns > > out to be the wrong B, then B would receive the request, > but the key > > (as per your example) would be wrong. B should be able to > provide it's > > certificate to A in the same session, so that the session could be > > renegotiated (if A whishes to do so). > > For example, I can think of the following mechanism: > > - B rejects the request with error code XXX and includes it's > > certificate > > in the response. B also includes a Contact. > > - A examines the certificate (and Contact), and determine > if it will > > re-initiate the request or not, based on it's own local criteria > > (is C already trusted, etc.). > > > > One use case of course for this is encryption (sRTP). It would work > > equally well with SDESC and with MIKEY/kmgmt. > > > > > > > > > -----Original Message----- > > > From: sip-bounces@ietf.org [mailto:sip-bounces@ietf.org] > On Behalf > > > Of Peterson, Jon > > > Sent: Tuesday, April 05, 2005 14:20 > > > To: Fries Steffen; fluffy@cisco.com > > > Cc: IETF SIP List > > > Subject: [Sip] RE: Question to Identity draft > > > > > > > > > > > > Your question points to an important difference in applicability > > > between sip-identity-04 and sipping-certs-01, and it is > essentially > > > a matter of what you mean by "communicate securely". > > > > > > The primary differences between sip-identity-04 and > > > sipping-certs-01 lie in what they require user agents to > support and > > > what security services they offer. > > > sip-identity-04 offers an integrity and replay protection > service, > > > whereas sipping-certs-01 offers a full suit of MIME security > > > services including confidentiality (the cost of course being that > > > UAs must support S/MIME and the certificate acquisition service). > > > > > > The method of exchanging certificates within SIP messages > which you > > > describe below was subtantially documented in RFC3261. There's no > > > doubt the integrity provided by > > > sip-identity-04 could help to secure certificates > exchanged in this > > > manner. But the question is what security properties you want to > > > derive from this practice. If you want to use the exchanged > > > certificates for integrity, then well, > > > sip-identity-04 already provides integrity. If you want > to use the > > > exchanged certificates for confidentiality, then you get the > > > bootstrapping problem - how does the sender of the INVITE > learn the > > > key they must use to encrypt the body of their request? > This is the > > > purpose of the certificate server, and of > sipping-certs-01. I doubt > > > that exchanging certificates within INVITEs and so on will prove > > > more servicable. > > > > > > Jon Peterson > > > NeuStar, Inc. > > > > > > > -----Original Message----- > > > > From: Fries Steffen [mailto:steffen.fries@siemens.com] > > > > Sent: Tuesday, April 05, 2005 3:04 AM > > > > To: Peterson, Jon; fluffy@cisco.com > > > > Cc: IETF SIP List > > > > Subject: Question to Identity draft > > > > > > > > > > > > Hi Jon, hi Cullen, > > > > > > > > by reading the IDs regarding enhanced identity management > > > > (draft-ietf-sip-identity-04) and certificate management > > > > (draft-ietf-sipping-certs-01) I've got a question to a possible > > > > use case. > > > > > > > > Assumed that two user A and B from two different > domains X and Y > > > > want to communicate securely. User A sends his INVITE with an > > > > attached certificate to User B in domain Y. The INVITE is send > > > > through an authentication service, which authenticates > (according > > > > the identity draft) that the AOR matches the FROM field. > > > > Additionally a digital signature is calculated also > over the body > > > > of the message. Thus also the attached certificate is signed. > > > > Using this approach would assure User B that User A has > > > registered with his > > > > credentials in domain X. User B could then use the received > > > > certificate to communicate securely with user A at > least for the > > > > duration of the session. > > > > User B may also send his certificate to user B also through an > > > > authentication service. Within a next session, when both > > users newly > > > > registered, the certificates may be different than in > the session > > > > before. > > > > > > > > Is this scenario somehow covered by the identity draft? > It could > > > > save the credential server in certain scenarios. The approach > > > > itself may require an enhanced storing of the username and > > > > certificate associations if non-repudiation is desired. > > > > > > > > Regards > > > > Steffen > > > > > > > > > > _______________________________________________ > > > Sip mailing list https://www1.ietf.org/mailman/listinfo/sip > > > This list is for NEW development of the core SIP Protocol Use > > > sip-implementors@cs.columbia.edu for questions on current sip Use > > > sipping@ietf.org for new developments on the application of sip > > > > > > > > > > > > _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Fri Apr 8 11:58:18 2005 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA06371 for ; Fri, 8 Apr 2005 11:58:18 -0400 (EDT) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJw0z-0005C1-JK for sip-web-archive@ietf.org; Fri, 08 Apr 2005 12:07:25 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJvkF-0005Ds-Oe; Fri, 08 Apr 2005 11:50:07 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJvkC-0005Dd-A4 for sip@megatron.ietf.org; Fri, 08 Apr 2005 11:50:04 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA05331 for ; Fri, 8 Apr 2005 11:50:02 -0400 (EDT) Received: from zrtps0kp.nortelnetworks.com ([47.140.192.56]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJvsv-0004e5-TG for sip@ietf.org; Fri, 08 Apr 2005 11:59:09 -0400 Received: from zrtpd0jn.us.nortel.com (zrtpd0jn.us.nortel.com [47.140.202.35]) by zrtps0kp.nortelnetworks.com (Switch-2.2.6/Switch-2.2.0) with ESMTP id j38FnZH05661; Fri, 8 Apr 2005 11:49:35 -0400 (EDT) Received: by zrtpd0jn.us.nortel.com with Internet Mail Service (5.5.2653.19) id <2KL1SRQ3>; Fri, 8 Apr 2005 11:49:35 -0400 Message-ID: <1ECE0EB50388174790F9694F77522CCF01E3965A@zrc2hxm0.corp.nortel.com> From: "Francois Audet" To: "'Fries Steffen'" , "'Peterson, Jon'" , "'fluffy@cisco.com'" Subject: RE: [Sip] RE: Question to Identity draft Date: Fri, 8 Apr 2005 11:48:51 -0400 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2653.19) X-Spam-Score: 0.5 (/) X-Scan-Signature: d0bdc596f8dd1c226c458f0b4df27a88 Cc: "'IETF SIP List'" X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============1955898237==" Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: a2c12dacc0736f14d6b540e805505a86 This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. --===============1955898237== Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C53C52.76D5A0EB" This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. ------_=_NextPart_001_01C53C52.76D5A0EB Content-Type: text/plain > You could provide your certificates also as part of the > S/MIME body. We discussed that in a parallel threat. Right: that's what I was alluding to. > The only > thing, that I'm not convinced with is, if it is possible to > use certificates, which are not directly related to the FROM > field in terms of a user name but a machine name for > instance. As far as I understand RFC3261, the subject name > should correspond to what is signaled in the FROM (AoR)field. > That was actually my though to use the authentication service > of the identity draft to associate the AoR with the > certificate used for the session. Good: that was also my tought. That makes sense for the sender certificate. An alternative would be that the subject in the certificate would supercede the one in the From field. In the identity draft, there is some hint of that in the last paragraph of section 2.2 with regards to the receiver certificate (connected party) "clobbering the value in the To header". ------_=_NextPart_001_01C53C52.76D5A0EB Content-Type: text/html RE: [Sip] RE: Question to Identity draft

> You could provide your certificates also as part of the
> S/MIME body. We discussed that in a parallel threat.

Right: that's what I was alluding to.

> The only
> thing, that I'm not convinced with is, if it is possible to
> use certificates, which are not directly related to the FROM
> field in terms of a user name but a machine name for
> instance. As far as I understand RFC3261, the subject name
> should correspond to what is signaled in the FROM (AoR)field.
> That was actually my though to use the authentication service
> of the identity draft to associate the AoR with the
> certificate used for the session.

Good: that was also my tought. That makes sense for the sender
certificate. An alternative would be that the subject in the certificate
would supercede the one in the From field.

In the identity draft, there is some hint of that in the last paragraph
of section 2.2 with regards to the receiver certificate (connected
party) "clobbering the value in the To header".

------_=_NextPart_001_01C53C52.76D5A0EB-- --===============1955898237== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline Content-Transfer-Encoding: 7bit _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip --===============1955898237==-- From sip-bounces@ietf.org Fri Apr 8 15:58:13 2005 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA06105 for ; Fri, 8 Apr 2005 15:58:13 -0400 (EDT) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJzlB-0002q0-Bs for sip-web-archive@ietf.org; Fri, 08 Apr 2005 16:07:22 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJzZW-0002y1-Ap; Fri, 08 Apr 2005 15:55:18 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJzZU-0002wm-GJ for sip@megatron.ietf.org; Fri, 08 Apr 2005 15:55:16 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA04935 for ; Fri, 8 Apr 2005 15:55:14 -0400 (EDT) Received: from oak.neustar.com ([209.173.53.70]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJziH-0002OS-3f for sip@ietf.org; Fri, 08 Apr 2005 16:04:23 -0400 Received: from stntsmtp1.cis.neustar.com (smartexch.neustar.com [10.31.13.79]) by oak.neustar.com (8.12.8/8.11.0) with ESMTP id j38JrpKD011724; Fri, 8 Apr 2005 19:53:51 GMT Received: from stntexch03.cis.neustar.com ([10.31.13.45]) by stntsmtp1.cis.neustar.com with Microsoft SMTPSVC(6.0.3790.211); Fri, 8 Apr 2005 15:53:51 -0400 X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Subject: RE: [Sip] sip-identity-05: display-name woes Date: Fri, 8 Apr 2005 15:53:50 -0400 Message-ID: <24EAE5D4448B9D4592C6D234CBEBD59701502E19@stntexch03.cis.neustar.com> Thread-Topic: [Sip] sip-identity-05: display-name woes Thread-Index: AcU7frN1Z5rgfugoSn2awd1AWizgfAA8hetg From: "Peterson, Jon" To: "Paul Kyzivat" , "Brian Rosen" X-OriginalArrivalTime: 08 Apr 2005 19:53:51.0201 (UTC) FILETIME=[AFBA1D10:01C53C74] X-Spam-Score: 0.0 (/) X-Scan-Signature: f4c2cf0bccc868e4cc88dace71fb3f44 Content-Transfer-Encoding: quoted-printable Cc: sip@ietf.org X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 244a2fd369eaf00ce6820a760a3de2e8 Content-Transfer-Encoding: quoted-printable Some notes inline. Jon Peterson NeuStar, Inc. > -----Original Message----- > From: Paul Kyzivat [mailto:pkyzivat@cisco.com] > Sent: Thursday, April 07, 2005 7:33 AM > To: Brian Rosen > Cc: Peterson, Jon; sip@ietf.org > Subject: Re: [Sip] sip-identity-05: display-name woes >=20 [snip] >=20 > The most immediate problem I can see comes when your call lands on a=20 > gateway to the PSTN. At that point the identification conventions of = the=20 > SIP network must be interworked with those of the public telephone=20 > network. The gateway must decide whether to populate the calling name=20 > and number fields on the PSTN side. If it has no authentication that = the=20 > information is correct, should it populate it?=20 Let's be careful, though. If I'm calling from sip:jon@example.com, what = exactly does the gateway put in the ISUP CgPN field, let alone what = might it share as a textual string in the GNP? That sort of SIP-ISUP = mapping has bigger problems than just how to deal with display-name. = Clearly, if the gateway is going to just make up a telephone number to = represent the calling party, all bets are off about how to understand = the GNP. Of course, the From header field of a SIP request might contain a tel = URI, or a SIP URI with a tel URI user portion. But in that instance, = provided it is a valid telephone number, there is most likely a CNAM = record associated with it in the PSTN. Gateways or subsequent PSTN = signaling elements can always do CNAM queries to recover the associated = appropriate calling name to populate the GNP. But clearly there's no = point in even getting the CNAM if the telephone number itself can just = trivially be forged in SIP From header fields. This gets into the whole = question of why a gateway would ever trust an Identity header that = asserts a telephone number. As sip-identity-04 suggests, that has to be = a subject for future work, but the only plausible lines of thought we = have on this today are ENUM architectures. By launching an ENUM query, the story might go, the gateway could learn = who the number owner is, and thus who should provide the signature over = the Identity information, and conceivably the gateway could also learn = info like CNAM at the time. This would be tantamount to just reinventing = CNAM in an IP context - something that is probably inevitable if = telephone numbers are to be used extensively in SIP, something that = people are no doubt noodling in various shops around the world today, = and something that probably wouldn't necessarily require signing the = display-name in order for it to work. But until we boil that particular ocean, I feel that PSTN interworking = might not the best case on which to argue the display-name issue one way = or another.=20 _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Fri Apr 8 16:44:56 2005 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA11169 for ; Fri, 8 Apr 2005 16:44:56 -0400 (EDT) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DK0UQ-0005Ya-5t for sip-web-archive@ietf.org; Fri, 08 Apr 2005 16:54:06 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DK0Jx-0005mc-4B; Fri, 08 Apr 2005 16:43:17 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DK0Jr-0005jc-1I for sip@megatron.ietf.org; Fri, 08 Apr 2005 16:43:11 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA11062 for ; Fri, 8 Apr 2005 16:43:09 -0400 (EDT) Received: from sj-iport-3-in.cisco.com ([171.71.176.72] helo=sj-iport-3.cisco.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DK0Se-0005WA-H7 for sip@ietf.org; Fri, 08 Apr 2005 16:52:18 -0400 Received: from sj-core-1.cisco.com (171.71.177.237) by sj-iport-3.cisco.com with ESMTP; 08 Apr 2005 13:42:58 -0700 X-IronPort-AV: i="3.92,88,1112598000"; d="scan'208"; a="247730244:sNHT2740055708" Received: from flask.cisco.com (IDENT:mirapoint@flask.cisco.com [161.44.122.62]) by sj-core-1.cisco.com (8.12.10/8.12.6) with ESMTP id j38KgqDt028807; Fri, 8 Apr 2005 13:42:54 -0700 (PDT) Received: from cisco.com ([161.44.79.173]) by flask.cisco.com (MOS 3.4.6-GR) with ESMTP id AQM27276; Fri, 8 Apr 2005 16:42:51 -0400 (EDT) Message-ID: <4256ECCB.7020609@cisco.com> Date: Fri, 08 Apr 2005 16:42:51 -0400 From: Paul Kyzivat User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.1) Gecko/20020826 X-Accept-Language: en-us, en MIME-Version: 1.0 To: "Peterson, Jon" Subject: Re: [Sip] sip-identity-05: display-name woes References: <24EAE5D4448B9D4592C6D234CBEBD59701502E19@stntexch03.cis.neustar.com> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Score: 0.0 (/) X-Scan-Signature: 39bd8f8cbb76cae18b7e23f7cf6b2b9f Content-Transfer-Encoding: 7bit Cc: sip@ietf.org X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 9ed51c9d1356100bce94f1ae4ec616a9 Content-Transfer-Encoding: 7bit OK. I forgot that phone numbers were out of scope for this discussion. Paul Peterson, Jon wrote: > Some notes inline. > > Jon Peterson > NeuStar, Inc. > > >>-----Original Message----- >>From: Paul Kyzivat [mailto:pkyzivat@cisco.com] >>Sent: Thursday, April 07, 2005 7:33 AM >>To: Brian Rosen >>Cc: Peterson, Jon; sip@ietf.org >>Subject: Re: [Sip] sip-identity-05: display-name woes >> > > [snip] > >>The most immediate problem I can see comes when your call lands on a >>gateway to the PSTN. At that point the identification conventions of the >>SIP network must be interworked with those of the public telephone >>network. The gateway must decide whether to populate the calling name >>and number fields on the PSTN side. If it has no authentication that the >>information is correct, should it populate it? > > > Let's be careful, though. If I'm calling from sip:jon@example.com, what exactly does the gateway put in the ISUP CgPN field, let alone what might it share as a textual string in the GNP? That sort of SIP-ISUP mapping has bigger problems than just how to deal with display-name. Clearly, if the gateway is going to just make up a telephone number to represent the calling party, all bets are off about how to understand the GNP. > > Of course, the From header field of a SIP request might contain a tel URI, or a SIP URI with a tel URI user portion. But in that instance, provided it is a valid telephone number, there is most likely a CNAM record associated with it in the PSTN. Gateways or subsequent PSTN signaling elements can always do CNAM queries to recover the associated appropriate calling name to populate the GNP. But clearly there's no point in even getting the CNAM if the telephone number itself can just trivially be forged in SIP From header fields. This gets into the whole question of why a gateway would ever trust an Identity header that asserts a telephone number. As sip-identity-04 suggests, that has to be a subject for future work, but the only plausible lines of thought we have on this today are ENUM architectures. > > By launching an ENUM query, the story might go, the gateway could learn who the number owner is, and thus who should provide the signature over the Identity information, and conceivably the gateway could also learn info like CNAM at the time. This would be tantamount to just reinventing CNAM in an IP context - something that is probably inevitable if telephone numbers are to be used extensively in SIP, something that people are no doubt noodling in various shops around the world today, and something that probably wouldn't necessarily require signing the display-name in order for it to work. > > But until we boil that particular ocean, I feel that PSTN interworking might not the best case on which to argue the display-name issue one way or another. > _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Fri Apr 8 18:07:09 2005 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA15985 for ; Fri, 8 Apr 2005 18:07:09 -0400 (EDT) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DK1lz-0000s7-3E for sip-web-archive@ietf.org; Fri, 08 Apr 2005 18:16:20 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DK1YX-0006OH-FV; Fri, 08 Apr 2005 18:02:25 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DK1YA-0006A8-8f for sip@megatron.ietf.org; Fri, 08 Apr 2005 18:02:02 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA15390 for ; Fri, 8 Apr 2005 18:01:59 -0400 (EDT) Received: from nylon.softarmor.com ([66.135.38.164]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DK1gz-0000b3-CH for sip@ietf.org; Fri, 08 Apr 2005 18:11:10 -0400 Received: from [64.101.149.215] ([64.101.149.215]) (authenticated bits=0) by nylon.softarmor.com (8.13.1/8.12.11) with ESMTP id j38M4ISP015171 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NO); Fri, 8 Apr 2005 17:04:19 -0500 In-Reply-To: References: Mime-Version: 1.0 (Apple Message framework v619.2) Content-Type: text/plain; charset=US-ASCII; format=flowed Message-Id: <7836c950b94429b685a3530e8e83932a@softarmor.com> Content-Transfer-Encoding: 7bit From: Dean Willis Subject: Re: [Sip] Draft minutes of SIP meeting at IETF 62 Date: Fri, 8 Apr 2005 17:03:06 -0500 To: "Orit Levin" X-Mailer: Apple Mail (2.619.2) X-Spam-Score: 0.0 (/) X-Scan-Signature: d17f825e43c9aed4fd65b7edddddec89 Content-Transfer-Encoding: 7bit Cc: sip@ietf.org, rohan@ekabal.com, Gonzalo Camarillo , Allison Mankin X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: de4f315c9369b71d7dd5909b42224370 Content-Transfer-Encoding: 7bit I'll see if I can get this into the proceedings. -- Dean On Apr 7, 2005, at 10:47 PM, Orit Levin wrote: > "Add a new header to be used with REFER request and the corresponding > response" _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Fri Apr 8 20:12:15 2005 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA24027 for ; Fri, 8 Apr 2005 20:12:15 -0400 (EDT) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DK3j6-0006JV-4p for sip-web-archive@ietf.org; Fri, 08 Apr 2005 20:21:28 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DK3Zx-0001yo-8Q; Fri, 08 Apr 2005 20:12:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DK3Zh-0001uY-UB for sip@megatron.ietf.org; Fri, 08 Apr 2005 20:11:46 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA24004 for ; Fri, 8 Apr 2005 20:11:42 -0400 (EDT) Received: from mail1.microsoft.com ([131.107.3.125]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DK3iY-0006DR-Cn for sip@ietf.org; Fri, 08 Apr 2005 20:20:55 -0400 Received: from mailout1.microsoft.com ([157.54.1.117]) by mail1.microsoft.com with Microsoft SMTPSVC(6.0.3790.1802); Fri, 8 Apr 2005 17:11:36 -0700 Received: from RED-MSG-52.redmond.corp.microsoft.com ([157.54.12.12]) by mailout1.microsoft.com with Microsoft SMTPSVC(6.0.3790.1824); Fri, 8 Apr 2005 17:11:33 -0700 X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Date: Fri, 8 Apr 2005 17:11:34 -0700 Message-ID: Thread-Topic: REFER with no implicit subscription [was: Draft minutes of SIP meeting at IETF 62] Thread-Index: AcU8hp0/DT0MDV8TTyWJZI9T3efrIAAEORDQ From: "Orit Levin" To: "Dean Willis" X-OriginalArrivalTime: 09 Apr 2005 00:11:33.0368 (UTC) FILETIME=[AFE58F80:01C53C98] X-Spam-Score: 0.0 (/) X-Scan-Signature: 9466e0365fc95844abaf7c3f15a05c7d Content-Transfer-Encoding: quoted-printable Cc: sip@ietf.org, rohan@ekabal.com, Gonzalo Camarillo , Allison Mankin Subject: [Sip] REFER with no implicit subscription [was: Draft minutes of SIP meeting at IETF 62] X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: bb8f917bb6b8da28fc948aeffb74aa17 Content-Transfer-Encoding: quoted-printable Dean, I am less worried about the official text. I just wanted the interested parties to look into it again and (even if silently) confirm that this was the meeting resolution. That is in order to capture the right solution in the updated draft. Thanks :-) Orit.=20 > -----Original Message----- > From: Dean Willis [mailto:dean.willis@softarmor.com]=20 > Sent: Friday, April 08, 2005 3:03 PM > To: Orit Levin > Cc: rohan@ekabal.com; Gonzalo Camarillo; Allison Mankin; sip@ietf.org > Subject: Re: [Sip] Draft minutes of SIP meeting at IETF 62 >=20 >=20 > I'll see if I can get this into the proceedings. >=20 > -- > Dean >=20 > On Apr 7, 2005, at 10:47 PM, Orit Levin wrote: >=20 > > "Add a new header to be used with REFER request and the=20 > corresponding=20 > > response" >=20 >=20 _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Sat Apr 9 02:48:33 2005 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA12364 for ; Sat, 9 Apr 2005 02:48:33 -0400 (EDT) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DK9ud-0007Bb-Eb for sip-web-archive@ietf.org; Sat, 09 Apr 2005 02:57:47 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DK9jB-00036u-37; Sat, 09 Apr 2005 02:45:57 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DK9i0-0002dF-Ad for sip@megatron.ietf.org; Sat, 09 Apr 2005 02:44:44 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA12247 for ; Sat, 9 Apr 2005 02:44:43 -0400 (EDT) Received: from sj-iport-4.cisco.com ([171.68.10.86]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DK9qu-0006x9-7w for sip@ietf.org; Sat, 09 Apr 2005 02:53:57 -0400 Received: from sj-core-3.cisco.com (171.68.223.137) by sj-iport-4.cisco.com with ESMTP; 08 Apr 2005 23:44:34 -0700 Received: from mira-sjc5-d.cisco.com (IDENT:mirapoint@mira-sjc5-d.cisco.com [171.71.163.28]) by sj-core-3.cisco.com (8.12.10/8.12.6) with ESMTP id j396iVgS021098; Fri, 8 Apr 2005 23:44:31 -0700 (PDT) Received: from [192.168.1.100] (che-vpn-cluster-2-257.cisco.com [10.86.243.2]) by mira-sjc5-d.cisco.com (MOS 3.4.6-GR) with ESMTP id AJG35822; Fri, 8 Apr 2005 23:44:29 -0700 (PDT) Message-ID: <425779CD.9080009@cisco.com> Date: Sat, 09 Apr 2005 02:44:29 -0400 From: Jonathan Rosenberg User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7.3) Gecko/20040910 X-Accept-Language: en-us, en MIME-Version: 1.0 To: Hisham Khartabil Subject: Re: [Sip] Target-Dialog draft submitted - open issue around kpml, dialog package References: <4250EB85.8010705@cisco.com> <58ac5fabce34d2be892f0e219a9affe9@telio.no> <425331FA.1050900@cisco.com> <0fc5dbdb17b4164340ca3f4cd679eecd@telio.no> In-Reply-To: <0fc5dbdb17b4164340ca3f4cd679eecd@telio.no> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Score: 0.0 (/) X-Scan-Signature: 8b30eb7682a596edff707698f4a80f7d Content-Transfer-Encoding: 7bit Cc: IETF SIP List X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: cab78e1e39c4b328567edb48482b6a69 Content-Transfer-Encoding: 7bit Hisham Khartabil wrote: > I'm confused now. If they serve different purposes, then what is the > problem? Do you believe that current implementations of those mentioned > event packages already use the event header information for > authorisation purposes? OK, let me try to clarify. You had proposed that each event package gets to pick what it does. You said they can either use target-dialog, or use something else. I dont think it works that way. Target-Dialog is to provide authorization by presenting certain information. If that information is presented in other places, then target dialog is not needed. So, an event package might need target-dialog in some flows (those where authorization is needed but not present in the event header or otherwise), and not in others. Whether its needed or not will not be fixed for all flows for an event package; that is my point. Within the same event package, sometimes it might be needed, sometimes not. Its certainly reasonable for an event package to discuss when it might be needed. Hope that clarifies, Jonathan R. -- Jonathan D. Rosenberg, Ph.D. 600 Lanidex Plaza Director, Service Provider VoIP Architecture Parsippany, NJ 07054-2711 Cisco Systems jdrosen@cisco.com FAX: (973) 952-5050 http://www.jdrosen.net PHONE: (973) 952-5000 http://www.cisco.com _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Sun Apr 10 01:36:01 2005 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA03428 for ; Sun, 10 Apr 2005 01:36:01 -0400 (EDT) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DKVGA-00029d-86 for sip-web-archive@ietf.org; Sun, 10 Apr 2005 01:45:27 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DKV1Z-0001lv-Te; Sun, 10 Apr 2005 01:30:21 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DJPxi-0000II-4h for sip@megatron.ietf.org; Thu, 07 Apr 2005 01:53:54 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA23519 for ; Thu, 7 Apr 2005 01:53:52 -0400 (EDT) Received: from 203-217-29-141.perm.iinet.net.au ([203.217.29.141] helo=river.redflex.com.au) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DJQ6B-0003DB-7o for sip@ietf.org; Thu, 07 Apr 2005 02:02:41 -0400 Received: from KenS ([192.168.88.180]) by river.redflex.com.au (8.9.3/8.9.3) with ESMTP id PAA18582 for ; Thu, 7 Apr 2005 15:53:46 +1000 Message-Id: <200504070553.PAA18582@river.redflex.com.au> From: "Ken Sayers" To: Date: Thu, 7 Apr 2005 15:53:09 +1000 Organization: Redflex Communications Systems MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----=_NextPart_000_003D_01C53B89.F7158C30" X-Mailer: Microsoft Office Outlook, Build 11.0.5510 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2527 Thread-Index: AcU7NhKi2WNYp2OgTgureyPVk32N+Q== X-Spam-Score: 0.0 (/) X-Scan-Signature: 39bd8f8cbb76cae18b7e23f7cf6b2b9f X-Mailman-Approved-At: Sun, 10 Apr 2005 01:30:15 -0400 Subject: [Sip] Re: SIP Refer Method X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: Ken.Sayers@redflex.com.au List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 50a516d93fd399dc60588708fd9a3002 This is a multi-part message in MIME format. ------=_NextPart_000_003D_01C53B89.F7158C30 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Hi Joel et al I saw the response from Joel re the transfer method, but I noticed that the document referenced "Session Initiation Protocol Call Control - Transfer draft-ietf-sipping-cc-transfer-03" is due to expire in a couple of weeks. Does anyone know what will be the end result of this work? What is planned as far as putting this into an RFC? /Ken Sayers ------=_NextPart_000_003D_01C53B89.F7158C30 Content-Type: text/x-vcard; name="Ken Sayers (KenS@redflex.com.au).vcf" Content-Disposition: attachment; filename="Ken Sayers (KenS@redflex.com.au).vcf" Content-Transfer-Encoding: 7bit BEGIN:VCARD VERSION:2.1 N:Sayers;Ken FN:Ken Sayers TITLE:Senior Consultant TEL;WORK;VOICE:(03) 9674 1729 EMAIL;PREF;INTERNET:KenS@redflex.com.au REV:20050404T070403Z END:VCARD ------=_NextPart_000_003D_01C53B89.F7158C30 Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Disposition: inline Content-Transfer-Encoding: 7bit _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip ------=_NextPart_000_003D_01C53B89.F7158C30-- From sip-bounces@ietf.org Mon Apr 11 10:50:42 2005 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA19272 for ; Mon, 11 Apr 2005 10:50:42 -0400 (EDT) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DL0Op-0001ej-BX for sip-web-archive@ietf.org; Mon, 11 Apr 2005 11:00:27 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DL0CO-0005Pe-Rp; Mon, 11 Apr 2005 10:47:36 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DL0CL-0005MU-0v for sip@megatron.ietf.org; Mon, 11 Apr 2005 10:47:35 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA18965 for ; Mon, 11 Apr 2005 10:47:18 -0400 (EDT) Received: from gallo.ekabal.com ([131.161.248.72]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DL0LW-0001ZP-H3 for sip@ietf.org; Mon, 11 Apr 2005 10:57:03 -0400 Received: from [192.168.2.104] (S0106000f6629a7aa.cg.shawcable.net [68.144.73.98]) by gallo.ekabal.com (Postfix) with ESMTP id 92FFDEC05B; Mon, 11 Apr 2005 07:56:44 -0700 (PDT) In-Reply-To: References: Mime-Version: 1.0 (Apple Message framework v619.2) Content-Type: text/plain; charset=US-ASCII; format=flowed Message-Id: Content-Transfer-Encoding: 7bit From: Rohan Mahy Date: Mon, 11 Apr 2005 08:47:35 -0600 To: "Orit Levin" X-Mailer: Apple Mail (2.619.2) X-Spam-Score: 0.1 (/) X-Scan-Signature: e1e48a527f609d1be2bc8d8a70eb76cb Content-Transfer-Encoding: 7bit Cc: sip@ietf.org, Rohan Mahy , Allison Mankin , Gonzalo Camarillo , Dean Willis Subject: [Sip] Re: REFER with no implicit subscription [was: Draft minutes of SIP meeting at IETF 62] X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org X-Spam-Score: 0.1 (/) X-Scan-Signature: c1c65599517f9ac32519d043c37c5336 Content-Transfer-Encoding: 7bit Hi Orit, I propose we just change the minutes text on the softarmor site. thx, -r On Apr 8, 2005, at 18:11, Orit Levin wrote: > Dean, > I am less worried about the official text. > I just wanted the interested parties to look into it again and (even if > silently) confirm that this was the meeting resolution. That is in > order > to capture the right solution in the updated draft. > > Thanks :-) > Orit. > >> -----Original Message----- >> From: Dean Willis [mailto:dean.willis@softarmor.com] >> Sent: Friday, April 08, 2005 3:03 PM >> To: Orit Levin >> Cc: rohan@ekabal.com; Gonzalo Camarillo; Allison Mankin; sip@ietf.org >> Subject: Re: [Sip] Draft minutes of SIP meeting at IETF 62 >> >> >> I'll see if I can get this into the proceedings. >> >> -- >> Dean >> >> On Apr 7, 2005, at 10:47 PM, Orit Levin wrote: >> >>> "Add a new header to be used with REFER request and the >> corresponding >>> response" >> >> _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Mon Apr 11 13:45:20 2005 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA03485 for ; Mon, 11 Apr 2005 13:45:20 -0400 (EDT) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DL37s-0007o1-Cv for sip-web-archive@ietf.org; Mon, 11 Apr 2005 13:55:08 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DL2o7-0003gP-Ma; Mon, 11 Apr 2005 13:34:43 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DL2o6-0003fz-0n for sip@megatron.ietf.org; Mon, 11 Apr 2005 13:34:42 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA02754 for ; Mon, 11 Apr 2005 13:34:30 -0400 (EDT) Received: from magus.nostrum.com ([69.5.195.2] helo=nostrum.com ident=root) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DL2xN-0007TJ-GD for sip@ietf.org; Mon, 11 Apr 2005 13:44:18 -0400 Received: from [192.168.0.102] (c-24-1-68-89.hsd1.tx.comcast.net [24.1.68.89]) (authenticated bits=0) by nostrum.com (8.12.11/8.12.11) with ESMTP id j3BHY3l8076284 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NO); Mon, 11 Apr 2005 12:34:04 -0500 (CDT) (envelope-from rjsparks@nostrum.com) Mime-Version: 1.0 (Apple Message framework v619.2) Content-Transfer-Encoding: 7bit Message-Id: Content-Type: text/plain; charset=US-ASCII; format=flowed To: sip-implementors@cs.columbia.edu, "sip@ietf.org WG" From: Robert Sparks Date: Mon, 11 Apr 2005 12:34:16 -0500 X-Mailer: Apple Mail (2.619.2) Received-SPF: pass (nostrum.com: 24.1.68.89 is authenticated by a trusted mechanism) X-Spam-Score: 0.1 (/) X-Scan-Signature: 36b1f8810cb91289d885dc8ab4fc8172 Content-Transfer-Encoding: 7bit Subject: [Sip] SIPIT 16 summary X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org X-Spam-Score: 0.1 (/) X-Scan-Signature: 42e3ed3f10a1d8bef690f09da16f507a Content-Transfer-Encoding: 7bit SIPIT 16 was held April 3-8, 2005 at the Fairmont Banff Springs. Jasomi Networks hosted the event and provided one of the most stable testing environments the SIPIT has enjoyed to date. We had 120 people in attendance from 15 countries. There was a much higher ratio of first-time attendees than normal (I estimate about a third). There were 57 teams present. General interoperability continues to improve at each SIPIT. Even with the large number of first time attendees, most of the peer-to-peer testing was progressing well beyond basic call. Lack of interoperability seemed to arise mostly from differing interpretations of non-trivial SDP bodies. ------------ Implementation Statistics: The list below is a summary of the number of implementations implementing various features. These statistics are obtained through a verbal survey of each team through the week - it's likely that some of these numbers are under-reported by one or two teams. SIP over TLS: 25 SIP over UDP only: 11 DNS SRV lookups (per 3263): 30 DNS NAPTR lookups (per 3263): 25 Lookup A records only: 7 Transfer using REFER: 29 REFER with Replaces: 22 PRACK: 24 Graceful handling of Multipart-Mime: 15 Session-Timer: 12 STUN: 4 ICE: 2 Privacy: 7 SIP Events presence : 16 presence.winfo: 9 dialog package: 5 mwi package: 14 eventlist: 4 IPv6: 5 SIGCOMP: 4 SRTP: 4 GRUU: 1 There were 10 teams with implementations doing various things to keep NAT bindings alive (sending CRLFs, empty media packets, etc). The remainder were not attempting to address the problem at this time. There was only one team present that was ready to test GRUUs. Several others were beginning to work on them anticipating testing at SIPIT 17. The majority of the attendees had not heard of them before. Likewise, the attendees in general were not aware of ICE or the recent work on SIP Identity. There were 4 implementations of SRTP present, with varying degrees of interoperability. Lack of interoperability was most often due to a lack of common transforms. 42 of the attending teams agreed to anonymously self report how many bugs they discovered in their implementation during the week. The results: # bugs # teams 2-5 7 6-10 12 11-20 11 21-50 12 ------------ The kind of arguments over what the specification says remains about the same. There were two serious specification clarity/accuracy questions that arose: 1) How does a proxy deal with a retransmitted INVITE when a 200 it forwarded upstream is lost (the spec's requirement to delete the server transaction at the proxy once a 200 is forwarded may have unintended consequences) 2) What should a proxy/registrar do when someone registers sips: Contacts against a sip: URI. More detailed descriptions of each of those questions will be sent to the SIP list. Other arguments overheard (bugs will be entered for each of these): - New implementers still miss that CSeqs come from independent spaces on each side of a dialog - There was confusion on what a proxy that's holding onto a 6xx response while canceling legs should do if a 200 shows up. - There was confusion around what endpoints can/should do to keep proxies from bailing out of an INVITE transaction before they are ready. - There were several implementations reusing the same branch tag from an INVITE in an ACK-200. - There were still arguments about the case-sensitivity of tags, the branch parameter value, and the value of the Content-Type header field. - There were arguments over what "reason" to provide in a final NOTIFY when an unSUBSCRIBE happens (more than one implementation used "deactivated" instead of "timeout"). - The REFER spec doesn't allow for empty body NOTIFY requests (for things like an immediate NOTIFY or a pending Event: refer subscription). Similar questions arose for the mwi package. ------------ The multiparty tests continue to be the most effective bug-exposing tools at the event. One of the most effective at this event was a multiparty REFER/Replaces test constructed by Dan Petrie. The scenario forces each of the three INVITEs in a consultative transfer to be forked to every participant, stressing admissions policy and dialog identification logic very effectively. I'll get a detailed description of this test up on sipit.net soon. RjS _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Mon Apr 11 19:19:32 2005 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA11059 for ; Mon, 11 Apr 2005 19:19:32 -0400 (EDT) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DL8LL-0003d2-2J for sip-web-archive@ietf.org; Mon, 11 Apr 2005 19:29:23 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DL82H-0002MS-9k; Mon, 11 Apr 2005 19:09:41 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DL82F-0002Lm-GW for sip@megatron.ietf.org; Mon, 11 Apr 2005 19:09:39 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA10355 for ; Mon, 11 Apr 2005 19:09:27 -0400 (EDT) Received: from oak.neustar.com ([209.173.53.70]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DL8Ba-0003OU-2r for sip@ietf.org; Mon, 11 Apr 2005 19:19:18 -0400 Received: from stntsmtp1.cis.neustar.com (smartexch.neustar.com [10.31.13.79]) by oak.neustar.com (8.12.8/8.11.0) with ESMTP id j3BN9JKD021064; Mon, 11 Apr 2005 23:09:20 GMT Received: from stntexch03.cis.neustar.com ([10.31.13.45]) by stntsmtp1.cis.neustar.com with Microsoft SMTPSVC(6.0.3790.211); Mon, 11 Apr 2005 19:09:19 -0400 X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Subject: sipping-retarget (was RE: [Sip] RE: Question to Identity draft) Date: Mon, 11 Apr 2005 19:09:19 -0400 Message-ID: <24EAE5D4448B9D4592C6D234CBEBD59701502E1D@stntexch03.cis.neustar.com> Thread-Topic: [Sip] RE: Question to Identity draft Thread-Index: AcU7t5+WfORpvfjNR4243es8wDhM1gAvvnwA From: "Peterson, Jon" To: "Francois Audet" , "Fries Steffen" , X-OriginalArrivalTime: 11 Apr 2005 23:09:19.0779 (UTC) FILETIME=[7DBE5730:01C53EEB] X-Spam-Score: 1.1 (+) X-Scan-Signature: b045c2b078f76b9f842d469de8a32de3 Content-Transfer-Encoding: quoted-printable Cc: IETF SIP List X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org X-Spam-Score: 1.1 (+) X-Scan-Signature: 32029c790f79bd4a84a26bd2915c54b9 Content-Transfer-Encoding: quoted-printable (maybe this should move to SIPPING, as this is properly about = sipping-retarget, but I'll leave it here for now) Francois, sipping-retarget-00 is not intended to provide a solution space, if any, = for retargeting problems; that is why it may seem to lack anything by = way of a conclusion or concrete proposal. When the draft gets revised, I = may try to insert some more speculation about the plausible parameters = for some limited-scope fixes, but as it stands, the draft really just = shows why a lot of things won't work. I guess I am not convinced that the rough proposal you outline below = really escapes the problems detailed in 2.2.1 and 2.3 of = sipping-retarget. The whole issue of using a certificate to provide = connected-party is problematic because, in order for someone to rely on = a cert to identify the connected-party, it cannot be a self-signed cert. = Issuing publicly-verifiable certs to end users (with subjects of form = sip:jon@example.com or what have you) is known to be extremely difficult = from an operational perspective. Indeed, if it were plausible to enroll = end-users in PKIs, much of the security work in email, SIP and most = other Internet applications would be taking a radically different form. = The current level of S/MIME support in SIP deployments is a good = indication of how well the implementation community is likely to react = to this appraoch. While the problems in 2.3 are specific to S/MIME = implementations, and thus could conceivably be addressed with a solution = that is predicated on S/MIME, the problems in 2.2 and 2.2.1 are really = generic ones that need to be addressed for clients that don't support = S/MIME (since S/MIME is, as we all know, only a MAY in RFC3261). Even if there were a CA-signed certificate passed in the backwards = direction which could tell a UAC whom is responding to their request, = that doesn't make the remote side any less unanticipated, nor tell the = UAC whether or not it should encrypt future calls to the original = Request-URI with this certificate, nor tell the UAC how to deal with = multiple responses that contain different certificates, and so on. Regarding your suggestion to encrypt or withhold SDP, how would you ever = decide it is safe to provide SDP in an INVITE, if essentially it is = possible for any INVITE to be retargeted? That is tantamount to always = requiring a two-phase INVITE. When you encrypt the SDP body initially, = at least that only results in a two-phase handshake for SIP when = retargeting has occurred, but in either case this is a definite = liability. Whenever there is a possibility of a two-phase handshake, = there is a possibility that the certificate you acquire in the first = phase will not work for the second phase, unless you change the target = URI for the request (like you suggest below, using a GRUU or something). = However, changing the target URI for the request may be self-defeating. = If I am trying to call you, and I get retargeted to Steffen, and Steffen = provides me his certificate... and then you become available before I = send the second phase INVITE... what is the desired effect? Am I = actually trying to contact you or Steffen? If I'm trying to talk to you, = why am I encrypting my message with Steffen's certificate? But of course = I may not even know the difference, if any, between "you" and the URI to = which I have been retargeted. If I'm trying to send an INVITE to you, = and I get back a 493 with a certificate for something really opaque, = like 'sip:user51@example.com', how am I supposed to understand that? Is = that URI a pseudonym for you, or does it represent someone else? Do I = want to encrypt my message with that certificate or not? Do I want to = use that certificate in the future when I try to contact you?=20 At the core of these problems is the bare fact that retargeting creates = an linkage, perhaps even an equivalence, between URIs which are not = necessarily equivalent at all from a security and authorization = perspective. These are the -hard- authorization problems inherent in the = presence of retargeting which are the subject of 2.3, and I really don't = see anything below that provides us with additional leverage on these = problems. So if I'm so negative on this whole 2.3 problem space, why do I keep = saying that the sipping-certs model is more promising than the INVITE = model when it comes to 2.3? Because a cert store is a single = authoritative place where "my" certificate exists. If I am a using a = different certificate for the next hour, I can PUBLISH it to that store = from my new user agent. If you are subscribed to my certificate, you = will receive a corresponding NOTIFY with my new certificate which you = can immediately use. If I log into a new user agent and I want to use my = old certificate, I can fetch my private keying material from the cert = store and use it to decrypt messages I receive. My certificate is = attached to "me". Contacts that are registered under my AoR may or may = not be "me", and I may set up forwarding to contacts that would not have = my certificate: but in a sipping-certs environment, it is unambiguous = that those people are not "me" from an authorization perspective. = Furthermore, these certs don't have to be signed by a CA because their = authority derives from the place where you acquired them - a certificate = store responsible for my namespace. Self-signed or publicly-signed, a = certificate in a response to an INVITE will never have that sort of = authority because it derives from some third party (the respondent) = whose relationship to me is ultimately unclear. Jon Peterson NeuStar, Inc. -----Original Message----- From: Francois Audet [mailto:audet@nortel.com] Sent: Thursday, April 07, 2005 2:20 PM To: Peterson, Jon; 'Fries Steffen'; 'fluffy@cisco.com' Cc: 'IETF SIP List' Subject: RE: [Sip] RE: Question to Identity draft Hi Jon,=20 Your draft peterson-sipping-retarget-00 describes very well the=20 issues at hand.=20 I don't view the use of INVITE as a "fetch". To me the SUBSCRIBE=20 mechanism is the fetch mechanism, and it should definitively be used=20 whenever it is possible. There is a very strong incentive to use=20 SUBSCRIBE to fetch the certificates of the "people you know" because=20 it will result in session setup in ONE round-trip (which will not be=20 the case when there is a failure, as with unanticipated respondents).=20 What I am saying is that there are a lot of cases where the=20 SUBSCRIBE mechanism will NOT work, but where you may still have=20 a need for either/both Identity and/or Privacy (encryption). We=20 absolutely need to acknowlege that this will happen (and it will=20 happen a lot).=20 I've listed a few cases where SUBSCRIBE won't work. It boils down=20 to cases where the responder is unpredictable which is extremly=20 common.=20 Going through the specifics of the retarging-draft regarding identity:=20 - To me the logical choice for the connected party information would be=20 to use the far-end certificate (especially if we need to do encryption = as well). It fact, it seems to be the only choice as, as you point = out,=20 it is impossible to enforce a rule that prohibits proxies from=20 retargeting in a domain it is not responsible for.=20 - It seems to me that it would solve the unanticipated respondent = problem=20 (2.2.1). The sender of the request would have many choices, depending=20 of the application, on what to do before sending a request:=20 - In the case of sending a request that does NOT include an encrypted=20 body, the sender needs to decide if there is any information that is = sensitive before it sends the request. For example, if it is a SIP=20 INVITE, it may decide that it will NOT send an SDP body (because it=20 doesn't want to advertize the information to anybody) in the INVITE=20 (which means it is doing delayed offer/answer. That particular = mechanism=20 has some advantage, including avoiding a re-negotiation later on = (what you=20 call the fetch). There are some cases where this makes sense.=20 - In most cases, I would say that you would use encryption (S/MIME) to = send the body. This means that there is no unanticipated respondent=20 problem because the unintendent respondent won't be able to decrypt=20 the body in the first place. Perhaps, we should highly recommend=20 this approach (as opposed to "depopulate the message" as above.=20 - Again, if for specific requests, it only makes sense to reach a = specific=20 recipient (e.g., MESSAGE), you still have the option to rely = strictly on=20 SUBSCRIBE. To me the real important use case where SUBSCRIBE is not=20 enought is INVITEs (and more importantly, for sRTP).=20 It is important to acknowledge in advance that there is no way for the = sender to know in advance that there will be an unanticipated = responder.=20 Even if a SUBSCRIBE was successful earlier, it may still be = retargeted.=20 - In section 2.3, you talk about using 493. Personally, I would think = that=20 a 3XX code (possibly a new one) would be more appropriate. In case of=20 forking for example, it is more likely that the forking proxy would = redirect=20 than a 4XX code which would be very likely to be dropped. You talk = about a=20 potential problem that the new INVITE could still be routed to a = different=20 users (just like SUBSCRIBE). Why not use a URI that specifically = refers to=20 a specific user as a Contact (perhaps a GRUU)? This essentially = transforms=20 a retargeting into a redirection, which solves a lot of issues (the = To:=20 would of course remain as per the original INVITE).=20 - The second to last paragraph of 2.3 says that "This whole class of = failure=20 would be preventable if Alice were able to guess who would eventually = receive=20 her request." I would say that it is quite unrealistic to think that = this=20 is feasible all the time. There are countless examples where this is = not=20 possible, and where you would still want to know (1) who responds, and = (2) you=20 may still want to do encryption.=20 - In section 2.4 you talk about consent of the UAC. You are right: this = is=20 absolutely crucial. My take is that the UAC could clear the session.=20 I would say that would be appropriate for INVITEs for example (keep in = mind=20 that normally, the receiver wouldn't understand the SDP if it is not=20 authorized, so no harm is done). I would agree that you probably don't = want=20 to do this for MESSAGE. We could also do some sort of precondition if=20 we really have to.=20 - Section 5 is where I was a little puzzled... The way I read the = document,=20 I was convinced the conclusion would be to use a "Connected party" = approach, but=20 instead it suggests that the entities doing the retargeting would have = to=20 do some new procedures. I think this is not enforceable. Even if it = was enforceable,=20 it would be increadibly complicated when multiple retargeting occur. = I'd much rather=20 rely on the certificate of the responder, and let the sender decide = how to proceed.=20 This would also allow for supporting sRTP to unanticipated respondents.=20 Note: I will point out that MIKEY allows for this today because the = certificates=20 can be included in the MIKEY message. Not so for SDESC. If we "pop = up 2 levels"=20 the certificates to the SIP level (instead of inside MIKEY inside = SDP in SIP), then=20 we could have a solution that would work for both mechanisms, = allowing a UAC to=20 advertize support for both mechanism. You could use S/MIME with = both mechanisms.=20 =20 _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Tue Apr 12 04:06:30 2005 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id EAA05758 for ; Tue, 12 Apr 2005 04:06:30 -0400 (EDT) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DLGZL-0008WB-Ot for sip-web-archive@ietf.org; Tue, 12 Apr 2005 04:16:24 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DLGIG-0000RM-48; Tue, 12 Apr 2005 03:58:44 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DLGIA-0000QC-7W for sip@megatron.ietf.org; Tue, 12 Apr 2005 03:58:38 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA05157 for ; Tue, 12 Apr 2005 03:58:28 -0400 (EDT) Received: from smtp12.clb.oleane.net ([213.56.31.47]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DLGRW-0008Gq-Im for sip@ietf.org; Tue, 12 Apr 2005 04:08:22 -0400 Received: from Pavillonquatre (upperside.rain.fr [194.206.151.59] (may be forged)) (authenticated) by smtp12.clb.oleane.net with ESMTP id j3C7wDfh031406 for ; Tue, 12 Apr 2005 09:58:13 +0200 Message-Id: <200504120758.j3C7wDfh031406@smtp12.clb.oleane.net> From: "Chantal Ladouce" To: Date: Tue, 12 Apr 2005 09:58:07 +0200 MIME-Version: 1.0 X-Mailer: Microsoft Office Outlook, Build 11.0.5510 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180 Thread-Index: AcU/NVyJCveJiCKdSAO/fxMOblBrxA== X-Spam-Score: 0.1 (/) X-Scan-Signature: 0ff9c467ad7f19c2a6d058acd7faaec8 Subject: [Sip] WiFi Voice Conference - Paris - France X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============1698170145==" Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org X-Spam-Score: 0.1 (/) X-Scan-Signature: 20f22c03b5c66958bff5ef54fcda6e48 This is a multi-part message in MIME format. --===============1698170145== Content-Type: multipart/alternative; boundary="----=_NextPart_000_001D_01C53F46.20C7C1F0" This is a multi-part message in MIME format. ------=_NextPart_000_001D_01C53F46.20C7C1F0 Content-Type: text/plain; charset="US-ASCII" Content-Transfer-Encoding: 7bit Only four weeks left before the starting of the second edition of the WiFi Voice conference to be held in Paris next 10-13 May. Experts and service providers will address all the technical issues related to VoWLAN. Registration is still open. Please get all details at: http://www.upperside.fr/wifi05/wifivoice2005intro.htm ------=_NextPart_000_001D_01C53F46.20C7C1F0 Content-Type: text/html; charset="US-ASCII" Content-Transfer-Encoding: quoted-printable

 

Only four weeks left before the starting of = the second edition of the WiFi Voice conference to be held in = Paris next = 10-13 May.

Experts and service providers will address all = the technical issues related to VoWLAN.

Registration is still open.

Please get all details at:

http://www.upperside.fr/wifi05/wifivoice2005intro.htm=

 

------=_NextPart_000_001D_01C53F46.20C7C1F0-- --===============1698170145== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline Content-Transfer-Encoding: 7bit _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip --===============1698170145==-- From sip-bounces@ietf.org Tue Apr 12 12:54:19 2005 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA15284 for ; Tue, 12 Apr 2005 12:54:19 -0400 (EDT) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DLOoE-0006rz-7f for sip-web-archive@ietf.org; Tue, 12 Apr 2005 13:04:19 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DLOZn-00052W-6U; Tue, 12 Apr 2005 12:49:23 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DLOZk-00051b-Ek for sip@megatron.ietf.org; Tue, 12 Apr 2005 12:49:21 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA14676 for ; Tue, 12 Apr 2005 12:49:17 -0400 (EDT) Received: from omzesmtp02.mci.com ([199.249.17.9]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DLOjL-0006bL-GW for sip@ietf.org; Tue, 12 Apr 2005 12:59:17 -0400 Received: from pmismtp06.wcomnet.com ([166.38.62.54]) by firewall.mci.com (Iplanet MTA 5.2) with ESMTP id <0IEU00GH2EPJ1I@firewall.mci.com> for sip@ietf.org; Tue, 12 Apr 2005 16:49:09 +0000 (GMT) Received: from pmismtp06.wcomnet.com by pmismtp06.mcilink.com (iPlanet Messaging Server 5.2 HotFix 1.14 (built Mar 18 2003)) with SMTP id <0IEU00301EPVWF@pmismtp06.mcilink.com>; Tue, 12 Apr 2005 16:49:08 +0000 (GMT) Received: from usashfe001.mcilink.com ([153.39.73.77]) by pmismtp06.mcilink.com (iPlanet Messaging Server 5.2 HotFix 1.14 (built Mar 18 2003)) with ESMTP id <0IEU003M4EPW6Y@pmismtp06.mcilink.com>; Tue, 12 Apr 2005 16:49:08 +0000 (GMT) Received: from usashms001.mcilink.com ([153.39.82.129]) by usashfe001.mcilink.com with Microsoft SMTPSVC(6.0.3790.211); Tue, 12 Apr 2005 16:49:07 +0000 Date: Tue, 12 Apr 2005 17:49:07 +0100 From: "Johnston, Alan" Subject: RE: [Sip] Re: SIP Refer Method To: Ken.Sayers@redflex.com.au, sip@ietf.org Message-id: <40AF35183B110B4899DD3221904B6B58F4BDE2@usashms001.mcilink.com> MIME-version: 1.0 X-MIMEOLE: Produced By Microsoft Exchange V6.5.7226.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: quoted-printable Content-class: urn:content-classes:message Thread-topic: [Sip] Re: SIP Refer Method Thread-index: AcU7NhKi2WNYp2OgTgureyPVk32N+QER+/Hg X-OriginalArrivalTime: 12 Apr 2005 16:49:07.0927 (UTC) FILETIME=[8B3BB670:01C53F7F] X-Spam-Score: 0.0 (/) X-Scan-Signature: b19722fc8d3865b147c75ae2495625f2 Content-Transfer-Encoding: quoted-printable X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 8b30eb7682a596edff707698f4a80f7d Content-Transfer-Encoding: quoted-printable Hi Ken, The -04 version of the document was submitted back on 2/20 but apparently not processed by the I-D editor... which perhaps explains why no one has commented on it ;-) We will get a new version out shortly which will be updated with the Target-Dialog information as well. Thanks, Alan Johnston sip:alan@sipstation.com > -----Original Message----- > From: sip-bounces@ietf.org [mailto:sip-bounces@ietf.org] On=20 > Behalf Of Ken Sayers > Sent: Thursday, April 07, 2005 12:53 AM > To: sip@ietf.org > Subject: [Sip] Re: SIP Refer Method >=20 >=20 > Hi Joel et al >=20 > I saw the response from Joel re the transfer method, but I=20 > noticed that the document referenced "Session Initiation=20 > Protocol Call Control - Transfer=20 > draft-ietf-sipping-cc-transfer-03" is due to expire in a=20 > couple of weeks. Does anyone know what will be the end result=20 > of this work? What is planned as far as putting this into an RFC? >=20 > /Ken Sayers >=20 >=20 _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Wed Apr 13 09:51:51 2005 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA26679 for ; Wed, 13 Apr 2005 09:51:51 -0400 (EDT) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DLiRL-0007no-IA for sip-web-archive@ietf.org; Wed, 13 Apr 2005 10:02:00 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DLhwY-00024D-Uj; Wed, 13 Apr 2005 09:30:10 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DLhwW-00022Z-G6 for sip@megatron.ietf.org; Wed, 13 Apr 2005 09:30:08 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA24840 for ; Wed, 13 Apr 2005 09:29:58 -0400 (EDT) Received: from [80.74.106.10] (helo=rvil-mail.RADVISION.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DLi69-0007E8-9i for sip@ietf.org; Wed, 13 Apr 2005 09:40:07 -0400 X-MimeOLE: Produced By Microsoft Exchange V6.0.6487.1 content-class: urn:content-classes:message MIME-Version: 1.0 Date: Wed, 13 Apr 2005 16:29:40 +0300 Message-ID: <10DA2C035FE3BC4FA8D73EC55FC43D9B76AC39@rvil-mail.radvision.com> Thread-Topic: Concerns about draft-ietf-sip-connect-reuse-03 Thread-Index: AcVALNjZhmi+nSDLQAeUJCaVNogDvQ== From: "Udi Tirosh (Weintrob)" To: X-Spam-Score: 0.5 (/) X-Scan-Signature: 225414c974e0d6437992164e91287a51 Subject: [Sip] Concerns about draft-ietf-sip-connect-reuse-03 X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============0812889275==" Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org X-Spam-Score: 0.5 (/) X-Scan-Signature: 2bf730a014b318fd3efd65b39b48818c This is a multi-part message in MIME format. --===============0812889275== content-class: urn:content-classes:message Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C5402C.D8B6FEBC" This is a multi-part message in MIME format. ------_=_NextPart_001_01C5402C.D8B6FEBC Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Hi, In draft-ietf-sip-connect-reuse-03, section 4.1.1 [3], it is described that for every mutually authenticated TLS connection, the UAS will have to perform a routine similar to the one in RFC3263 to find out if the name in the via is indeed covered by the certificate. My Concerns regard sections 3 and 4 in the proposed algorithm. >From connect-reuse-03: 3. Use DNS to resolve if the advertised name is resolvable from the subjectAltName (start by resolving the subjectAltName as if it where a target URI according to the rules in RFC3263. That is, if no port number is present perform an SRV lookup, then finally resolve relevant address records). If any of the resolved addresses (port numbers can be ignored in this case) matches the advertised address, then the certificate covers the address. 4. Finally, Verify that the advertised address can resolve to the IP address over which the connection was received. Firstly, I am concerned with the time it might take to perform that "reverse 3263" algorithm: A NAPTR query has to be send,=20 If it fails, an SRV query will have to be sent, And finally (assuming there were no additional info in the DNS server response) another A query. So, we end up with 3 DNS queries for one resolution. The thing that can be troubling is that an administrator can have multiple SRV records (load balancing, for example). Each will result in several hosts, so more A queries have to be done until the "advertised address" can be verified. Lastly, the subjectAltName field in a TLS certificate is a list, so, it can have multiple addresses (e.g. proxy.com, proxy.org, proxy.co.uk). Now which one of those should we use? Again trying them all can be very time costly and heavy on network traffic. Another concern I have regard using DNS as means of authentication. Requests sent to and responses received from DNS server are usually over UDP and can be intercepted and changed. Maybe a solution for the multiple SRV records issue, can be to add a parameter to the via: expected-srv:. Empty expected-srv can indicate that there are no NAPTR records. Regards, Udi J. Tirosh. ------_=_NextPart_001_01C5402C.D8B6FEBC Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Concerns about draft-ietf-sip-connect-reuse-03

Hi,

In = draft-ietf-sip-connect-reuse-03, section 4.1.1 [3], it is described that = for every mutually authenticated TLS connection, the UAS will have to = perform a routine similar to the one in RFC3263 to find out if the name = in the via is indeed covered by the certificate.

My = Concerns regard sections 3 and 4 in the proposed = algorithm.

From connect-reuse-03:

   3.  Use DNS to resolve if the advertised name is = resolvable from the
       subjectAltName (start by resolving = the subjectAltName as if it
       where a target URI according to the = rules in RFC3263.  That is,
       if no port number is present = perform an SRV lookup, then finally
       resolve relevant address = records).  If any of the resolved
       addresses (port numbers can be = ignored in this case) matches the
       advertised address, then the = certificate covers the address.
   4.  Finally, Verify that the advertised address can = resolve to the IP
       address over which the connection = was received.

Firstly, = I am concerned with the time it might take to perform that "reverse = 3263" algorithm:

A NAPTR = query has to be send,

If it = fails, an SRV query will have to be sent,

And = finally (assuming there were no additional info in the DNS server = response) another A query.

So, we = end up with 3 DNS queries for one resolution.

The = thing that can be troubling is that an administrator can have multiple = SRV records (load balancing, for example). Each will result in several = hosts, so more A queries have to be done until the "advertised = address" can be verified.

Lastly, = the subjectAltName field in a TLS certificate is a list, so, it can have = multiple addresses (e.g. proxy.com, proxy.org, proxy.co.uk). Now which = one of those should we use? Again trying them all can be very time = costly and heavy on network traffic.

Another = concern I have regard using DNS as means of authentication. Requests = sent to and responses received from DNS server are usually over UDP and = can be intercepted and changed.

Maybe a = solution for the multiple SRV records issue, can be to add a parameter = to the via: expected-srv:<the srv to use from the NAPTR record>. = Empty expected-srv can indicate that there are no NAPTR = records.

Regards,

Udi J. = Tirosh.



------_=_NextPart_001_01C5402C.D8B6FEBC-- --===============0812889275== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline Content-Transfer-Encoding: 7bit _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip --===============0812889275==-- From sip-bounces@ietf.org Thu Apr 14 02:51:37 2005 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA08274 for ; Thu, 14 Apr 2005 02:51:37 -0400 (EDT) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DLyML-0002I5-1H for sip-web-archive@ietf.org; Thu, 14 Apr 2005 03:01:55 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DLy0O-0004j6-QO; Thu, 14 Apr 2005 02:39:12 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DLxzv-0004dI-W5 for sip@megatron.ietf.org; Thu, 14 Apr 2005 02:38:44 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA07428 for ; Thu, 14 Apr 2005 02:38:26 -0400 (EDT) Received: from nylon.softarmor.com ([66.135.38.164]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DLy9c-0001vH-4P for sip@ietf.org; Thu, 14 Apr 2005 02:48:44 -0400 Received: from [10.10.3.49] (sj-natpool-220.cisco.com [128.107.248.220]) (authenticated bits=0) by nylon.softarmor.com (8.13.1/8.12.11) with ESMTP id j3E6etZj027926 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NO); Thu, 14 Apr 2005 01:40:58 -0500 In-Reply-To: <40AF35183B110B4899DD3221904B6B58F4BDE2@usashms001.mcilink.com> References: <40AF35183B110B4899DD3221904B6B58F4BDE2@usashms001.mcilink.com> Mime-Version: 1.0 (Apple Message framework v619.2) Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed Message-Id: <1db9e9eae269b414d2d8033dfe9846bb@softarmor.com> Content-Transfer-Encoding: 7bit From: Dean Willis Subject: Re: [Sip] Re: SIP Refer Method Date: Thu, 14 Apr 2005 01:38:24 -0500 To: "Johnston, Alan" X-Mailer: Apple Mail (2.619.2) X-Spam-Score: 0.0 (/) X-Scan-Signature: 0ddefe323dd869ab027dbfff7eff0465 Content-Transfer-Encoding: 7bit Cc: sip@ietf.org, Ken.Sayers@redflex.com.au X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 82c9bddb247d9ba4471160a9a865a5f3 Content-Transfer-Encoding: 7bit I have -04 at: http://www.ietf.org/internet-drafts/draft-ietf-sipping-cc-transfer -04.txt On Apr 12, 2005, at 11:49 AM, Johnston, Alan wrote: > Hi Ken, > > The -04 version of the document was submitted back on 2/20 but > apparently not processed by the I-D editor... which perhaps explains > why > no one has commented on it ;-) > > We will get a new version out shortly which will be updated with the > Target-Dialog information as well. > > Thanks, > Alan Johnston > sip:alan@sipstation.com > >> -----Original Message----- >> From: sip-bounces@ietf.org [mailto:sip-bounces@ietf.org] On >> Behalf Of Ken Sayers >> Sent: Thursday, April 07, 2005 12:53 AM >> To: sip@ietf.org >> Subject: [Sip] Re: SIP Refer Method >> >> >> Hi Joel et al >> >> I saw the response from Joel re the transfer method, but I >> noticed that the document referenced "Session Initiation >> Protocol Call Control - Transfer >> draft-ietf-sipping-cc-transfer-03" is due to expire in a >> couple of weeks. Does anyone know what will be the end result >> of this work? What is planned as far as putting this into an RFC? >> >> /Ken Sayers >> >> > > _______________________________________________ > Sip mailing list https://www1.ietf.org/mailman/listinfo/sip > This list is for NEW development of the core SIP Protocol > Use sip-implementors@cs.columbia.edu for questions on current sip > Use sipping@ietf.org for new developments on the application of sip > _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Thu Apr 14 07:33:14 2005 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA01779 for ; Thu, 14 Apr 2005 07:33:14 -0400 (EDT) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DM2kw-0002Mh-MR for sip-web-archive@ietf.org; Thu, 14 Apr 2005 07:43:34 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DM2Ro-0006zX-97; Thu, 14 Apr 2005 07:23:48 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DM2Rl-0006zH-Iv for sip@megatron.ietf.org; Thu, 14 Apr 2005 07:23:45 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA01223 for ; Thu, 14 Apr 2005 07:23:36 -0400 (EDT) Received: from web50202.mail.yahoo.com ([206.190.38.43]) by ietf-mx.ietf.org with smtp (Exim 4.33) id 1DM2bb-00020s-Fb for sip@ietf.org; Thu, 14 Apr 2005 07:33:56 -0400 Received: (qmail 56632 invoked by uid 60001); 14 Apr 2005 11:23:27 -0000 Comment: DomainKeys? See http://antispam.yahoo.com/domainkeys DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.com; b=WUYvLRGDOSruCfuFnzKsus24maC0pu4TCVaHhIL3KjerfqaDHiIBZzCp4E/NOCiszQmbkodyAvbGjYd/XZmq7v+VRLz893mSBZLqUyWp2H1XGTFwwoZ9Tn99uhAdvQ0dRj/2F1H8aKThvt9P0Qrhrm6oKTVqGFACQYz6abKdWe4= ; Message-ID: <20050414112327.56630.qmail@web50202.mail.yahoo.com> Received: from [61.246.223.130] by web50202.mail.yahoo.com via HTTP; Thu, 14 Apr 2005 12:23:27 BST Date: Thu, 14 Apr 2005 12:23:27 +0100 (BST) From: Satya Kondury To: sip@ietf.org MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: 8bit X-Spam-Score: 0.0 (/) X-Scan-Signature: 7d33c50f3756db14428398e2bdedd581 Content-Transfer-Encoding: 8bit Subject: [Sip] Registration question X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 2409bba43e9c8d580670fda8b695204a Content-Transfer-Encoding: 8bit Hi, I am new to working in SIP area. I have a basic quetsion. Incase a registered user again registers with different contact address registrar with out deregistering from the first contact address, both the addresses will be stored in the location database(assume expiry time is not over for the previous registration). Then how the routing takes place for an incoming call to that user? Is there any difference in case a user registers with two contact addresses in a single registration message as far as routing is concerned? Satya ________________________________________________________________________ Yahoo! India Matrimony: Find your partner online. http://yahoo.shaadi.com/india-matrimony/ _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Thu Apr 14 08:39:03 2005 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA07153 for ; Thu, 14 Apr 2005 08:39:03 -0400 (EDT) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DM3me-0005FG-CI for sip-web-archive@ietf.org; Thu, 14 Apr 2005 08:49:24 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DM3LL-0005Nc-5Y; Thu, 14 Apr 2005 08:21:11 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DM3LI-0005M5-Vt for sip@megatron.ietf.org; Thu, 14 Apr 2005 08:21:09 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA05699 for ; Thu, 14 Apr 2005 08:20:59 -0400 (EDT) Received: from sj-iport-2-in.cisco.com ([171.71.176.71] helo=sj-iport-2.cisco.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DM3V9-0004Xi-Cz for sip@ietf.org; Thu, 14 Apr 2005 08:31:20 -0400 Received: from sj-core-5.cisco.com (171.71.177.238) by sj-iport-2.cisco.com with ESMTP; 14 Apr 2005 05:20:52 -0700 Received: from flask.cisco.com (IDENT:mirapoint@flask.cisco.com [161.44.122.62]) by sj-core-5.cisco.com (8.12.10/8.12.6) with ESMTP id j3ECKmfk022811; Thu, 14 Apr 2005 05:20:48 -0700 (PDT) Received: from cisco.com (che-vpn-cluster-1-10.cisco.com [10.86.240.10]) by flask.cisco.com (MOS 3.4.6-GR) with ESMTP id AQP77771; Thu, 14 Apr 2005 08:20:46 -0400 (EDT) Message-ID: <425E601E.6080306@cisco.com> Date: Thu, 14 Apr 2005 08:20:46 -0400 From: Paul Kyzivat User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.1) Gecko/20020826 X-Accept-Language: en-us, en MIME-Version: 1.0 To: Satya Kondury Subject: Re: [Sip] Registration question References: <20050414112327.56630.qmail@web50202.mail.yahoo.com> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Score: 0.0 (/) X-Scan-Signature: e1e48a527f609d1be2bc8d8a70eb76cb Content-Transfer-Encoding: 7bit Cc: sip@ietf.org X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: c1c65599517f9ac32519d043c37c5336 Content-Transfer-Encoding: 7bit Satya Kondury wrote: > Hi, > I am new to working in SIP area. I have a basic > quetsion. > > Incase a registered user again registers with > different contact address registrar with out > deregistering from the first contact address, both the > addresses will be stored in the location > database(assume expiry time is not over for the > previous registration). Then how the routing takes > place for an incoming call to that user? Both addresses are *candidates* for routing of requests addressed to the address of record identified in the REGISTER. The details of if, and in what order, the candidates are tried is not normatively specified. There are some guidelines/suggestions in RFCs 3261 and 3841 (callerprefs). Everything else being equal, you might expect that requests would be forked to both. > Is there any difference in case a user registers > with two contact addresses in a single registration > message as far as routing is concerned? No - that should make no difference. Paul > Satya > > ________________________________________________________________________ > Yahoo! India Matrimony: Find your partner online. http://yahoo.shaadi.com/india-matrimony/ > > _______________________________________________ > Sip mailing list https://www1.ietf.org/mailman/listinfo/sip > This list is for NEW development of the core SIP Protocol > Use sip-implementors@cs.columbia.edu for questions on current sip > Use sipping@ietf.org for new developments on the application of sip > _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Thu Apr 14 10:51:00 2005 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA21148 for ; Thu, 14 Apr 2005 10:51:00 -0400 (EDT) Received: from megatron.ietf.org ([132.151.6.71]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DM5qM-0002lp-RQ for sip-web-archive@ietf.org; Thu, 14 Apr 2005 11:01:23 -0400 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DM5da-0007Us-VZ; Thu, 14 Apr 2005 10:48:10 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DM5dZ-0007Ui-4r for sip@megatron.ietf.org; Thu, 14 Apr 2005 10:48:09 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA20856 for ; Thu, 14 Apr 2005 10:48:06 -0400 (EDT) Received: from david.siemens.de ([192.35.17.14]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DM5nZ-0002bI-Ey for sip@ietf.org; Thu, 14 Apr 2005 10:58:30 -0400 Received: from mail2.siemens.de (mail2.siemens.de [139.25.208.11]) by david.siemens.de (8.12.6/8.12.6) with ESMTP id j3EEm05b000485; Thu, 14 Apr 2005 16:48:00 +0200 Received: from mchp9daa.mch.sbs.de (mchp9daa.mch.sbs.de [139.25.137.99]) by mail2.siemens.de (8.12.6/8.12.6) with ESMTP id j3EEm0uT004526; Thu, 14 Apr 2005 16:48:00 +0200 Received: by mchp9daa.mch.sbs.de with Internet Mail Service (5.5.2657.72) id <2SQ5KH73>; Thu, 14 Apr 2005 16:48:00 +0200 Message-ID: From: Fries Steffen To: "Peterson, Jon" , fluffy@cisco.com Subject: RE: [Sip] RE: Question to Identity draft Date: Thu, 14 Apr 2005 16:47:59 +0200 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2657.72) Content-Type: text/plain X-Spam-Score: 0.0 (/) X-Scan-Signature: b1c41982e167b872076d0018e4e1dc3c Cc: IETF SIP List X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org X-Spam-Score: 0.0 (/) X-Scan-Signature: 93e7fb8fef2e780414389440f367c879 Hi Jon, I'm still not sure what the answer to the scenarios is. Do you see the option with the identity draft to assert a FROM field of a SIP message and also an embedded certificate in the body and thus have a security context for that dialog. The security context may be used on subsequent messages (e.g., to negotiate media encryption), which do not need to be sent via the authentication service? Regards Steffen > -----Original Message----- > From: sip-bounces@ietf.org [mailto:sip-bounces@ietf.org] On > Behalf Of Fries Steffen > Sent: Thursday, April 07, 2005 4:56 PM > To: Peterson, Jon; fluffy@cisco.com > Cc: IETF SIP List > Subject: [Sip] RE: Question to Identity draft > Importance: High > > Hi Jon, > > > > [stf] yes, RFC3261 talks about certificate exchhange. But > > here it is > > > only possible to take certificates, which are (more or > > less) bound to a person. > > > Assume that you use certificates, which are bound to the > > host used for > > > phone calls. Then you would need some instance assuring, > that this > > > certificate is connected with the registration under some AOR. > > > > > > What I had in mind is an inband certificate exchange from, > > e.g., self > > > signed certificates, were the authentication services basically > > > assures that the message (and thus the certificate) came > > from a person > > > registered under a certain AOR. > > > > RFC3261 does in fact describe the self-signed certificate case. > [stf] Okay, I put it in a wrong way, I meant the certificate > must follow some dedicated syntax, connected with the domain > you are registering in. > When you have something like device certificates, which are > issued by a corporate CA on the base of machine names, these > certificates may be used in SIP scenarios. After successful > registering, the Proxy knows, that a user, who authenticated > himself using digest authentication over a TLS link that he > uses the dedicated device certificate for the duration of his > registration for security purposes. That means next time he > registers, his identity may be connected with a different > certificate, as he may use a different phone. Sure, the user > could publish the certificate to a cert server, as described > in the certs draft, but I was thinking of some kind of > "inband provisioning" for such a scenario. > > > > > > The certificate itself may then be used for end-to-end integrity > > > services. > > > > In what respect would using this certificates for an end-to-end > > integrity service be superior to just using > > sip-identity-04 for integrity? Note that that strength of a > > self-signed credential is necessarily equivalent to the strength of > > the security mechanism used to deliver that self-signed > credential to > > potential users. So, if > > sip-identity-04 is used to secure the cert, it isn't clear how the > > cert provides a stronger or more attractive assurance than > > sip-identity-04 itself would provide. > [stf]Using the certificate would require to send just one > message over the authentication service and use the supplied > certificate for the rest of the communication. > > > > > A usage example would be the key management for SRTP using > > MIKEY, were > > > one option is the usage of certificates. When here a > certificate is > > > used, which is completely unknown to the receiver, then > there is no > > > real value. But when a trusted component (the > > authentication service) > > > assures, that a person registered with a dedicated AOR is > connected > > > with this certificate, then it gets a meaning. It would basically > > > provide the assurance, that for the time I am in the call, > > I am using > > > this certificate, which may be sufficient. > > > > No question that using sip-identity-04 would guarantee the > integrity > > of the certificate contained in a SIP message body. > > But why not have sip-identity-04 secure the SDP body containing the > > keymgmt attribute for MIKEY, rather than going through a > certificate > > exchange phase in order to subsequently use the a cert > (whose strength > > is equivalent to > > sip-identity-04) to secure the SDP body containing the keymgmt? In > > what respect is this not a redundant step? > [stf] as stated above, the authentication server would only > be needed for one message, to support the establishment of a > session security context. The other thing is that for the key > management for SRTP the client itself needs to include the > appropriate message body for MIKEY, as the MIKEY container is > protected. The same would be true in scenarios were S/MIME > would be required to protect sdescriptions. > > > Regards > Steffen > > > > > Jon Peterson > > NeuStar, Inc. > > > > > Regards > > > Steffen > > > > > > > > > > _______________________________________________ > Sip mailing list https://www1.ietf.org/mailman/listinfo/sip > This list is for NEW development of the core SIP Protocol Use > sip-implementors@cs.columbia.edu for questions on current sip > Use sipping@ietf.org for new developments on the application of sip > _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Mon Apr 18 11:18:14 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DNY0s-0000oP-CK; Mon, 18 Apr 2005 11:18:14 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DNY0o-0000oF-0D for sip@megatron.ietf.org; Mon, 18 Apr 2005 11:18:12 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA28299 for ; Mon, 18 Apr 2005 11:18:07 -0400 (EDT) Received: from voyager.coretrek.no ([212.33.142.2]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DNYBa-0005P3-Ts for sip@ietf.org; Mon, 18 Apr 2005 11:29:21 -0400 Received: from localhost (localhost [127.0.0.1]) by voyager.coretrek.no (Postfix) with ESMTP id D0F8BA9864; Mon, 18 Apr 2005 17:17:52 +0200 (CEST) Received: from [192.168.1.65] (unknown [82.196.214.14]) by voyager.coretrek.no (Postfix) with ESMTP id 2055FA9832; Mon, 18 Apr 2005 17:17:50 +0200 (CEST) In-Reply-To: <200504071336.JAA22655@ietf.org> References: <200504071336.JAA22655@ietf.org> Mime-Version: 1.0 (Apple Message framework v619.2) Content-Type: text/plain; charset=US-ASCII; format=flowed Message-Id: <3efd5821d4f6d32e012641d801877321@telio.no> Content-Transfer-Encoding: 7bit From: Hisham Khartabil Subject: Re: [Sip] sip-identity-05: display-name woes Date: Mon, 18 Apr 2005 17:17:52 +0200 To: "Brian Rosen" X-Mailer: Apple Mail (2.619.2) X-Virus-Scanned: by AMaViS perl-11 (CoreTrek clamav patch 1) X-Spam-Score: 0.0 (/) X-Scan-Signature: e178fd6cb61ffb6940cd878e7fea8606 Content-Transfer-Encoding: 7bit Cc: sip@ietf.org, 'Paul Kyzivat' , "'Peterson, Jon'" X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org Brian does have some point in what he's saying. Usually, the number is displayed (the sip address in out case) unless the receiver has the caller in the address book. In this case the name displayed is the one in the local address book. But is it too late to think that way? It probably is since a lot of implementations out there already display the Display Name in the From header field, but we could recommend against it. Hisham On Apr 7, 2005, at 3:35 PM, Brian Rosen wrote: > Maybe we want to step back and ask: > What is the purpose of a display name? > And > What is the purpose of the Identity work? > > We might find that there is no point in trying to assert anything about > display name ever. > > A display name is something used to LABEL a caller. It's displayed to > the > user. > > Identity is used to Identify a caller, primarily to provide a > reasonably > reliable indication of who called, and how to call them back. > > If you go to a telephone company and get a phone line, and you tell > them > that your name is George Bush, they might kid you, but they aren't > going to > give you the third degree because there really are a few other George > Bush's > out there. It's more work than doing something with the display name > on > your SIP phone, maybe, but it's not something that is assertable. The > phone > company REPORTS the name on appropriate caller ID, but does not assert > it > means anything. The phone number, on the other hand, is an > identifier, and > it does mean something. > > Perhaps we simply do not ever include display name in the Identity > signature. > > I think our email experience suggests that there is not a lot of harm > when > you get a forged email display name. We have harm with a forged email > address. There is probably more concern over indecent names than > forged > names, but as always YMMV. > > Brian > > -----Original Message----- > From: sip-bounces@ietf.org [mailto:sip-bounces@ietf.org] On Behalf Of > Paul > Kyzivat > Sent: Thursday, April 07, 2005 8:10 AM > To: Peterson, Jon > Cc: sip@ietf.org > Subject: Re: [Sip] sip-identity-05: display-name woes > > > > Peterson, Jon wrote: >>> The simple answer (but perhaps not a popular one) would be to mandate >>> that the authentication service *must* have a policy wrt display >>> names. >>> (A degenerate policy would be that display names simply aren't >>> permitted.) >> >> >> I would feel more comfortable about that if anyone had any idea how a > domain might go about enforcing such policies and distributing > legitimate > display-names to users. Currently, we're taking it on faith that some > domains will want to adopt such policies, and will figure out > appropriate > operational ways to execute them. Not a small thing to take on faith > given > the precedents in the email space, not to mention the fact that the > domains > themselves seem to gain little by enforcing these policies. > > We shouldn't try to boil the ocean, but I think we should be looking to > put a framework in place that will let the players do the right thing. > > I have the impression there is some appreciation that callerid (both > number and name) should be somewhat trustworthy. That notion just has > to > be embraced for SIP. > > If callee devices don't trust, and hence don't display, untrusted > display names, that might eventually provide a competitive advantage to > those that provide trusted names. ("Alice, when you call me your name > is > never displayed. Why don't you switch to a service that provides the > name?") > > Or it may be that once there are some highly publicized abuses, there > will be legal action to require reliable callerid from IP phones. > >>> I suppose it is then necessary to be a little more demanding about >>> what >>> sort of policy is acceptable. (A policy of "you can use any display >>> name >>> you want" is probably not an acceptable policy.) >> >> >> Well, it's about as acceptable as the policy "you can use any >> username in > the addr-spec portion of the From header field that you want", but > that is > effectively the state-of-the-art for SIP and email today. I doubt that > sip-identity can have any appreciable effect on what policies domains > want > to use for this stuff. What is can do is specify a way, through > mechanism, > for a domain to communicate "my policies, however strict or lax, were > followed with regards to this From header field". >> >> >>> Alternatively, perhaps there should be a standard way for discovering >>> the (human and/or machine readable) authentication policy of a >>> particular authentication service. It doesn't have to be part of the >>> request, just derivable from the authentication service credentials. >> >> >> In the end analysis, I can't think of any way that the authorization > decision made by a recipient would change if it had this information. > After > all, a bad domain could lie about its policies, deluded domains will > tell > you they have a good policy even though it is routinely circumvented by > clever users, and good domains will be good regardless of whether or > not > they tell you your policies. As a verifier, I might be willing to take > the > word of a third-party auditor, but I don't think we can incorporate > that > into our protocol specification. > > I think I take advantage of such info by configuring my system about > what domains to accept names from. > > In principle, I would think it might eventually be possible to arrange > things so that the signer of the authorization service's cert vouched > for the policy of the authentication service. Then it would be easier > to > configure who you trust. (But in practice this sounds hard.) > > Regarding lying about policy - at least being on the record provides > the > basis for legal action against those that lie. > > Paul > >> Jon Peterson >> NeuStar, Inc. >> >> >>> Paul >>> >>> Peterson, Jon wrote: >>> >>>> The problem with that, I think, is that it does not provide >>> >>> for the case where the display-name is present, but the >>> authentication service has no policy with regard to >>> display-names. What does the authentication service do then, >>> and how is that behavior disambiguated from the other cases >>> at the verifier? >>> >>>> I agree that if the display-name is present and >>> >>> unauthorized, then the authentication service shouldn't sign >>> the message. In fact, you don't even have to include the >>> display-name in the identity-string in order to structure the >>> mechanism like that. The mechanism in sip-identity-04 >>> essentially reads: >>> >>>> (G) If the domain has policies about display-names, and the >>> >>> display-name is present and unauthorized, decline to sign the >>> message, sending back a 4xx suggesting that the display-name >>> needs to be correct. Otherwise, sign the message (NOT >>> including the display-name) and forward it. >>> >>>> Ultimately, a signature over the display-name itself is not >>> >>> necessary unless you are concerned that the message is going >>> to be modified in transit (which is outside the threat model >>> of sip-identity, since sip-identity is only concerned with >>> impersonation). Replaying the message with a differnt >>> display-name isn't really an option because the replay would >>> be exposed by the other reference indicators present in the >>> request. So at a high level, the fact that a message is >>> signed at all (with or without a display-name) could >>> plausibly signify that either the domain liked the >>> display-name or that it doesn't care about display-names, but >>> it could never plausibly signify that the domain had policies >>> about display-names and that it didn't like the display name, >>> regardless of whether or not the display-name itself is >>> included in the identity-string. >>> >>>> The issue with (G), of course, is that it does not >>> >>> disambiguate the case where the domain has policies about >>> domain names and authorized this message from the case where >>> the domain doesn't have policies. >>> >>>> Jon Peterson >>>> NeuStar, Inc. >>>> >>>> >>>> >>>>> -----Original Message----- >>>>> From: Paul Kyzivat [mailto:pkyzivat@cisco.com] >>>>> Sent: Wednesday, April 06, 2005 2:31 PM >>>>> To: Peterson, Jon >>>>> Cc: sip@ietf.org >>>>> Subject: Re: [Sip] sip-identity-05: display-name woes >>>>> >>>> >>>> [snip] >>>> >>>> >>>>> I don't much like any of those alternatives. >>>>> >>>>> >>>>> >>>>>> Any better ideas, or barring that, any preferences among the >>>>>> above? >>>>> >>>>> (F) If the display name is present but unauthorized, >>>> >>> decline to sign the >>> >>>>> message. If the display-name is present and authorized, include it. >>>>> >>>> >>>> >> > > _______________________________________________ > Sip mailing list https://www1.ietf.org/mailman/listinfo/sip > This list is for NEW development of the core SIP Protocol > Use sip-implementors@cs.columbia.edu for questions on current sip > Use sipping@ietf.org for new developments on the application of sip > > > > > > _______________________________________________ > Sip mailing list https://www1.ietf.org/mailman/listinfo/sip > This list is for NEW development of the core SIP Protocol > Use sip-implementors@cs.columbia.edu for questions on current sip > Use sipping@ietf.org for new developments on the application of sip > _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Mon Apr 18 14:29:07 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DNazb-0006ji-6U; Mon, 18 Apr 2005 14:29:07 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DNazY-0006jd-Tc for sip@megatron.ietf.org; Mon, 18 Apr 2005 14:29:05 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA14372 for ; Mon, 18 Apr 2005 14:29:03 -0400 (EDT) Received: from pmesmtp04.mci.com ([199.249.20.36]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DNbAO-0001bp-S7 for sip@ietf.org; Mon, 18 Apr 2005 14:40:18 -0400 Received: from dgismtp01.wcomnet.com ([166.38.58.141]) by firewall.mci.com (Iplanet MTA 5.2) with ESMTP id <0IF500J2WNC36X@firewall.mci.com> for sip@ietf.org; Mon, 18 Apr 2005 18:28:51 +0000 (GMT) Received: from dgismtp01.wcomnet.com by dgismtp01.mcilink.com (iPlanet Messaging Server 5.2 HotFix 1.14 (built Mar 18 2003)) with SMTP id <0IF500I01NC37E@dgismtp01.mcilink.com>; Mon, 18 Apr 2005 18:28:51 +0000 (GMT) Received: from usashfe002.mcilink.com ([153.39.73.78]) by dgismtp01.mcilink.com (iPlanet Messaging Server 5.2 HotFix 1.14 (built Mar 18 2003)) with ESMTP id <0IF500HEXNC220@dgismtp01.mcilink.com>; Mon, 18 Apr 2005 18:28:50 +0000 (GMT) Received: from usashms001.mcilink.com ([153.39.82.129]) by usashfe002.mcilink.com with Microsoft SMTPSVC(6.0.3790.1830); Mon, 18 Apr 2005 18:28:50 +0000 Date: Mon, 18 Apr 2005 19:28:50 +0100 From: "Johnston, Alan" Subject: RE: [Sip] Re: SIP Refer Method To: Dean Willis Message-id: <40AF35183B110B4899DD3221904B6B58F4BE11@usashms001.mcilink.com> MIME-version: 1.0 X-MIMEOLE: Produced By Microsoft Exchange V6.5.7226.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: quoted-printable Content-class: urn:content-classes:message Thread-topic: [Sip] Re: SIP Refer Method Thread-index: AcVAvJLmY8f33zEWRza/CEXkBW1bHgDh5TLw X-OriginalArrivalTime: 18 Apr 2005 18:28:50.0655 (UTC) FILETIME=[77B20EF0:01C54444] X-Spam-Score: 0.0 (/) X-Scan-Signature: d0bdc596f8dd1c226c458f0b4df27a88 Content-Transfer-Encoding: quoted-printable Cc: sip@ietf.org, Ken.Sayers@redflex.com.au X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org Yes, it appeared suddenly after I inquired why it was not processed back in February when it was submitted... I will put out -05 shortly. Thanks, Alan Johnston sip:alan@sipstation.com > -----Original Message----- > From: Dean Willis [mailto:dean.willis@softarmor.com]=20 > Sent: Thursday, April 14, 2005 1:38 AM > To: Johnston, Alan > Cc: Ken.Sayers@redflex.com.au; sip@ietf.org > Subject: Re: [Sip] Re: SIP Refer Method >=20 >=20 >=20 > I have -04 at: >=20 > http://www.ietf.org/internet-drafts/draft-ietf-sipping-cc-transfer=20 > -04.txt >=20 > On Apr 12, 2005, at 11:49 AM, Johnston, Alan wrote: >=20 > > Hi Ken, > > > > The -04 version of the document was submitted back on 2/20 but=20 > > apparently not processed by the I-D editor... which perhaps explains > > why > > no one has commented on it ;-) > > > > We will get a new version out shortly which will be updated=20 > with the=20 > > Target-Dialog information as well. > > > > Thanks, > > Alan Johnston > > sip:alan@sipstation.com > > > >> -----Original Message----- > >> From: sip-bounces@ietf.org [mailto:sip-bounces@ietf.org]=20 > On Behalf Of=20 > >> Ken Sayers > >> Sent: Thursday, April 07, 2005 12:53 AM > >> To: sip@ietf.org > >> Subject: [Sip] Re: SIP Refer Method > >> > >> > >> Hi Joel et al > >> > >> I saw the response from Joel re the transfer method, but I noticed=20 > >> that the document referenced "Session Initiation Protocol Call=20 > >> Control - Transfer draft-ietf-sipping-cc-transfer-03" is due to=20 > >> expire in a couple of weeks. Does anyone know what will be the end=20 > >> result of this work? What is planned as far as putting=20 > this into an=20 > >> RFC? > >> > >> /Ken Sayers > >> > >> > > > > _______________________________________________ > > Sip mailing list https://www1.ietf.org/mailman/listinfo/sip > > This list is for NEW development of the core SIP Protocol > > Use sip-implementors@cs.columbia.edu for questions on=20 > current sip Use=20 > > sipping@ietf.org for new developments on the application of sip > > >=20 >=20 _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Mon Apr 18 14:56:44 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DNbQK-0000rz-FN; Mon, 18 Apr 2005 14:56:44 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DNbQJ-0000rp-9i for sip@megatron.ietf.org; Mon, 18 Apr 2005 14:56:43 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA17355 for ; Mon, 18 Apr 2005 14:56:41 -0400 (EDT) Received: from zrtps0kp.nortelnetworks.com ([47.140.192.56]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DNbbA-0002ua-Qi for sip@ietf.org; Mon, 18 Apr 2005 15:07:57 -0400 Received: from zrtpd0jn.us.nortel.com (zrtpd0jn.us.nortel.com [47.140.202.35]) by zrtps0kp.nortelnetworks.com (Switch-2.2.6/Switch-2.2.0) with ESMTP id j3IIuSp27839; Mon, 18 Apr 2005 14:56:28 -0400 (EDT) Received: by zrtpd0jn.us.nortel.com with Internet Mail Service (5.5.2653.19) id <2KL1051B>; Mon, 18 Apr 2005 14:56:28 -0400 Message-ID: <1ECE0EB50388174790F9694F77522CCF01F3ED6F@zrc2hxm0.corp.nortel.com> From: "Francois Audet" To: "'Peterson, Jon'" , "'Paul Kyzivat'" , "'Brian Rosen'" Subject: RE: [Sip] sip-identity-05: display-name woes Date: Mon, 18 Apr 2005 14:56:21 -0400 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2653.19) X-Spam-Score: 0.5 (/) X-Scan-Signature: bacfc6c7290e34d410f9bc22b825ce96 Cc: "'sip@ietf.org'" X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============1911857833==" Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. --===============1911857833== Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C54448.4FE8EEC7" This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. ------_=_NextPart_001_01C54448.4FE8EEC7 Content-Type: text/plain There is also the case where the ENUM database wouldn't have the Name of the end-user because a block of phone numbers are assigned to an organization (like a corporation). It this case, I'm assuming that the display name would be provided by the organization itself, but the SIP service provider would assert that the organization was allowed to populate the display name. Perhaps ENUM could be used to verify that, but it wouldn't be used to derive the name itself (just the owner). Is this what you had in mind? > -----Original Message----- > From: sip-bounces@ietf.org [mailto:sip-bounces@ietf.org] On > Behalf Of Peterson, Jon > Sent: Friday, April 08, 2005 12:54 > To: Paul Kyzivat; Brian Rosen > Cc: sip@ietf.org > Subject: RE: [Sip] sip-identity-05: display-name woes > > > > Some notes inline. > > Jon Peterson > NeuStar, Inc. > > > -----Original Message----- > > From: Paul Kyzivat [mailto:pkyzivat@cisco.com] > > Sent: Thursday, April 07, 2005 7:33 AM > > To: Brian Rosen > > Cc: Peterson, Jon; sip@ietf.org > > Subject: Re: [Sip] sip-identity-05: display-name woes > > > [snip] > > > > The most immediate problem I can see comes when your call lands on a > > gateway to the PSTN. At that point the identification > conventions of the > > SIP network must be interworked with those of the public telephone > > network. The gateway must decide whether to populate the > calling name > > and number fields on the PSTN side. If it has no > authentication that the > > information is correct, should it populate it? > > Let's be careful, though. If I'm calling from > sip:jon@example.com, what exactly does the gateway put in the > ISUP CgPN field, let alone what might it share as a textual > string in the GNP? That sort of SIP-ISUP mapping has bigger > problems than just how to deal with display-name. Clearly, if > the gateway is going to just make up a telephone number to > represent the calling party, all bets are off about how to > understand the GNP. > > Of course, the From header field of a SIP request might > contain a tel URI, or a SIP URI with a tel URI user portion. > But in that instance, provided it is a valid telephone > number, there is most likely a CNAM record associated with it > in the PSTN. Gateways or subsequent PSTN signaling elements > can always do CNAM queries to recover the associated > appropriate calling name to populate the GNP. But clearly > there's no point in even getting the CNAM if the telephone > number itself can just trivially be forged in SIP From header > fields. This gets into the whole question of why a gateway > would ever trust an Identity header that asserts a telephone > number. As sip-identity-04 suggests, that has to be a subject > for future work, but the only plausible lines of thought we > have on this today are ENUM architectures. > > By launching an ENUM query, the story might go, the gateway > could learn who the number owner is, and thus who should > provide the signature over the Identity information, and > conceivably the gateway could also learn info like CNAM at > the time. This would be tantamount to just reinventing CNAM > in an IP context - something that is probably inevitable if > telephone numbers are to be used extensively in SIP, > something that people are no doubt noodling in various shops > around the world today, and something that probably wouldn't > necessarily require signing the display-name in order for it to work. > > But until we boil that particular ocean, I feel that PSTN > interworking might not the best case on which to argue the > display-name issue one way or another. > > _______________________________________________ > Sip mailing list https://www1.ietf.org/mailman/listinfo/sip > This list is for NEW development of the core SIP Protocol > Use sip-implementors@cs.columbia.edu for questions on current > sip Use sipping@ietf.org for new developments on the > application of sip > > ------_=_NextPart_001_01C54448.4FE8EEC7 Content-Type: text/html RE: [Sip] sip-identity-05: display-name woes

There is also the case where the ENUM database wouldn't have the Name of the
end-user because a block of phone numbers are assigned to an organization (like
a corporation).

It this case, I'm assuming that the display name would be provided
by the organization itself, but the SIP service provider would
assert that the organization was allowed to populate the display name.

Perhaps ENUM could be used to verify that, but it wouldn't be used
to derive the name itself (just the owner).

Is this what you had in mind?

> -----Original Message-----
> From: sip-bounces@ietf.org [mailto:sip-bounces@ietf.org] On
> Behalf Of Peterson, Jon
> Sent: Friday, April 08, 2005 12:54
> To: Paul Kyzivat; Brian Rosen
> Cc: sip@ietf.org
> Subject: RE: [Sip] sip-identity-05: display-name woes
>
>
>
> Some notes inline.
>
> Jon Peterson
> NeuStar, Inc.
>
> > -----Original Message-----
> > From: Paul Kyzivat [mailto:pkyzivat@cisco.com]
> > Sent: Thursday, April 07, 2005 7:33 AM
> > To: Brian Rosen
> > Cc: Peterson, Jon; sip@ietf.org
> > Subject: Re: [Sip] sip-identity-05: display-name woes
> >
> [snip]
> >
> > The most immediate problem I can see comes when your call lands on a
> > gateway to the PSTN. At that point the identification
> conventions of the
> > SIP network must be interworked with those of the public telephone
> > network. The gateway must decide whether to populate the
> calling name
> > and number fields on the PSTN side. If it has no
> authentication that the
> > information is correct, should it populate it?
>
> Let's be careful, though. If I'm calling from
> sip:jon@example.com, what exactly does the gateway put in the
> ISUP CgPN field, let alone what might it share as a textual
> string in the GNP? That sort of SIP-ISUP mapping has bigger
> problems than just how to deal with display-name. Clearly, if
> the gateway is going to just make up a telephone number to
> represent the calling party, all bets are off about how to
> understand the GNP.
>
> Of course, the From header field of a SIP request might
> contain a tel URI, or a SIP URI with a tel URI user portion.
> But in that instance, provided it is a valid telephone
> number, there is most likely a CNAM record associated with it
> in the PSTN. Gateways or subsequent PSTN signaling elements
> can always do CNAM queries to recover the associated
> appropriate calling name to populate the GNP. But clearly
> there's no point in even getting the CNAM if the telephone
> number itself can just trivially be forged in SIP From header
> fields. This gets into the whole question of why a gateway
> would ever trust an Identity header that asserts a telephone
> number. As sip-identity-04 suggests, that has to be a subject
> for future work, but the only plausible lines of thought we
> have on this today are ENUM architectures.
>
> By launching an ENUM query, the story might go, the gateway
> could learn who the number owner is, and thus who should
> provide the signature over the Identity information, and
> conceivably the gateway could also learn info like CNAM at
> the time. This would be tantamount to just reinventing CNAM
> in an IP context - something that is probably inevitable if
> telephone numbers are to be used extensively in SIP,
> something that people are no doubt noodling in various shops
> around the world today, and something that probably wouldn't
> necessarily require signing the display-name in order for it to work.
>
> But until we boil that particular ocean, I feel that PSTN
> interworking might not the best case on which to argue the
> display-name issue one way or another.
>
> _______________________________________________
> Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
> This list is for NEW development of the core SIP Protocol
> Use sip-implementors@cs.columbia.edu for questions on current
> sip Use sipping@ietf.org for new developments on the
> application of sip
>
>

------_=_NextPart_001_01C54448.4FE8EEC7-- --===============1911857833== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip --===============1911857833==-- From sip-bounces@ietf.org Mon Apr 18 18:02:39 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DNeKF-0006SW-L3; Mon, 18 Apr 2005 18:02:39 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DNeKD-0006SR-Au for sip@megatron.ietf.org; Mon, 18 Apr 2005 18:02:37 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA16457 for ; Mon, 18 Apr 2005 18:02:34 -0400 (EDT) Received: from sj-iport-2-in.cisco.com ([171.71.176.71] helo=sj-iport-2.cisco.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DNeV5-0005pn-CQ for sip@ietf.org; Mon, 18 Apr 2005 18:13:52 -0400 Received: from sj-core-1.cisco.com (171.71.177.237) by sj-iport-2.cisco.com with ESMTP; 18 Apr 2005 15:02:27 -0700 Received: from imail.cisco.com (imail.cisco.com [128.107.200.91]) by sj-core-1.cisco.com (8.12.10/8.12.6) with ESMTP id j3IM2N2w010148; Mon, 18 Apr 2005 15:02:24 -0700 (PDT) Received: from thomasm-lnx.cisco.com (thomasm-lnx.cisco.com [171.71.96.50]) by imail.cisco.com (8.12.11/8.12.10) with ESMTP id j3ILrV2i016493; Mon, 18 Apr 2005 14:53:31 -0700 Subject: RE: [Sip] sip-identity-05: display-name woes From: Michael Thomas To: Francois Audet In-Reply-To: <1ECE0EB50388174790F9694F77522CCF01F3ED6F@zrc2hxm0.corp.nortel.com> References: <1ECE0EB50388174790F9694F77522CCF01F3ED6F@zrc2hxm0.corp.nortel.com> Organization: Cisco Systems Message-Id: <1113861742.32605.13.camel@thomasm-lnx.cisco.com> Mime-Version: 1.0 X-Mailer: Ximian Evolution 1.4.6 Date: Mon, 18 Apr 2005 15:02:22 -0700 IIM-SIG: v:"1.1"; h:"imail.cisco.com"; d:"cisco.com"; z:"home"; m:"krs"; t:"1113861212.119657"; x:"432200"; a:"rsa-sha1"; b:"nofws:4940"; e:"Iw=="; n:"sQYarK2E51MdcTiUqeif3F7cWdxIfoCiXhdfb9vD5ee/j0jXL15gbFxF2p" "XIweAblu0N6XAgK7k+wrbr7bQDJaCDqOmzqpRUBjIRQAXQ7NzadpmR3pUL6wxaRUtW+c43sl9jC" "50Qg1sXHpPjt8Y+Y16ioyQAQAdSunM4YhevURc="; s:"HgOR6ni+X/Y3Z2PVrFO2AhXs6C1fFqieQW6IeJwu+XoaC0r7gewZ5c6jc+/Oa6OEZThw+O1W" "Obn/wSUok3wktk4wA3bho5zVNCEdBvSmLGr6/4r2CnXG71SgFOp313GzjWOXnotzo/v4BNRxZob" "Z2SZ3stubgCKfOilZKHBsjmc="; c:"Subject: RE: [Sip] sip-identity-05: display-name woes"; c:"From: Michael Thomas "; c:"Date: Mon, 18 Apr 2005 15:02:22 -0700" IIM-VERIFY: s:"y"; v:"y"; r:"60"; h:"imail.cisco.com"; c:"message from imail.cisco.com verified; " X-Spam-Score: 0.0 (/) X-Scan-Signature: 789c141a303c09204b537a4078e2a63f Cc: "'sip@ietf.org'" , 'Paul Kyzivat' , "'Peterson, Jon'" X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============0069468886==" Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org --===============0069468886== Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="=-8fl7sN6D7Db3ORN+CkJj" --=-8fl7sN6D7Db3ORN+CkJj Content-Type: text/plain Content-Transfer-Encoding: quoted-printable On Mon, 2005-04-18 at 11:56, Francois Audet wrote: > There is also the case where the ENUM database wouldn't have the Name > of the > end-user because a block of phone numbers are assigned to an > organization (like > a corporation). >=20 > It this case, I'm assuming that the display name would be provided > by the organization itself, but the SIP service provider would > assert that the organization was allowed to populate the display name. This strikes me as most likely broken: it relies on transitive trust, for one thing. And it also implies=20 that there's some sort of trusted intermediary, which is not always the case; nor should it be *required* to be the case to get the desired authorization characteristics. Much better would be for a way for the name space owner to assert whether something using its name space is authorized or not to be sending on its behalf. And DNSsec alone for ENUM doesn't provide this since DNSsec is a=20 source authentication scheme, not a source authorization=20 service. Of course, I think that sip-identity suffers from the same problem... Mike >=20 > Perhaps ENUM could be used to verify that, but it wouldn't be used > to derive the name itself (just the owner). >=20 > Is this what you had in mind? >=20 > > -----Original Message----- > > From: sip-bounces@ietf.org [mailto:sip-bounces@ietf.org] On=20 > > Behalf Of Peterson, Jon > > Sent: Friday, April 08, 2005 12:54 > > To: Paul Kyzivat; Brian Rosen > > Cc: sip@ietf.org > > Subject: RE: [Sip] sip-identity-05: display-name woes > >=20 > >=20 > >=20 > > Some notes inline. > >=20 > > Jon Peterson > > NeuStar, Inc. > >=20 > > > -----Original Message----- > > > From: Paul Kyzivat [mailto:pkyzivat@cisco.com] > > > Sent: Thursday, April 07, 2005 7:33 AM > > > To: Brian Rosen > > > Cc: Peterson, Jon; sip@ietf.org > > > Subject: Re: [Sip] sip-identity-05: display-name woes > > >=20 > > [snip] > > >=20 > > > The most immediate problem I can see comes when your call lands on > a > > > gateway to the PSTN. At that point the identification=20 > > conventions of the=20 > > > SIP network must be interworked with those of the public telephone > > > network. The gateway must decide whether to populate the=20 > > calling name=20 > > > and number fields on the PSTN side. If it has no=20 > > authentication that the=20 > > > information is correct, should it populate it?=20 > >=20 > > Let's be careful, though. If I'm calling from=20 > > sip:jon@example.com, what exactly does the gateway put in the=20 > > ISUP CgPN field, let alone what might it share as a textual=20 > > string in the GNP? That sort of SIP-ISUP mapping has bigger=20 > > problems than just how to deal with display-name. Clearly, if=20 > > the gateway is going to just make up a telephone number to=20 > > represent the calling party, all bets are off about how to=20 > > understand the GNP. > >=20 > > Of course, the From header field of a SIP request might=20 > > contain a tel URI, or a SIP URI with a tel URI user portion.=20 > > But in that instance, provided it is a valid telephone=20 > > number, there is most likely a CNAM record associated with it=20 > > in the PSTN. Gateways or subsequent PSTN signaling elements=20 > > can always do CNAM queries to recover the associated=20 > > appropriate calling name to populate the GNP. But clearly=20 > > there's no point in even getting the CNAM if the telephone=20 > > number itself can just trivially be forged in SIP From header=20 > > fields. This gets into the whole question of why a gateway=20 > > would ever trust an Identity header that asserts a telephone=20 > > number. As sip-identity-04 suggests, that has to be a subject=20 > > for future work, but the only plausible lines of thought we=20 > > have on this today are ENUM architectures. > >=20 > > By launching an ENUM query, the story might go, the gateway=20 > > could learn who the number owner is, and thus who should=20 > > provide the signature over the Identity information, and=20 > > conceivably the gateway could also learn info like CNAM at=20 > > the time. This would be tantamount to just reinventing CNAM=20 > > in an IP context - something that is probably inevitable if=20 > > telephone numbers are to be used extensively in SIP,=20 > > something that people are no doubt noodling in various shops=20 > > around the world today, and something that probably wouldn't=20 > > necessarily require signing the display-name in order for it to > work. > >=20 > > But until we boil that particular ocean, I feel that PSTN=20 > > interworking might not the best case on which to argue the=20 > > display-name issue one way or another.=20 > >=20 > > _______________________________________________ > > Sip mailing list https://www1.ietf.org/mailman/listinfo/sip > > This list is for NEW development of the core SIP Protocol > > Use sip-implementors@cs.columbia.edu for questions on current=20 > > sip Use sipping@ietf.org for new developments on the=20 > > application of sip > >=20 > >=20 >=20 >=20 >=20 > ______________________________________________________________________ > _______________________________________________ > Sip mailing list https://www1.ietf.org/mailman/listinfo/sip > This list is for NEW development of the core SIP Protocol > Use sip-implementors@cs.columbia.edu for questions on current sip > Use sipping@ietf.org for new developments on the application of sip --=-8fl7sN6D7Db3ORN+CkJj Content-Type: application/pgp-signature; name=signature.asc Content-Description: This is a digitally signed message part -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.3 (GNU/Linux) iQCVAwUAQmQubrMsDAj/Eq++AQIS+QP+ICRY4JObZtSCS+tiD1Zx6MnXbHtygWb+ g1aZoN35t0DO7SIwEE1n/BNId7SepjAs+Udtw2XGgGJ4Zbl15zWtpY0/uDgEiJ+M fTn1p62Bgi9snqT1v9sAZnUgT2keLWobc78zz6qdS0Ves76Ldul4KnBDsiNtqrZo TP6rtbMriPM= =7GsN -----END PGP SIGNATURE----- --=-8fl7sN6D7Db3ORN+CkJj-- --===============0069468886== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip --===============0069468886==-- From sip-bounces@ietf.org Mon Apr 18 18:09:46 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DNeR7-0006hQ-Rm; Mon, 18 Apr 2005 18:09:45 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DNeR5-0006dJ-Kk for sip@megatron.ietf.org; Mon, 18 Apr 2005 18:09:43 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA17310 for ; Mon, 18 Apr 2005 18:09:41 -0400 (EDT) Received: from sj-iport-1-in.cisco.com ([171.71.176.70] helo=sj-iport-1.cisco.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DNebw-00062s-2V for sip@ietf.org; Mon, 18 Apr 2005 18:20:56 -0400 Received: from sj-core-1.cisco.com (171.71.177.237) by sj-iport-1.cisco.com with ESMTP; 18 Apr 2005 15:09:31 -0700 X-IronPort-AV: i="3.92,111,1112598000"; d="asc'?scan'208"; a="630076938:sNHT44518486" Received: from imail.cisco.com (imail.cisco.com [128.107.200.91]) by sj-core-1.cisco.com (8.12.10/8.12.6) with ESMTP id j3IM9P2w017397; Mon, 18 Apr 2005 15:09:25 -0700 (PDT) Received: from thomasm-lnx.cisco.com (thomasm-lnx.cisco.com [171.71.96.50]) by imail.cisco.com (8.12.11/8.12.10) with ESMTP id j3IM0akB016598; Mon, 18 Apr 2005 15:00:36 -0700 Subject: Re: [Sip] sip-identity-05: display-name woes From: Michael Thomas To: Hisham Khartabil In-Reply-To: <3efd5821d4f6d32e012641d801877321@telio.no> References: <200504071336.JAA22655@ietf.org> <3efd5821d4f6d32e012641d801877321@telio.no> Organization: Cisco Systems Message-Id: <1113862167.32605.20.camel@thomasm-lnx.cisco.com> Mime-Version: 1.0 X-Mailer: Ximian Evolution 1.4.6 Date: Mon, 18 Apr 2005 15:09:27 -0700 IIM-SIG: v:"1.1"; h:"imail.cisco.com"; d:"cisco.com"; z:"home"; m:"krs"; t:"1113861636.364864"; x:"432200"; a:"rsa-sha1"; b:"nofws:1310"; e:"Iw=="; n:"sQYarK2E51MdcTiUqeif3F7cWdxIfoCiXhdfb9vD5ee/j0jXL15gbFxF2p" "XIweAblu0N6XAgK7k+wrbr7bQDJaCDqOmzqpRUBjIRQAXQ7NzadpmR3pUL6wxaRUtW+c43sl9jC" "50Qg1sXHpPjt8Y+Y16ioyQAQAdSunM4YhevURc="; s:"ZffoK9cT4M3Tou+lXwWk7qy7KrLzFpuzqQbsNI5QtpVffvgDHa72C8GJlTa20GRwDYL6UXyv" "1NxRkq2kkwo98eBc8yWfOjhuDSVhXVVyTQBv+yCnF2yXF+SZTK18l0I2fyjN1xwvwOnbyHeDTD3" "Xl6mLviUc68qmGisEBofMlYk="; c:"Subject: Re: [Sip] sip-identity-05: display-name woes"; c:"From: Michael Thomas "; c:"Date: Mon, 18 Apr 2005 15:09:27 -0700" IIM-VERIFY: s:"y"; v:"y"; r:"60"; h:"imail.cisco.com"; c:"message from imail.cisco.com verified; " X-Spam-Score: 0.0 (/) X-Scan-Signature: a7d6aff76b15f3f56fcb94490e1052e4 Cc: sip@ietf.org, 'Paul Kyzivat' , "'Peterson, Jon'" X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============1019560354==" Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org --===============1019560354== Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="=-+TrhZMzjxrXbML4+eXw7" --=-+TrhZMzjxrXbML4+eXw7 Content-Type: text/plain Content-Transfer-Encoding: quoted-printable On Mon, 2005-04-18 at 08:17, Hisham Khartabil wrote: > Brian does have some point in what he's saying. Usually, the number is=20 > displayed (the sip address in out case) unless the receiver has the=20 > caller in the address book. In this case the name displayed is the one=20 > in the local address book. But is it too late to think that way? It=20 > probably is since a lot of implementations out there already display=20 > the Display Name in the From header field, but we could recommend=20 > against it. I think that people are tempting the fates if they think that proscriptions against misuse buried in some arcane RFC will stop developers from putting juicy identity bits in front their users. Even if it's really, really stupid. And insecure.=20 And SIP is not just about voice rendezvous. Imagine a proscription on an IM user agent against putting a=20 display name in front of their user. It's not only ludicrous, it would make the protocol useless. Mike --=-+TrhZMzjxrXbML4+eXw7 Content-Type: application/pgp-signature; name=signature.asc Content-Description: This is a digitally signed message part -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.3 (GNU/Linux) iQCVAwUAQmQwF7MsDAj/Eq++AQK6cgP/YEfKWMy5iefTI5oGr90XnTMKenRCQYfp PpnNUcXcQu5b0qYHVzAL5Jww96JgT54nqaILeaMC2ypVovy+0rw+TJ82sNqYMBPm y04b3Uf8uZziiWdQXj33+fZM+6Htviru1KO+KPl1KKAC5XTjXTkOMvG0Vkuw+hyQ 8+E5F5wCJWE= =wcHS -----END PGP SIGNATURE----- --=-+TrhZMzjxrXbML4+eXw7-- --===============1019560354== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip --===============1019560354==-- From sip-bounces@ietf.org Mon Apr 18 18:51:08 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DNf5A-000562-TY; Mon, 18 Apr 2005 18:51:08 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DNf59-00055u-6h for sip@megatron.ietf.org; Mon, 18 Apr 2005 18:51:07 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA20918 for ; Mon, 18 Apr 2005 18:51:04 -0400 (EDT) Received: from rtp-iport-2.cisco.com ([64.102.122.149]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DNfG1-0007yk-K2 for sip@ietf.org; Mon, 18 Apr 2005 19:02:23 -0400 Received: from rtp-core-1.cisco.com (64.102.124.12) by rtp-iport-2.cisco.com with ESMTP; 18 Apr 2005 18:50:57 -0400 Received: from flask.cisco.com (IDENT:mirapoint@flask.cisco.com [161.44.122.62]) by rtp-core-1.cisco.com (8.12.10/8.12.6) with ESMTP id j3IMorRQ026133; Mon, 18 Apr 2005 18:50:54 -0400 (EDT) Received: from cisco.com ([161.44.79.173]) by flask.cisco.com (MOS 3.4.6-GR) with ESMTP id AQS29230; Mon, 18 Apr 2005 18:50:52 -0400 (EDT) Message-ID: <426439CC.2000704@cisco.com> Date: Mon, 18 Apr 2005 18:50:52 -0400 From: Paul Kyzivat User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.1) Gecko/20020826 X-Accept-Language: en-us, en MIME-Version: 1.0 To: Michael Thomas Subject: Re: [Sip] sip-identity-05: display-name woes References: <200504071336.JAA22655@ietf.org> <3efd5821d4f6d32e012641d801877321@telio.no> <1113862167.32605.20.camel@thomasm-lnx.cisco.com> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Score: 0.0 (/) X-Scan-Signature: c1c65599517f9ac32519d043c37c5336 Content-Transfer-Encoding: 7bit Cc: sip@ietf.org, "'Peterson, Jon'" X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org I agree. One way or another I think we need to have an approach caller id and calling name that works at least as well and reliably as it does in the PSTN, and that does so whether going between two sip endpoints in different domains, or between a sip endpoint and a PSTN gateway. And it needs to do this whether you are using sip native URIs or telephone numbers. For telephone numbers there probably must be consistency with what happens for PSTN-PSTN calls. For sip native addresses there may be some wiggle room about how it should work, but I think people will want the same level of trust with either kind of address. Paul Michael Thomas wrote: > On Mon, 2005-04-18 at 08:17, Hisham Khartabil wrote: > >>Brian does have some point in what he's saying. Usually, the number is >>displayed (the sip address in out case) unless the receiver has the >>caller in the address book. In this case the name displayed is the one >>in the local address book. But is it too late to think that way? It >>probably is since a lot of implementations out there already display >>the Display Name in the From header field, but we could recommend >>against it. > > > I think that people are tempting the fates if they > think that proscriptions against misuse buried in > some arcane RFC will stop developers from putting > juicy identity bits in front their users. Even if it's > really, really stupid. And insecure. > > And SIP is not just about voice rendezvous. Imagine a > proscription on an IM user agent against putting a > display name in front of their user. It's not only > ludicrous, it would make the protocol useless. > > Mike > > > ------------------------------------------------------------------------ > > _______________________________________________ > Sip mailing list https://www1.ietf.org/mailman/listinfo/sip > This list is for NEW development of the core SIP Protocol > Use sip-implementors@cs.columbia.edu for questions on current sip > Use sipping@ietf.org for new developments on the application of sip _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Tue Apr 19 04:43:41 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DNoKW-0000KK-7t; Tue, 19 Apr 2005 04:43:36 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DNoKT-0000KF-4C for sip@megatron.ietf.org; Tue, 19 Apr 2005 04:43:34 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id EAA18091 for ; Tue, 19 Apr 2005 04:43:28 -0400 (EDT) Received: from oak.neustar.com ([209.173.53.70]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DNoVP-0003pU-Mo for sip@ietf.org; Tue, 19 Apr 2005 04:54:52 -0400 Received: from stntsmtp1.cis.neustar.com (smartexch.neustar.com [10.31.13.79]) by oak.neustar.com (8.12.8/8.11.0) with ESMTP id j3J8hHKD028397; Tue, 19 Apr 2005 08:43:17 GMT Received: from stntexch03.cis.neustar.com ([10.31.13.45]) by stntsmtp1.cis.neustar.com with Microsoft SMTPSVC(6.0.3790.211); Tue, 19 Apr 2005 04:43:17 -0400 X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0 Content-class: urn:content-classes:message MIME-Version: 1.0 Subject: RE: [Sip] sip-identity-05: display-name woes Date: Tue, 19 Apr 2005 04:43:16 -0400 Message-ID: <24EAE5D4448B9D4592C6D234CBEBD59701502E37@stntexch03.cis.neustar.com> Thread-Topic: [Sip] sip-identity-05: display-name woes Thread-Index: AcVESHRQMPhQmKchTZuOyTG+Xxah2QATjsbQ From: "Peterson, Jon" To: "Francois Audet" , "Paul Kyzivat" , "Brian Rosen" X-OriginalArrivalTime: 19 Apr 2005 08:43:17.0154 (UTC) FILETIME=[D4E90020:01C544BB] X-Spam-Score: 0.6 (/) X-Scan-Signature: 73948e4d005645343fd08e813e5615ef Cc: sip@ietf.org X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============1215536158==" Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org This is a multi-part message in MIME format. --===============1215536158== Content-class: urn:content-classes:message Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C544BB.D4808605" This is a multi-part message in MIME format. ------_=_NextPart_001_01C544BB.D4808605 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable =20 Understand that most of what I wrote below was intended only to support = the design decision that identity for telephone numbers is out of scope = for the current sip-identity draft, and thus that TNs wouldn't serve as = a clear argument about display-names one way or another. So, this is all = just hypotheticals. =20 Currently, the ENUM database has no capability whatsoever to provide = names of end users; any such capability would need to be invented before = it could be leveraged. Presumably, if a block of phone numbers is = delegated to an organization with ENUM, it is the responsibility of that = organization to populate any and all ENUM records, including any = hypothetical records that assisted in providing names for end users. = Note that in many principalities, organizations are not allowed to "own" = telephone numbers, only carriers have that privilege. In such contexts = the idea of, say, an enterprise being responsible for this function = wouldn't make any sense. =20 Strictly following my logic below, in a case where an organization is = responsible for a block of telephone numbers in ENUM, they would be the = appropriate signatory for any and all authentication service = responsibilities when telephone numbers are used in the From header = field of SIP requests. Thus, ENUM could be used to discover the = organization responsible for the number, yes, and so to determine who is = eligible to provide an authentication service for the user in question. = While it could theoretically be used furthermore to derive the = appropriate name, if we were to invent such a mechanism, this would be a = separable capability. =20 Jon Peterson NeuStar, Inc. -----Original Message----- From: Francois Audet [mailto:audet@nortel.com] Sent: Monday, April 18, 2005 11:56 AM To: Peterson, Jon; 'Paul Kyzivat'; 'Brian Rosen' Cc: 'sip@ietf.org' Subject: RE: [Sip] sip-identity-05: display-name woes There is also the case where the ENUM database wouldn't have the Name of = the=20 end-user because a block of phone numbers are assigned to an = organization (like=20 a corporation).=20 It this case, I'm assuming that the display name would be provided=20 by the organization itself, but the SIP service provider would=20 assert that the organization was allowed to populate the display name.=20 Perhaps ENUM could be used to verify that, but it wouldn't be used=20 to derive the name itself (just the owner).=20 Is this what you had in mind?=20 > -----Original Message-----=20 > From: sip-bounces@ietf.org [ mailto:sip-bounces@ietf.org] On=20 > Behalf Of Peterson, Jon=20 > Sent: Friday, April 08, 2005 12:54=20 > To: Paul Kyzivat; Brian Rosen=20 > Cc: sip@ietf.org=20 > Subject: RE: [Sip] sip-identity-05: display-name woes=20 >=20 >=20 >=20 > Some notes inline.=20 >=20 > Jon Peterson=20 > NeuStar, Inc.=20 >=20 > > -----Original Message-----=20 > > From: Paul Kyzivat [ mailto:pkyzivat@cisco.com]=20 > > Sent: Thursday, April 07, 2005 7:33 AM=20 > > To: Brian Rosen=20 > > Cc: Peterson, Jon; sip@ietf.org=20 > > Subject: Re: [Sip] sip-identity-05: display-name woes=20 > >=20 > [snip]=20 > >=20 > > The most immediate problem I can see comes when your call lands on a = > > gateway to the PSTN. At that point the identification=20 > conventions of the=20 > > SIP network must be interworked with those of the public telephone=20 > > network. The gateway must decide whether to populate the=20 > calling name=20 > > and number fields on the PSTN side. If it has no=20 > authentication that the=20 > > information is correct, should it populate it?=20 >=20 > Let's be careful, though. If I'm calling from=20 > sip:jon@example.com, what exactly does the gateway put in the=20 > ISUP CgPN field, let alone what might it share as a textual=20 > string in the GNP? That sort of SIP-ISUP mapping has bigger=20 > problems than just how to deal with display-name. Clearly, if=20 > the gateway is going to just make up a telephone number to=20 > represent the calling party, all bets are off about how to=20 > understand the GNP.=20 >=20 > Of course, the From header field of a SIP request might=20 > contain a tel URI, or a SIP URI with a tel URI user portion.=20 > But in that instance, provided it is a valid telephone=20 > number, there is most likely a CNAM record associated with it=20 > in the PSTN. Gateways or subsequent PSTN signaling elements=20 > can always do CNAM queries to recover the associated=20 > appropriate calling name to populate the GNP. But clearly=20 > there's no point in even getting the CNAM if the telephone=20 > number itself can just trivially be forged in SIP From header=20 > fields. This gets into the whole question of why a gateway=20 > would ever trust an Identity header that asserts a telephone=20 > number. As sip-identity-04 suggests, that has to be a subject=20 > for future work, but the only plausible lines of thought we=20 > have on this today are ENUM architectures.=20 >=20 > By launching an ENUM query, the story might go, the gateway=20 > could learn who the number owner is, and thus who should=20 > provide the signature over the Identity information, and=20 > conceivably the gateway could also learn info like CNAM at=20 > the time. This would be tantamount to just reinventing CNAM=20 > in an IP context - something that is probably inevitable if=20 > telephone numbers are to be used extensively in SIP,=20 > something that people are no doubt noodling in various shops=20 > around the world today, and something that probably wouldn't=20 > necessarily require signing the display-name in order for it to work.=20 >=20 > But until we boil that particular ocean, I feel that PSTN=20 > interworking might not the best case on which to argue the=20 > display-name issue one way or another.=20 >=20 > _______________________________________________=20 > Sip mailing list https://www1.ietf.org/mailman/listinfo/sip=20 > This list is for NEW development of the core SIP Protocol=20 > Use sip-implementors@cs.columbia.edu for questions on current=20 > sip Use sipping@ietf.org for new developments on the=20 > application of sip=20 >=20 >=20 ------_=_NextPart_001_01C544BB.D4808605 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable RE: [Sip] sip-identity-05: display-name woes
 
Understand that most of what I wrote below = was intended=20 only to support the design decision that identity for telephone numbers = is out=20 of scope for the current sip-identity draft, and thus that TNs wouldn't = serve as=20 a clear argument about display-names one way or another. So, this is all = just=20 hypotheticals.
 
Currently, the ENUM database has no = capability=20 whatsoever to provide names of end users; any such capability would need = to be=20 invented before it could be leveraged. Presumably, if a block of phone = numbers=20 is delegated to an organization with ENUM, it is the responsibility of = that=20 organization to populate any and all ENUM records, including any = hypothetical=20 records that assisted in providing names for end users. Note that in = many=20 principalities, organizations are not allowed to "own" telephone = numbers, only=20 carriers have that privilege. In such contexts the idea of, say, an = enterprise=20 being responsible for this function wouldn't make any = sense.
 
Strictly following my logic below, in a case = where an=20 organization is responsible for a block of telephone numbers in ENUM, = they would=20 be the appropriate signatory for any and all authentication service=20 responsibilities when telephone numbers are used in the From header = field of SIP=20 requests. Thus, ENUM could be used to discover the organization = responsible for=20 the number, yes, and so to determine who is eligible to provide an=20 authentication service for the user in question. While it could = theoretically be=20 used furthermore to derive the appropriate name, if we were to invent = such a=20 mechanism, this would be a separable capability.
 
Jon=20 Peterson
NeuStar, Inc.
-----Original Message-----
From: Francois Audet=20 [mailto:audet@nortel.com]
Sent: Monday, April 18, 2005 11:56 = AM
To: Peterson, Jon; 'Paul Kyzivat'; 'Brian = Rosen'
Cc:=20 'sip@ietf.org'
Subject: RE: [Sip] sip-identity-05: = display-name=20 woes

There is also the case where the ENUM database = wouldn't have=20 the Name of the
end-user because a block of = phone=20 numbers are assigned to an organization (like
a=20 corporation).

It this case, I'm assuming that the display name = would be=20 provided
by the organization itself, but the = SIP=20 service provider would
assert that the = organization=20 was allowed to populate the display name.

Perhaps ENUM could be used to verify that, but it = wouldn't be=20 used
to derive the name itself (just the=20 owner).

Is this what you had in mind?

> -----Original Message-----
>=20 From: sip-bounces@ietf.org [mailto:sip-bounces@ietf.org] = On=20
> Behalf Of Peterson, Jon =
> Sent: Friday, April 08, 2005 12:54

>=20 To: Paul Kyzivat; Brian Rosen
> Cc:=20 sip@ietf.org
> Subject: RE: [Sip] = sip-identity-05:=20 display-name woes
>
>=20
>
> Some = notes=20 inline.
>
> = Jon=20 Peterson
> NeuStar, Inc.
>
> > -----Original=20 Message-----
> > From: Paul Kyzivat = [mailto:pkyzivat@cisco.com] =
> > Sent: Thursday, April 07, 2005 7:33 = AM=20
> > To: Brian Rosen
> >=20 Cc: Peterson, Jon; sip@ietf.org
> > = Subject: Re:=20 [Sip] sip-identity-05: display-name woes
> >=20
> [snip]
> = >=20
> > The most immediate problem I can = see comes=20 when your call lands on a
> > gateway = to the=20 PSTN. At that point the identification
>=20 conventions of the
> > SIP network = must be=20 interworked with those of the public telephone
>=20 > network. The gateway must decide whether to populate the =
> calling name

> > and = number fields=20 on the PSTN side. If it has no
> = authentication=20 that the
> > information is correct, = should it=20 populate it?
>
> Let's=20 be careful, though. If I'm calling from
> = sip:jon@example.com, what exactly does the gateway put in the =
> ISUP CgPN field, let alone what might it share as a = textual=20

> string in the GNP? That sort of = SIP-ISUP mapping=20 has bigger
> problems than just how to = deal with=20 display-name. Clearly, if
> the gateway = is going to=20 just make up a telephone number to
> = represent the=20 calling party, all bets are off about how to
>=20 understand the GNP.
>
>=20 Of course, the From header field of a SIP request might =
> contain a tel URI, or a SIP URI with a tel URI user = portion.=20

> But in that instance, provided it is a = valid=20 telephone
> number, there is most likely = a CNAM=20 record associated with it
> in the PSTN. = Gateways=20 or subsequent PSTN signaling elements
> = can always=20 do CNAM queries to recover the associated
>=20 appropriate calling name to populate the GNP. But clearly =
> there's no point in even getting the CNAM if the = telephone=20
> number itself can just trivially be = forged in SIP=20 From header
> fields. This gets into the = whole=20 question of why a gateway
> would ever = trust an=20 Identity header that asserts a telephone
> number.=20 As sip-identity-04 suggests, that has to be a subject
> for future work, but the only plausible lines of thought = we=20
> have on this today are ENUM = architectures.=20
>
> By launching an = ENUM query,=20 the story might go, the gateway
> could = learn who=20 the number owner is, and thus who should
> provide=20 the signature over the Identity information, and
>=20 conceivably the gateway could also learn info like CNAM at =
> the time. This would be tantamount to just reinventing = CNAM=20
> in an IP context - something that is = probably=20 inevitable if
> telephone numbers are to = be used=20 extensively in SIP,
> something that = people are no=20 doubt noodling in various shops
> around = the world=20 today, and something that probably wouldn't
>=20 necessarily require signing the display-name in order for it to = work.=20
>
> But until we = boil that=20 particular ocean, I feel that PSTN
> = interworking=20 might not the best case on which to argue the
>=20 display-name issue one way or another.
>=20
>=20 _______________________________________________
>=20 Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip =
> This list is for NEW development of the core SIP = Protocol=20
> Use sip-implementors@cs.columbia.edu for = questions on=20 current
> sip Use sipping@ietf.org for = new=20 developments on the
> application of = sip=20
>
>=20

------_=_NextPart_001_01C544BB.D4808605-- --===============1215536158== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip --===============1215536158==-- From sip-bounces@ietf.org Tue Apr 19 04:46:22 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DNoNA-0000o8-Gc; Tue, 19 Apr 2005 04:46:20 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DNoN8-0000nZ-06 for sip@megatron.ietf.org; Tue, 19 Apr 2005 04:46:18 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id EAA18413 for ; Tue, 19 Apr 2005 04:46:15 -0400 (EDT) Received: from oak.neustar.com ([209.173.53.70]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DNoY7-0003vn-6M for sip@ietf.org; Tue, 19 Apr 2005 04:57:39 -0400 Received: from stntsmtp1.cis.neustar.com (smartexch.neustar.com [10.31.13.79]) by oak.neustar.com (8.12.8/8.11.0) with ESMTP id j3J8jtKD028459; Tue, 19 Apr 2005 08:45:55 GMT Received: from stntexch03.cis.neustar.com ([10.31.13.45]) by stntsmtp1.cis.neustar.com with Microsoft SMTPSVC(6.0.3790.211); Tue, 19 Apr 2005 04:45:55 -0400 X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Subject: RE: [Sip] sip-identity-05: display-name woes Date: Tue, 19 Apr 2005 04:45:55 -0400 Message-ID: <24EAE5D4448B9D4592C6D234CBEBD59701502E38@stntexch03.cis.neustar.com> Thread-Topic: [Sip] sip-identity-05: display-name woes Thread-Index: AcVEYk+q6xYFwjL7R7q/VAPceHho+QANFBOw From: "Peterson, Jon" To: "Michael Thomas" , "Francois Audet" X-OriginalArrivalTime: 19 Apr 2005 08:45:55.0744 (UTC) FILETIME=[336FEA00:01C544BC] X-Spam-Score: 0.0 (/) X-Scan-Signature: 8abaac9e10c826e8252866cbe6766464 Content-Transfer-Encoding: quoted-printable Cc: sip@ietf.org, Paul Kyzivat X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org Mike, I'm not sure why you think sip-identity suffers from the same problem. = The presence of an Identity header signifies that the owner of a = namespace (the signer of the hash) authorizes the use of the name = populating the From header field. The Identity header exists for no = other purpose. So what exactly is the problem? Jon Peterson NeuStar, Inc. > -----Original Message----- > From: Michael Thomas [mailto:mat@cisco.com] > Sent: Monday, April 18, 2005 3:02 PM > To: Francois Audet > Cc: Peterson, Jon; 'Paul Kyzivat'; 'Brian Rosen'; 'sip@ietf.org' > Subject: RE: [Sip] sip-identity-05: display-name woes >=20 [snip] >=20 > Much better would be for a way for the name space owner > to assert whether something using its name space is > authorized or not to be sending on its behalf. And DNSsec > alone for ENUM doesn't provide this since DNSsec is a=20 > source authentication scheme, not a source authorization=20 > service. >=20 > Of course, I think that sip-identity suffers from the > same problem... >=20 > Mike=20 _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Tue Apr 19 07:27:53 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DNqtV-0006T7-H2; Tue, 19 Apr 2005 07:27:53 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DNqtT-0006Sy-39 for sip@megatron.ietf.org; Tue, 19 Apr 2005 07:27:51 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA29703 for ; Tue, 19 Apr 2005 07:27:49 -0400 (EDT) Message-Id: <200504191127.HAA29703@ietf.org> Received: from dx28.winwebhosting.com ([70.85.77.84]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DNr4T-0001rX-Hc for sip@ietf.org; Tue, 19 Apr 2005 07:39:13 -0400 Received: from acs-24-154-127-163.zoominternet.net ([24.154.127.163] helo=BROSENLT) by dx28.winwebhosting.com with esmtpa (Exim 4.44) id 1DNqt9-0006F4-HM; Tue, 19 Apr 2005 06:27:31 -0500 From: "Brian Rosen" To: "'Paul Kyzivat'" , "'Michael Thomas'" Subject: RE: [Sip] sip-identity-05: display-name woes Date: Tue, 19 Apr 2005 07:27:22 -0400 MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Office Outlook, Build 11.0.6353 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180 Thread-Index: AcVEalYAV8/ksHX0RNGj7jejzIQGrwAZmWaQ In-Reply-To: <426439CC.2000704@cisco.com> X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - dx28.winwebhosting.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - brianrosen.net X-Spam-Score: 0.0 (/) X-Scan-Signature: 10d3e4e3c32e363f129e380e644649be Content-Transfer-Encoding: 7bit Cc: sip@ietf.org, "'Peterson, Jon'" X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org Which do you find more useful: Caller name in the PSTN or display name in email? One is "authenticated", the other is not. Let's face it, the PSTN caller name system is fundamentally broken, and it doesn't work as well, or as reliably FROM THE POINT OF VIEW OF THE USER, as nearly anything else. Imitating that is a poor choice. To be sure, much of what doesn't work is due to poor implementation and "star syndrome" (I block my Caller ID and I don't take calls without CallerId). No one really trusts display name in the PSTN. Few even understand it. Everyone who uses email knows what to expect of a display name. With session initiation on the Internet, it's not very useful to hide behind the trust of the originating carrier, because there are too many of them and you have no reasonable way to distinguish a trustworthy one from an untrustworthy one. There may not even be an originating carrier. In this case, I think we trust users to be polite, and when they aren't, you have the option of not taking their calls. -----Original Message----- From: sip-bounces@ietf.org [mailto:sip-bounces@ietf.org] On Behalf Of Paul Kyzivat Sent: Monday, April 18, 2005 6:51 PM To: Michael Thomas Cc: sip@ietf.org; 'Peterson, Jon' Subject: Re: [Sip] sip-identity-05: display-name woes I agree. One way or another I think we need to have an approach caller id and calling name that works at least as well and reliably as it does in the PSTN, and that does so whether going between two sip endpoints in different domains, or between a sip endpoint and a PSTN gateway. And it needs to do this whether you are using sip native URIs or telephone numbers. For telephone numbers there probably must be consistency with what happens for PSTN-PSTN calls. For sip native addresses there may be some wiggle room about how it should work, but I think people will want the same level of trust with either kind of address. Paul Michael Thomas wrote: > On Mon, 2005-04-18 at 08:17, Hisham Khartabil wrote: > >>Brian does have some point in what he's saying. Usually, the number is >>displayed (the sip address in out case) unless the receiver has the >>caller in the address book. In this case the name displayed is the one >>in the local address book. But is it too late to think that way? It >>probably is since a lot of implementations out there already display >>the Display Name in the From header field, but we could recommend >>against it. > > > I think that people are tempting the fates if they > think that proscriptions against misuse buried in > some arcane RFC will stop developers from putting > juicy identity bits in front their users. Even if it's > really, really stupid. And insecure. > > And SIP is not just about voice rendezvous. Imagine a > proscription on an IM user agent against putting a > display name in front of their user. It's not only > ludicrous, it would make the protocol useless. > > Mike > > > ------------------------------------------------------------------------ > > _______________________________________________ > Sip mailing list https://www1.ietf.org/mailman/listinfo/sip > This list is for NEW development of the core SIP Protocol > Use sip-implementors@cs.columbia.edu for questions on current sip > Use sipping@ietf.org for new developments on the application of sip _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Tue Apr 19 09:21:20 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DNsfI-0007Ug-ED; Tue, 19 Apr 2005 09:21:20 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DNsfF-0007UJ-4L for sip@megatron.ietf.org; Tue, 19 Apr 2005 09:21:18 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA08790 for ; Tue, 19 Apr 2005 09:21:14 -0400 (EDT) Received: from rtp-iport-2.cisco.com ([64.102.122.149]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DNsqE-0006jS-NQ for sip@ietf.org; Tue, 19 Apr 2005 09:32:40 -0400 Received: from rtp-core-1.cisco.com (64.102.124.12) by rtp-iport-2.cisco.com with ESMTP; 19 Apr 2005 09:21:04 -0400 Received: from flask.cisco.com (IDENT:mirapoint@flask.cisco.com [161.44.122.62]) by rtp-core-1.cisco.com (8.12.10/8.12.6) with ESMTP id j3JDL1RQ015787; Tue, 19 Apr 2005 09:21:02 -0400 (EDT) Received: from cisco.com ([161.44.79.173]) by flask.cisco.com (MOS 3.4.6-GR) with ESMTP id AQS53979; Tue, 19 Apr 2005 09:21:00 -0400 (EDT) Message-ID: <426505BC.8060705@cisco.com> Date: Tue, 19 Apr 2005 09:21:00 -0400 From: Paul Kyzivat User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.1) Gecko/20020826 X-Accept-Language: en-us, en MIME-Version: 1.0 To: Brian Rosen Subject: Re: [Sip] sip-identity-05: display-name woes References: <40qjfr$1n6p3c@sj-inbound-b.cisco.com> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Score: 0.0 (/) X-Scan-Signature: 03169bfe4792634a390035a01a6c6d2f Content-Transfer-Encoding: 7bit Cc: sip@ietf.org, 'Michael Thomas' , "'Peterson, Jon'" X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org Brian Rosen wrote: > Which do you find more useful: Caller name in the PSTN or display name in > email? I don't think the two cases are quite analogous. Display names are less important with email because the URIs are themselves often more human friendly. So, if I get an email with a display name I don't recognize, I can look at the URI and sometimes get an idea of who it is. Even so, if I get a mail from somebody else claimg to be Brian Rosen I am quite likely to be confused for awhile. Otherwise it is hard to compare because the human factors of the devices I use for each are so different. I think it will become much more of an issue when voicemails with addresses derived from sip headers start showing up in my email inbox. > One is "authenticated", the other is not. > > Let's face it, the PSTN caller name system is fundamentally broken, and it > doesn't work as well, or as reliably FROM THE POINT OF VIEW OF THE USER, as > nearly anything else. Imitating that is a poor choice. To be sure, much of > what doesn't work is due to poor implementation and "star syndrome" (I block > my Caller ID and I don't take calls without CallerId). The fact that the info is often blocked, or that I often use devices that can't present it, isn't a good argument. We should be evaluating how it works when it is used. And I didn't say that we should just copy that system, or do as poorly. I only said we should aim to do no worse. > No one really trusts display name in the PSTN. Few even understand it. Well, its probably true that nobody understands it. And nobody trusts it to always be there. But I suspect people do trust that if a value is displayed then it is vouched for by "the phone company". > Everyone who uses email knows what to expect of a display name. No. Everybody that participates in IETF knows what to expect, and a big chunk of techies elsewhere do too. But grandma doesn't. And when grandma switches her phone service to her cable company because it is cheaper, she won't know that she should change her expectations. > With session initiation on the Internet, it's not very useful to hide behind > the trust of the originating carrier, because there are too many of them and > you have no reasonable way to distinguish a trustworthy one from an > untrustworthy one. There may not even be an originating carrier. That is partly what certificate chains are for. The originating carrier needs to get its cert from somebody I trust. I certainly can't predict exactly how this is going to play out. But it may be that part of the value proposition of carriers is that they will be able to provide some identity guarantees that you can't so easily get otherwise. But I think people will continue to want to make and receive calls from strangers, and will want to know the identity of the caller in some useful way. > In this case, I think we trust users to be polite, and when they aren't, > you have the option of not taking their calls. Well, I would probably take a call from Brian Rosen. And I would do so even though I don't know your phone number. But that means I will probably take a call from a telemarketer claiming to be Brian Rosen too. While I have the option to not take the call, I don't have the data to distinguish one from the other. I realize the situation is similar with email, but the ergonomics are different. I can look at the beginning of the message and the subject, and quickly realize it is not you. I'm much less bothered by the misrepresentation than if I have answered the phone. My main point is that sip initially adopted the very loose identification semantics of email. Now there are attempts to tighten those up. I think we should be considering where we would like to get as well as where we know how to get. And the expectations of existing phone users are one source of requirements about where we want to get. Paul > -----Original Message----- > From: sip-bounces@ietf.org [mailto:sip-bounces@ietf.org] On Behalf Of Paul > Kyzivat > Sent: Monday, April 18, 2005 6:51 PM > To: Michael Thomas > Cc: sip@ietf.org; 'Peterson, Jon' > Subject: Re: [Sip] sip-identity-05: display-name woes > > I agree. > > One way or another I think we need to have an approach caller id and > calling name that works at least as well and reliably as it does in the > PSTN, and that does so whether going between two sip endpoints in > different domains, or between a sip endpoint and a PSTN gateway. And it > needs to do this whether you are using sip native URIs or telephone > numbers. For telephone numbers there probably must be consistency with > what happens for PSTN-PSTN calls. For sip native addresses there may be > some wiggle room about how it should work, but I think people will want > the same level of trust with either kind of address. > > Paul > > Michael Thomas wrote: > >>On Mon, 2005-04-18 at 08:17, Hisham Khartabil wrote: >> >> >>>Brian does have some point in what he's saying. Usually, the number is >>>displayed (the sip address in out case) unless the receiver has the >>>caller in the address book. In this case the name displayed is the one >>>in the local address book. But is it too late to think that way? It >>>probably is since a lot of implementations out there already display >>>the Display Name in the From header field, but we could recommend >>>against it. >> >> >>I think that people are tempting the fates if they >>think that proscriptions against misuse buried in >>some arcane RFC will stop developers from putting >>juicy identity bits in front their users. Even if it's >>really, really stupid. And insecure. >> >>And SIP is not just about voice rendezvous. Imagine a >>proscription on an IM user agent against putting a >>display name in front of their user. It's not only >>ludicrous, it would make the protocol useless. >> >> Mike >> >> >>------------------------------------------------------------------------ >> >>_______________________________________________ >>Sip mailing list https://www1.ietf.org/mailman/listinfo/sip >>This list is for NEW development of the core SIP Protocol >>Use sip-implementors@cs.columbia.edu for questions on current sip >>Use sipping@ietf.org for new developments on the application of sip > > > _______________________________________________ > Sip mailing list https://www1.ietf.org/mailman/listinfo/sip > This list is for NEW development of the core SIP Protocol > Use sip-implementors@cs.columbia.edu for questions on current sip > Use sipping@ietf.org for new developments on the application of sip > > _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Tue Apr 19 09:34:31 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DNss3-0001mt-DR; Tue, 19 Apr 2005 09:34:31 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DNss1-0001m2-2d for sip@megatron.ietf.org; Tue, 19 Apr 2005 09:34:29 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA09975 for ; Tue, 19 Apr 2005 09:34:26 -0400 (EDT) Received: from rtp-iport-2.cisco.com ([64.102.122.149]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DNt32-0007Nc-Bs for sip@ietf.org; Tue, 19 Apr 2005 09:45:52 -0400 Received: from rtp-core-1.cisco.com (64.102.124.12) by rtp-iport-2.cisco.com with ESMTP; 19 Apr 2005 09:34:20 -0400 Received: from flask.cisco.com (IDENT:mirapoint@flask.cisco.com [161.44.122.62]) by rtp-core-1.cisco.com (8.12.10/8.12.6) with ESMTP id j3JDYGRQ019362; Tue, 19 Apr 2005 09:34:17 -0400 (EDT) Received: from cisco.com ([161.44.79.173]) by flask.cisco.com (MOS 3.4.6-GR) with ESMTP id AQS54930; Tue, 19 Apr 2005 09:34:15 -0400 (EDT) Message-ID: <426508D7.6040305@cisco.com> Date: Tue, 19 Apr 2005 09:34:15 -0400 From: Paul Kyzivat User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.1) Gecko/20020826 X-Accept-Language: en-us, en MIME-Version: 1.0 To: "Peterson, Jon" Subject: Re: [Sip] sip-identity-05: display-name woes References: <24EAE5D4448B9D4592C6D234CBEBD59701502E37@stntexch03.cis.neustar.com> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Score: 0.0 (/) X-Scan-Signature: 21be852dc93f0971708678c18d38c096 Content-Transfer-Encoding: 7bit Cc: sip@ietf.org, Francois Audet X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org Jon, So what you are suggesting is: - your identity draft is based on ability to determine authenticator based on domain name in URI. It doesn't work for phone numbers - potentially that could be solved by having something (e.g. enum) provide a specification for who the authenticator should be for a particular tel: URI. Given that, the identity draft could then provide the authentication. I think that makes a lot of sense as a potential way forward, though it further increases the potential latency for a call. And yes, this is just a bunch of hypotheticals. But a potentially important bunch. It may form bhe beginning of a plan for where to go. SIP is starting to get real traction in the consumer market now. This stuff seems important for continued progress. I think those hypotheticals need to include how meet perceived needs such as display of calling name. Whether it comes from the display name or from somewhere else can remain an open question for awhile. Paul Peterson, Jon wrote: > > Understand that most of what I wrote below was intended only to support > the design decision that identity for telephone numbers is out of scope > for the current sip-identity draft, and thus that TNs wouldn't serve as > a clear argument about display-names one way or another. So, this is all > just hypotheticals. > > Currently, the ENUM database has no capability whatsoever to provide > names of end users; any such capability would need to be invented before > it could be leveraged. Presumably, if a block of phone numbers is > delegated to an organization with ENUM, it is the responsibility of that > organization to populate any and all ENUM records, including any > hypothetical records that assisted in providing names for end users. > Note that in many principalities, organizations are not allowed to "own" > telephone numbers, only carriers have that privilege. In such contexts > the idea of, say, an enterprise being responsible for this function > wouldn't make any sense. > > Strictly following my logic below, in a case where an organization is > responsible for a block of telephone numbers in ENUM, they would be the > appropriate signatory for any and all authentication service > responsibilities when telephone numbers are used in the From header > field of SIP requests. Thus, ENUM could be used to discover the > organization responsible for the number, yes, and so to determine who is > eligible to provide an authentication service for the user in question. > While it could theoretically be used furthermore to derive the > appropriate name, if we were to invent such a mechanism, this would be a > separable capability. > > Jon Peterson > NeuStar, Inc. > > -----Original Message----- > *From:* Francois Audet [mailto:audet@nortel.com] > *Sent:* Monday, April 18, 2005 11:56 AM > *To:* Peterson, Jon; 'Paul Kyzivat'; 'Brian Rosen' > *Cc:* 'sip@ietf.org' > *Subject:* RE: [Sip] sip-identity-05: display-name woes > > There is also the case where the ENUM database wouldn't have the > Name of the > end-user because a block of phone numbers are assigned to an > organization (like > a corporation). > > It this case, I'm assuming that the display name would be provided > by the organization itself, but the SIP service provider would > assert that the organization was allowed to populate the display name. > > Perhaps ENUM could be used to verify that, but it wouldn't be used > to derive the name itself (just the owner). > > Is this what you had in mind? > > > -----Original Message----- > > From: sip-bounces@ietf.org [mailto:sip-bounces@ietf.org] On > > Behalf Of Peterson, Jon > > Sent: Friday, April 08, 2005 12:54 > > To: Paul Kyzivat; Brian Rosen > > Cc: sip@ietf.org > > Subject: RE: [Sip] sip-identity-05: display-name woes > > > > > > > > Some notes inline. > > > > Jon Peterson > > NeuStar, Inc. > > > > > -----Original Message----- > > > From: Paul Kyzivat [mailto:pkyzivat@cisco.com] > > > Sent: Thursday, April 07, 2005 7:33 AM > > > To: Brian Rosen > > > Cc: Peterson, Jon; sip@ietf.org > > > Subject: Re: [Sip] sip-identity-05: display-name woes > > > > > [snip] > > > > > > The most immediate problem I can see comes when your call lands > on a > > > gateway to the PSTN. At that point the identification > > conventions of the > > > SIP network must be interworked with those of the public telephone > > > network. The gateway must decide whether to populate the > > calling name > > > and number fields on the PSTN side. If it has no > > authentication that the > > > information is correct, should it populate it? > > > > Let's be careful, though. If I'm calling from > > sip:jon@example.com, what exactly does the gateway put in the > > ISUP CgPN field, let alone what might it share as a textual > > string in the GNP? That sort of SIP-ISUP mapping has bigger > > problems than just how to deal with display-name. Clearly, if > > the gateway is going to just make up a telephone number to > > represent the calling party, all bets are off about how to > > understand the GNP. > > > > Of course, the From header field of a SIP request might > > contain a tel URI, or a SIP URI with a tel URI user portion. > > But in that instance, provided it is a valid telephone > > number, there is most likely a CNAM record associated with it > > in the PSTN. Gateways or subsequent PSTN signaling elements > > can always do CNAM queries to recover the associated > > appropriate calling name to populate the GNP. But clearly > > there's no point in even getting the CNAM if the telephone > > number itself can just trivially be forged in SIP From header > > fields. This gets into the whole question of why a gateway > > would ever trust an Identity header that asserts a telephone > > number. As sip-identity-04 suggests, that has to be a subject > > for future work, but the only plausible lines of thought we > > have on this today are ENUM architectures. > > > > By launching an ENUM query, the story might go, the gateway > > could learn who the number owner is, and thus who should > > provide the signature over the Identity information, and > > conceivably the gateway could also learn info like CNAM at > > the time. This would be tantamount to just reinventing CNAM > > in an IP context - something that is probably inevitable if > > telephone numbers are to be used extensively in SIP, > > something that people are no doubt noodling in various shops > > around the world today, and something that probably wouldn't > > necessarily require signing the display-name in order for it to > work. > > > > But until we boil that particular ocean, I feel that PSTN > > interworking might not the best case on which to argue the > > display-name issue one way or another. > > > > _______________________________________________ > > Sip mailing list https://www1.ietf.org/mailman/listinfo/sip > > This list is for NEW development of the core SIP Protocol > > Use sip-implementors@cs.columbia.edu for questions on current > > sip Use sipping@ietf.org for new developments on the > > application of sip > > > > > _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Tue Apr 19 10:16:28 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DNtQf-0007Qv-EQ; Tue, 19 Apr 2005 10:10:17 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DNtQc-0007Q9-4L for sip@megatron.ietf.org; Tue, 19 Apr 2005 10:10:14 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA13332 for ; Tue, 19 Apr 2005 10:10:11 -0400 (EDT) Message-Id: <200504191410.KAA13332@ietf.org> Received: from dx28.winwebhosting.com ([70.85.77.84]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DNtbd-0000VN-R7 for sip@ietf.org; Tue, 19 Apr 2005 10:21:38 -0400 Received: from acs-24-154-127-163.zoominternet.net ([24.154.127.163] helo=BROSENLT) by dx28.winwebhosting.com with esmtpa (Exim 4.44) id 1DNtQN-0007hr-LC; Tue, 19 Apr 2005 09:09:59 -0500 From: "Brian Rosen" To: "'Paul Kyzivat'" Subject: RE: [Sip] sip-identity-05: display-name woes Date: Tue, 19 Apr 2005 10:09:51 -0400 MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Office Outlook, Build 11.0.6353 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180 Thread-Index: AcVE4qTptDHIjeHrTnu9lqP5eJmyLQAA+8eA In-Reply-To: <426505BC.8060705@cisco.com> X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - dx28.winwebhosting.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - brianrosen.net X-Spam-Score: 0.0 (/) X-Scan-Signature: 0ff9c467ad7f19c2a6d058acd7faaec8 Content-Transfer-Encoding: 7bit Cc: sip@ietf.org, 'Michael Thomas' , "'Peterson, Jon'" X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org > > Which do you find more useful: Caller name in the PSTN or display name > in > > email? > > I don't think the two cases are quite analogous. Display names are less > important with email because the URIs are themselves often more human > friendly. So, if I get an email with a display name I don't recognize, I > can look at the URI and sometimes get an idea of who it is. Which of course you could do with a URI on a SIP call > > Even so, if I get a mail from somebody else claimg to be Brian Rosen I > am quite likely to be confused for awhile. > > Otherwise it is hard to compare because the human factors of the devices > I use for each are so different. I think it will become much more of an > issue when voicemails with addresses derived from sip headers start > showing up in my email inbox. I'm not sure I agree. The displays for phones are becoming more like the displays for email. The human factors are converging. I think the voicemail example is a good one, and I think you have the same choices you have with any other email, and authentication isn't going to help. > > > One is "authenticated", the other is not. > > > > Let's face it, the PSTN caller name system is fundamentally broken, and > it > > doesn't work as well, or as reliably FROM THE POINT OF VIEW OF THE USER, > as > > nearly anything else. Imitating that is a poor choice. To be sure, > much of > > what doesn't work is due to poor implementation and "star syndrome" (I > block > > my Caller ID and I don't take calls without CallerId). > > The fact that the info is often blocked, or that I often use devices > that can't present it, isn't a good argument. We should be evaluating > how it works when it is used. I don't agree. You are positing that we should provide at least the level of service the PSTN does. I'm claiming users don't appreciate the difference; they think PSTN caller ID is broken, and email display names are forgeable. > > And I didn't say that we should just copy that system, or do as poorly. > I only said we should aim to do no worse. I'm always interested in improving things, but only if real users perceive the difference. > > > No one really trusts display name in the PSTN. Few even understand it. > > Well, its probably true that nobody understands it. And nobody trusts it > to always be there. But I suspect people do trust that if a value is > displayed then it is vouched for by "the phone company". Go find some non techie friends and do a small survey. Let me know what you find. I think you will discover that no one believes the name is "vouched for". I think they will tell you that it's anything that the subscriber told the phone company, the phone company does no checking, and doesn't vouch for it, they just spit it out, rarely, in some pattern not discernable from a users point of view. > > > Everyone who uses email knows what to expect of a display name. > > No. Everybody that participates in IETF knows what to expect, and a big > chunk of techies elsewhere do too. > > But grandma doesn't. And when grandma switches her phone service to her > cable company because it is cheaper, she won't know that she should > change her expectations. Dunno about yours, but my Mom knows what to expect of email. Since she sees Caller Name once in a blue moon on her current phone, she isn't going to have any expectations if she switches to her cable vendor's system. > > > With session initiation on the Internet, it's not very useful to hide > behind > > the trust of the originating carrier, because there are too many of them > and > > you have no reasonable way to distinguish a trustworthy one from an > > untrustworthy one. There may not even be an originating carrier. > > That is partly what certificate chains are for. The originating carrier > needs to get its cert from somebody I trust. > > I certainly can't predict exactly how this is going to play out. But it > may be that part of the value proposition of carriers is that they will > be able to provide some identity guarantees that you can't so easily get > otherwise. I'm pretty sure that's what will happen for URIs. I don't think that can happen for display names. The guarantee is NOT that the identity is any good; it's that the identity was used to place the call. You aren't identifying the caller, you are providing traceability. > > But I think people will continue to want to make and receive calls from > strangers, and will want to know the identity of the caller in some > useful way. Agree. They want to. The question is, is there a way to place any amount of trust in the identity as an identity? > > > In this case, I think we trust users to be polite, and when they aren't, > > you have the option of not taking their calls. > > Well, I would probably take a call from Brian Rosen. And I would do so > even though I don't know your phone number. But that means I will > probably take a call from a telemarketer claiming to be Brian Rosen too. > While I have the option to not take the call, I don't have the data to > distinguish one from the other. And I don't think you ever will. If the telemarketer tells the phone company that his name is Brian Rosen, the carrier will believe him, and will do no checking at all. The only advantage you have is the time delay to change the name. If that is some advantage, maybe we could work on that, but it's not anything to do with identity, it's a brake on the rate of change. > > I realize the situation is similar with email, but the ergonomics are > different. I can look at the beginning of the message and the subject, > and quickly realize it is not you. I'm much less bothered by the > misrepresentation than if I have answered the phone. True. If we CAN make things better, we should. I just don't see any reasonable way to do that yet. > > My main point is that sip initially adopted the very loose > identification semantics of email. Now there are attempts to tighten > those up. I think we should be considering where we would like to get as > well as where we know how to get. And the expectations of existing phone > users are one source of requirements about where we want to get. Careful. The email folks are just as interested in identity as we are these days. We should not invent a separate solution. Of course we shouldn't copy a known-to-be-broken scheme either. Brian _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Tue Apr 19 10:39:49 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DNttF-0004TC-9J; Tue, 19 Apr 2005 10:39:49 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DNttD-0004T7-0i for sip@megatron.ietf.org; Tue, 19 Apr 2005 10:39:47 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA16319 for ; Tue, 19 Apr 2005 10:39:42 -0400 (EDT) Received: from sb7.songbird.com ([208.184.79.137]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DNu4B-0001Vi-UL for sip@ietf.org; Tue, 19 Apr 2005 10:51:09 -0400 Received: from RSHOCKEY-LTXP.shockey.us (neustargw.va.neustar.com [209.173.53.233]) by sb7.songbird.com (8.12.11/8.12.11) with ESMTP id j3JEcVhK031568 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Tue, 19 Apr 2005 07:38:53 -0700 Message-Id: <6.2.1.2.2.20050419095531.04dd7240@sb7.songbird.com> X-Mailer: QUALCOMM Windows Eudora Version 6.2.1.2 Date: Tue, 19 Apr 2005 10:05:48 -0400 To: "Francois Audet" , "'Peterson, Jon'" , "'Paul Kyzivat'" , "'Brian Rosen'" From: Richard Shockey Subject: RE: [Sip] sip-identity-05: display-name woes In-Reply-To: <1ECE0EB50388174790F9694F77522CCF01F3ED6F@zrc2hxm0.corp.nor tel.com> References: <1ECE0EB50388174790F9694F77522CCF01F3ED6F@zrc2hxm0.corp.nortel.com> Mime-Version: 1.0 X-SongbirdInformation: support@songbird.com for more information X-Songbird: Found to be clean X-Songbird-From: richard@shockey.us X-Spam-Score: 1.3 (+) X-Scan-Signature: 789c141a303c09204b537a4078e2a63f Cc: "'sip@ietf.org'" X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============1815352764==" Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org --===============1815352764== Content-Type: multipart/alternative; boundary="=====================_6164213==.ALT" --=====================_6164213==.ALT Content-Type: text/plain; charset="us-ascii"; format=flowed At 02:56 PM 4/18/2005, Francois Audet wrote: >There is also the case where the ENUM database wouldn't have the Name of the >end-user because a block of phone numbers are assigned to an organization >(like >a corporation). > >It this case, I'm assuming that the display name would be provided >by the organization itself, but the SIP service provider would >assert that the organization was allowed to populate the display name. > >Perhaps ENUM could be used to verify that, but it wouldn't be used >to derive the name itself (just the owner). I would doubt it ... most of the discussions I'm aware of are focused on using something like IRIS to validate the underlying ENUM registration and hold various forms of Contact-Info and potentially display names. > > > > By launching an ENUM query, the story might go, the gateway > > could learn who the number owner is, and thus who should > > provide the signature over the Identity information, that is more likely >and > > conceivably the gateway could also learn info like CNAM at > > the time. This would be tantamount to just reinventing CNAM > > in an IP context - something that is probably inevitable if > > telephone numbers are to be used extensively in SIP, > > something that people are no doubt noodling in various shops > > around the world today, and something that probably wouldn't > > necessarily require signing the display-name in order for it to work. > > > > But until we boil that particular ocean, I feel that PSTN > > interworking might not the best case on which to argue the > > display-name issue one way or another. > > > > You are assuming BTW that people will permit personally identifying display information such as CNAME to be used in a IP context. Identity and >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> Richard Shockey, Senior Manager, Strategic Technology Initiatives NeuStar Inc. 46000 Center Oak Plaza - Sterling, VA 20166 sip:rshockey(at)iptel.org sip:57141@fwd.pulver.com ENUM +87810-13313-31331 PSTN Office +1 571.434.5651 PSTN Mobile: +1 703.593.2683, Fax: +1 815.333.1237 or ; <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<< --=====================_6164213==.ALT Content-Type: text/html; charset="us-ascii" At 02:56 PM 4/18/2005, Francois Audet wrote:

There is also the case where the ENUM database wouldn't have the Name of the
end-user because a block of phone numbers are assigned to an organization (like
a corporation).

It this case, I'm assuming that the display name would be provided
by the organization itself, but the SIP service provider would
assert that the organization was allowed to populate the display name.

Perhaps ENUM could be used to verify that, but it wouldn't be used
to derive the name itself (just the owner).


I would doubt it ... most of the discussions I'm aware of are focused on using something like IRIS to validate the  underlying ENUM registration and hold various forms of Contact-Info and potentially display names.


>
> By launching an ENUM query, the story might go, the gateway
> could learn who the number owner is, and thus who should
> provide the signature over the Identity information,

that is more likely

and
> conceivably the gateway could also learn info like CNAM at
> the time. This would be tantamount to just reinventing CNAM
> in an IP context - something that is probably inevitable if
> telephone numbers are to be used extensively in SIP,
> something that people are no doubt noodling in various shops
> around the world today, and something that probably wouldn't
> necessarily require signing the display-name in order for it to work.
>
> But until we boil that particular ocean, I feel that PSTN
> interworking might not the best case on which to argue the
> display-name issue one way or another.
>
>


You are assuming BTW that people will permit personally identifying display information such as CNAME to be used in a IP context.

Identity and


>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
Richard Shockey, Senior Manager, Strategic Technology Initiatives
NeuStar Inc.
46000 Center Oak Plaza  -   Sterling, VA  20166
sip:rshockey(at)iptel.org   sip:57141@fwd.pulver.com
ENUM +87810-13313-31331
PSTN Office +1 571.434.5651 PSTN Mobile: +1 703.593.2683,  Fax: +1 815.333.1237
< mailto:richard(at)shockey.us> or < mailto:richard.shockey(at)neustar.biz>
< http://www.neustar.biz> ; < http://www.enum.org>
<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
--=====================_6164213==.ALT-- --===============1815352764== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip --===============1815352764==-- From sip-bounces@ietf.org Tue Apr 19 11:14:11 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DNuQV-00018B-5T; Tue, 19 Apr 2005 11:14:11 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DNuQS-00017l-MF for sip@megatron.ietf.org; Tue, 19 Apr 2005 11:14:09 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA18840 for ; Tue, 19 Apr 2005 11:14:05 -0400 (EDT) Received: from sj-iport-3-in.cisco.com ([171.71.176.72] helo=sj-iport-3.cisco.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DNubU-0002TK-0y for sip@ietf.org; Tue, 19 Apr 2005 11:25:33 -0400 Received: from sj-core-5.cisco.com (171.71.177.238) by sj-iport-3.cisco.com with ESMTP; 19 Apr 2005 08:13:57 -0700 X-IronPort-AV: i="3.92,114,1112598000"; d="asc'?scan'208"; a="251602879:sNHT46181740" Received: from imail.cisco.com (imail.cisco.com [128.107.200.91]) by sj-core-5.cisco.com (8.12.10/8.12.6) with ESMTP id j3JFDshu006630; Tue, 19 Apr 2005 08:13:55 -0700 (PDT) Received: from thomasm-lnx.cisco.com (thomasm-lnx.cisco.com [171.71.96.50]) by imail.cisco.com (8.12.11/8.12.10) with ESMTP id j3JF50pE022689; Tue, 19 Apr 2005 08:05:00 -0700 Subject: RE: [Sip] sip-identity-05: display-name woes From: Michael Thomas To: "Peterson, Jon" In-Reply-To: <24EAE5D4448B9D4592C6D234CBEBD59701502E38@stntexch03.cis.neustar.com> References: <24EAE5D4448B9D4592C6D234CBEBD59701502E38@stntexch03.cis.neustar.com> Organization: Cisco Systems Message-Id: <1113923633.2275.17.camel@thomasm-lnx.cisco.com> Mime-Version: 1.0 X-Mailer: Ximian Evolution 1.4.6 Date: Tue, 19 Apr 2005 08:13:53 -0700 IIM-SIG: v:"1.1"; h:"imail.cisco.com"; d:"cisco.com"; z:"home"; m:"krs"; t:"1113923100.266790"; x:"432200"; a:"rsa-sha1"; b:"nofws:2011"; e:"Iw=="; n:"sQYarK2E51MdcTiUqeif3F7cWdxIfoCiXhdfb9vD5ee/j0jXL15gbFxF2p" "XIweAblu0N6XAgK7k+wrbr7bQDJaCDqOmzqpRUBjIRQAXQ7NzadpmR3pUL6wxaRUtW+c43sl9jC" "50Qg1sXHpPjt8Y+Y16ioyQAQAdSunM4YhevURc="; s:"EA38uyjxd4l3giBNREMwyETynzNpd3epwlXfaA97IzciGwHQPjeYAiKUPJxpgKKCFkPBLFDn" "1+ATMK5tV49zktnmF90TE0swyh6Y/m2Ws16gfr+gvGx85lSEVQnaggVyfvVOkavro6wPf1uVE9D" "b+KKMvakyBqY/AZYAGyokR34="; c:"Subject: RE: [Sip] sip-identity-05: display-name woes"; c:"From: Michael Thomas "; c:"Date: Tue, 19 Apr 2005 08:13:53 -0700" IIM-VERIFY: s:"y"; v:"y"; r:"60"; h:"imail.cisco.com"; c:"message from imail.cisco.com verified; " X-Spam-Score: 0.0 (/) X-Scan-Signature: 0a7aa2e6e558383d84476dc338324fab Cc: sip@ietf.org, Francois Audet , Paul Kyzivat X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============2009856137==" Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org --===============2009856137== Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="=-LdNvPbnP9YfftOe5Ik2X" --=-LdNvPbnP9YfftOe5Ik2X Content-Type: text/plain Content-Transfer-Encoding: quoted-printable On Tue, 2005-04-19 at 01:45, Peterson, Jon wrote: > Mike, >=20 > I'm not sure why you think sip-identity suffers from the same problem. Th= e presence of an Identity header signifies that the owner of a namespace (t= he signer of the hash) authorizes the use of the name populating the From h= eader field. The Identity header exists for no other purpose. So what exact= ly is the problem? I'm not talking about the header here, I'm talking about about the credential being asserted. As always, authentication !=3D authorization: my merely having a credential in a namespace does not mean that I am authorized to perform every service that namespace offers, for example. In this particular case, if example.com gave me a cert for mat@example.com which is how I identify myself for, oh say, ssh access that does *not* mean that I likewise then get the ability to assert sip-identities for the whole domain. Example.com must be able to delegate whether I'm allowed to do that or not.=20 As far as I can tell, there's an implicit assumption in sip-identity that the way that example.com would prevent=20 me from signing sip-identites for the whole domain is=20 to... just not give me that cert. That's not a very=20 good assumption as credentials can be used for a wide variety of things, and having to run parallel namespaces which each gate a particular authorization domain would be a horrible management nightmare. Worse is that a naive cross domain receiver has *no* way to know which of example.com's namespaces ought to be considered valid. So it doesn't even work in this case. NB: this is a common conflation with would-be cert users. What you get with certs is authentication and nothing more. Authorization is necessary to bind identity with role. That's missing in the sip-identity draft. Mike --=-LdNvPbnP9YfftOe5Ik2X Content-Type: application/pgp-signature; name=signature.asc Content-Description: This is a digitally signed message part -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.3 (GNU/Linux) iQCVAwUAQmUgMbMsDAj/Eq++AQJv6AQAkLMgTWHymx2DaJ6gQzpfNkbkNTGdjxFA dYEFtmjRdUxQpD9iYOIfLqRYtdlky42huGMF/GLv/4xnH/gWCIML1l6ywhNrdbzK 8O4r2uniVkqecfkuN9Vsi05waojRJ+4VCSm1P9zWfBNuwF16ujX36XwWJYZD8BF0 776pr3jiXFY= =r7m+ -----END PGP SIGNATURE----- --=-LdNvPbnP9YfftOe5Ik2X-- --===============2009856137== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip --===============2009856137==-- From sip-bounces@ietf.org Tue Apr 19 12:49:25 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DNvuf-0001Pk-Kb; Tue, 19 Apr 2005 12:49:25 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DNvud-0001Pf-Fm for sip@megatron.ietf.org; Tue, 19 Apr 2005 12:49:23 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA26064 for ; Tue, 19 Apr 2005 12:49:19 -0400 (EDT) Received: from zcars04f.nortelnetworks.com ([47.129.242.57]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DNw5g-0005UP-7u for sip@ietf.org; Tue, 19 Apr 2005 13:00:48 -0400 Received: from zrtpd0jn.us.nortel.com (zrtpd0jn.us.nortel.com [47.140.202.35]) by zcars04f.nortelnetworks.com (Switch-2.2.6/Switch-2.2.0) with ESMTP id j3JGn1D06691; Tue, 19 Apr 2005 12:49:02 -0400 (EDT) Received: by zrtpd0jn.us.nortel.com with Internet Mail Service (5.5.2653.19) id <2KLFBR7H>; Tue, 19 Apr 2005 12:48:46 -0400 Message-ID: <1ECE0EB50388174790F9694F77522CCF01F3F31A@zrc2hxm0.corp.nortel.com> From: "Francois Audet" To: "'Michael Thomas'" Subject: RE: [Sip] sip-identity-05: display-name woes Date: Tue, 19 Apr 2005 12:48:34 -0400 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2653.19) X-Spam-Score: 0.5 (/) X-Scan-Signature: 9178bae9f85419fdc08e9f2c86e345d0 Cc: "'sip@ietf.org'" , 'Paul Kyzivat' , "'Peterson, Jon'" X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============1031339077==" Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. --===============1031339077== Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C544FF.A0E98C21" This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. ------_=_NextPart_001_01C544FF.A0E98C21 Content-Type: text/plain It starts to sound like P-Asserted-Identity. > -----Original Message----- > From: Michael Thomas [mailto:mat@cisco.com] > Sent: Monday, April 18, 2005 15:02 > To: Audet, Francois [SC100:9T51:EXCH] > Cc: 'Peterson, Jon'; 'Paul Kyzivat'; 'Brian Rosen'; 'sip@ietf.org' > Subject: RE: [Sip] sip-identity-05: display-name woes > > > On Mon, 2005-04-18 at 11:56, Francois Audet wrote: > > There is also the case where the ENUM database wouldn't > have the Name > > of the end-user because a block of phone numbers are assigned to an > > organization (like > > a corporation). > > > > It this case, I'm assuming that the display name would be > provided by > > the organization itself, but the SIP service provider would assert > > that the organization was allowed to populate the display name. > > This strikes me as most likely broken: it relies on > transitive trust, for one thing. And it also implies > that there's some sort of trusted intermediary, which > is not always the case; nor should it be *required* to > be the case to get the desired authorization characteristics. > > Much better would be for a way for the name space owner > to assert whether something using its name space is > authorized or not to be sending on its behalf. And DNSsec > alone for ENUM doesn't provide this since DNSsec is a > source authentication scheme, not a source authorization > service. > > Of course, I think that sip-identity suffers from the > same problem... > > Mike > > > > > Perhaps ENUM could be used to verify that, but it wouldn't > be used to > > derive the name itself (just the owner). > > > > Is this what you had in mind? > > > > > -----Original Message----- > > > From: sip-bounces@ietf.org [mailto:sip-bounces@ietf.org] On > > > Behalf Of Peterson, Jon > > > Sent: Friday, April 08, 2005 12:54 > > > To: Paul Kyzivat; Brian Rosen > > > Cc: sip@ietf.org > > > Subject: RE: [Sip] sip-identity-05: display-name woes > > > > > > > > > > > > Some notes inline. > > > > > > Jon Peterson > > > NeuStar, Inc. > > > > > > > -----Original Message----- > > > > From: Paul Kyzivat [mailto:pkyzivat@cisco.com] > > > > Sent: Thursday, April 07, 2005 7:33 AM > > > > To: Brian Rosen > > > > Cc: Peterson, Jon; sip@ietf.org > > > > Subject: Re: [Sip] sip-identity-05: display-name woes > > > > > > > [snip] > > > > > > > > The most immediate problem I can see comes when your > call lands on > > a > > > > gateway to the PSTN. At that point the identification > > > conventions of the > > > > SIP network must be interworked with those of the > public telephone > > > > network. The gateway must decide whether to populate the > > > calling name > > > > and number fields on the PSTN side. If it has no > > > authentication that the > > > > information is correct, should it populate it? > > > > > > Let's be careful, though. If I'm calling from > > > sip:jon@example.com, what exactly does the gateway put in the > > > ISUP CgPN field, let alone what might it share as a textual > > > string in the GNP? That sort of SIP-ISUP mapping has bigger > > > problems than just how to deal with display-name. Clearly, if > > > the gateway is going to just make up a telephone number to > > > represent the calling party, all bets are off about how to > > > understand the GNP. > > > > > > Of course, the From header field of a SIP request might > > > contain a tel URI, or a SIP URI with a tel URI user portion. > > > But in that instance, provided it is a valid telephone > > > number, there is most likely a CNAM record associated with it > > > in the PSTN. Gateways or subsequent PSTN signaling elements > > > can always do CNAM queries to recover the associated > > > appropriate calling name to populate the GNP. But clearly > > > there's no point in even getting the CNAM if the telephone > > > number itself can just trivially be forged in SIP From header > > > fields. This gets into the whole question of why a gateway > > > would ever trust an Identity header that asserts a telephone > > > number. As sip-identity-04 suggests, that has to be a subject > > > for future work, but the only plausible lines of thought we > > > have on this today are ENUM architectures. > > > > > > By launching an ENUM query, the story might go, the gateway > > > could learn who the number owner is, and thus who should > > > provide the signature over the Identity information, and > > > conceivably the gateway could also learn info like CNAM at > > > the time. This would be tantamount to just reinventing CNAM > > > in an IP context - something that is probably inevitable if > > > telephone numbers are to be used extensively in SIP, > > > something that people are no doubt noodling in various shops > > > around the world today, and something that probably wouldn't > > > necessarily require signing the display-name in order for it to > > work. > > > > > > But until we boil that particular ocean, I feel that PSTN > > > interworking might not the best case on which to argue the > > > display-name issue one way or another. > > > > > > _______________________________________________ > > > Sip mailing list https://www1.ietf.org/mailman/listinfo/sip > > > This list is for NEW development of the core SIP Protocol Use > > > sip-implementors@cs.columbia.edu for questions on current sip Use > > > sipping@ietf.org for new developments on the application of sip > > > > > > > > > > > > > > > ______________________________________________________________________ > > _______________________________________________ > > Sip mailing list https://www1.ietf.org/mailman/listinfo/sip > > This list is for NEW development of the core SIP Protocol > > Use sip-implementors@cs.columbia.edu for questions on > current sip Use > > sipping@ietf.org for new developments on the application of sip > ------_=_NextPart_001_01C544FF.A0E98C21 Content-Type: text/html Content-Transfer-Encoding: quoted-printable RE: [Sip] sip-identity-05: display-name woes

It starts to sound like P-Asserted-Identity.

> -----Original Message-----
> From: Michael Thomas [mailto:mat@cisco.com]
> Sent: Monday, April 18, 2005 15:02
> To: Audet, Francois [SC100:9T51:EXCH]
> Cc: 'Peterson, Jon'; 'Paul Kyzivat'; 'Brian = Rosen'; 'sip@ietf.org'
> Subject: RE: [Sip] sip-identity-05: = display-name woes
>
>
> On Mon, 2005-04-18 at 11:56, Francois Audet = wrote:
> > There is also the case where the ENUM = database wouldn't
> have the Name
> > of the end-user because a block of phone = numbers are assigned to an
> > organization (like
> > a corporation).
> >
> > It this case, I'm assuming that the = display name would be
> provided by
> > the organization itself, but the SIP = service provider would assert
> > that the organization was allowed to = populate the display name.
>
> This strikes me as most likely broken: it = relies on
> transitive trust, for one thing. And it also = implies
> that there's some sort of trusted intermediary, = which
> is not always the case; nor should it be = *required* to
> be the case to get the desired authorization = characteristics.
>
> Much better would be for a way for the name = space owner
> to assert whether something using its name = space is
> authorized or not to be sending on its behalf. = And DNSsec
> alone for ENUM doesn't provide this since = DNSsec is a
> source authentication scheme, not a source = authorization
> service.
>
> Of course, I think that sip-identity suffers = from the
> same problem...
>
>       =         Mike
>
> >
> > Perhaps ENUM could be used to verify that, = but it wouldn't
> be used to
> > derive the name itself (just the = owner).
> >
> > Is this what you had in mind?
> >
> > > -----Original Message-----
> > > From: sip-bounces@ietf.org [mailto:sip-bounces@ietf.org] = On
> > > Behalf Of Peterson, Jon
> > > Sent: Friday, April 08, 2005 = 12:54
> > > To: Paul Kyzivat; Brian Rosen
> > > Cc: sip@ietf.org
> > > Subject: RE: [Sip] sip-identity-05: = display-name woes
> > >
> > >
> > >
> > > Some notes inline.
> > >
> > > Jon Peterson
> > > NeuStar, Inc.
> > >
> > > > -----Original = Message-----
> > > > From: Paul Kyzivat [mailto:pkyzivat@cisco.com]=
> > > > Sent: Thursday, April 07, 2005 = 7:33 AM
> > > > To: Brian Rosen
> > > > Cc: Peterson, Jon; = sip@ietf.org
> > > > Subject: Re: [Sip] = sip-identity-05: display-name woes
> > > >
> > > [snip]
> > > >
> > > > The most immediate problem I can = see comes when your
> call lands on
> > a
> > > > gateway to the PSTN. At that = point the identification
> > > conventions of the
> > > > SIP network must be interworked = with those of the
> public telephone
> > > > network. The gateway must decide = whether to populate the
> > > calling name
> > > > and number fields on the PSTN = side. If it has no
> > > authentication that the
> > > > information is correct, should = it populate it?
> > >
> > > Let's be careful, though. If I'm = calling from
> > > sip:jon@example.com, what exactly = does the gateway put in the
> > > ISUP CgPN field, let alone what might = it share as a textual
> > > string in the GNP? That sort of = SIP-ISUP mapping has bigger
> > > problems than just how to deal with = display-name. Clearly, if
> > > the gateway is going to just make up = a telephone number to
> > > represent the calling party, all bets = are off about how to
> > > understand the GNP.
> > >
> > > Of course, the From header field of a = SIP request might
> > > contain a tel URI, or a SIP URI with = a tel URI user portion.
> > > But in that instance, provided it is = a valid telephone
> > > number, there is most likely a CNAM = record associated with it
> > > in the PSTN. Gateways or subsequent = PSTN signaling elements
> > > can always do CNAM queries to recover = the associated
> > > appropriate calling name to populate = the GNP. But clearly
> > > there's no point in even getting the = CNAM if the telephone
> > > number itself can just trivially be = forged in SIP From header
> > > fields. This gets into the whole = question of why a gateway
> > > would ever trust an Identity header = that asserts a telephone
> > > number. As sip-identity-04 suggests, = that has to be a subject
> > > for future work, but the only = plausible lines of thought we
> > > have on this today are ENUM = architectures.
> > >
> > > By launching an ENUM query, the story = might go, the gateway
> > > could learn who the number owner is, = and thus who should
> > > provide the signature over the = Identity information, and
> > > conceivably the gateway could also = learn info like CNAM at
> > > the time. This would be tantamount to = just reinventing CNAM
> > > in an IP context - something that is = probably inevitable if
> > > telephone numbers are to be used = extensively in SIP,
> > > something that people are no doubt = noodling in various shops
> > > around the world today, and something = that probably wouldn't
> > > necessarily require signing the = display-name in order for it to
> > work.
> > >
> > > But until we boil that particular = ocean, I feel that PSTN
> > > interworking might not the best case = on which to argue the
> > > display-name issue one way or = another.
> > >
> > > = _______________________________________________
> > > Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
> > > This list is for NEW development of = the core SIP Protocol Use
> > > sip-implementors@cs.columbia.edu for = questions on current sip Use
> > > sipping@ietf.org for new developments = on the application of sip
> > >
> > >
> >
> >
> >
> >
> = ______________________________________________________________________
> > = _______________________________________________
> > Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
> > This list is for NEW development of the = core SIP Protocol
> > Use sip-implementors@cs.columbia.edu for = questions on
> current sip Use
> > sipping@ietf.org for new developments on = the application of sip
>

------_=_NextPart_001_01C544FF.A0E98C21-- --===============1031339077== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip --===============1031339077==-- From sip-bounces@ietf.org Tue Apr 19 13:09:36 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DNwEC-0005Ws-3G; Tue, 19 Apr 2005 13:09:36 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DNwE9-0005Wn-J4 for sip@megatron.ietf.org; Tue, 19 Apr 2005 13:09:33 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA27838 for ; Tue, 19 Apr 2005 13:09:30 -0400 (EDT) Received: from sj-iport-2-in.cisco.com ([171.71.176.71] helo=sj-iport-2.cisco.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DNwPB-00069W-Ih for sip@ietf.org; Tue, 19 Apr 2005 13:20:59 -0400 Received: from sj-core-2.cisco.com (171.71.177.254) by sj-iport-2.cisco.com with ESMTP; 19 Apr 2005 10:09:23 -0700 Received: from imail.cisco.com (imail.cisco.com [128.107.200.91]) by sj-core-2.cisco.com (8.12.10/8.12.6) with ESMTP id j3JH9FKx003353; Tue, 19 Apr 2005 10:09:15 -0700 (PDT) Received: from thomasm-lnx.cisco.com (thomasm-lnx.cisco.com [171.71.96.50]) by imail.cisco.com (8.12.11/8.12.10) with ESMTP id j3JH0Pbg023960; Tue, 19 Apr 2005 10:00:25 -0700 Subject: RE: [Sip] sip-identity-05: display-name woes From: Michael Thomas To: Francois Audet In-Reply-To: <1ECE0EB50388174790F9694F77522CCF01F3F31A@zrc2hxm0.corp.nortel.com> References: <1ECE0EB50388174790F9694F77522CCF01F3F31A@zrc2hxm0.corp.nortel.com> Organization: Cisco Systems Message-Id: <1113930559.2296.21.camel@thomasm-lnx.cisco.com> Mime-Version: 1.0 X-Mailer: Ximian Evolution 1.4.6 Date: Tue, 19 Apr 2005 10:09:19 -0700 IIM-SIG: v:"1.1"; h:"imail.cisco.com"; d:"cisco.com"; z:"home"; m:"krs"; t:"1113930025.453054"; x:"432200"; a:"rsa-sha1"; b:"nofws:6103"; e:"Iw=="; n:"sQYarK2E51MdcTiUqeif3F7cWdxIfoCiXhdfb9vD5ee/j0jXL15gbFxF2p" "XIweAblu0N6XAgK7k+wrbr7bQDJaCDqOmzqpRUBjIRQAXQ7NzadpmR3pUL6wxaRUtW+c43sl9jC" "50Qg1sXHpPjt8Y+Y16ioyQAQAdSunM4YhevURc="; s:"BIS9hFusZEA63wyeRnuJyuWrPffh6jslftUPWWVqECoZefXgugy1UFDq3vW3dIh8hL0eTZ5d" "/Li1lcihYFwdTkvwQcVkqPHNPnqLrt9QRCDU3oT780F5xiQyVKANMxw2tX1f5l2G/fkt/bacUOF" "XBhrGl2IdChTQDxFvUi51FCk="; c:"Subject: RE: [Sip] sip-identity-05: display-name woes"; c:"From: Michael Thomas "; c:"Date: Tue, 19 Apr 2005 10:09:19 -0700" IIM-VERIFY: s:"y"; v:"y"; r:"60"; h:"imail.cisco.com"; c:"message from imail.cisco.com verified; " X-Spam-Score: 0.0 (/) X-Scan-Signature: ccfb4541e989aa743998098cd315d0fd Cc: "'sip@ietf.org'" , 'Paul Kyzivat' , "'Peterson, Jon'" X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============0833593185==" Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org --===============0833593185== Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="=-Q87mRdiRlHHjmZBhzCt5" --=-Q87mRdiRlHHjmZBhzCt5 Content-Type: text/plain Content-Transfer-Encoding: quoted-printable On Tue, 2005-04-19 at 09:48, Francois Audet wrote: > It starts to sound like P-Asserted-Identity. No. P-Asserted-Identity is forgery-4-free. A cryptographic means of establishing identity paired with the ability to bind it with authorization is what P-Asserted-Identity wants to be when it grows up. Mike >=20 > > -----Original Message----- > > From: Michael Thomas [mailto:mat@cisco.com]=20 > > Sent: Monday, April 18, 2005 15:02 > > To: Audet, Francois [SC100:9T51:EXCH] > > Cc: 'Peterson, Jon'; 'Paul Kyzivat'; 'Brian Rosen'; 'sip@ietf.org' > > Subject: RE: [Sip] sip-identity-05: display-name woes > >=20 > >=20 > > On Mon, 2005-04-18 at 11:56, Francois Audet wrote: > > > There is also the case where the ENUM database wouldn't=20 > > have the Name=20 > > > of the end-user because a block of phone numbers are assigned to > an > > > organization (like > > > a corporation). > > >=20 > > > It this case, I'm assuming that the display name would be=20 > > provided by=20 > > > the organization itself, but the SIP service provider would assert > > > that the organization was allowed to populate the display name. > >=20 > > This strikes me as most likely broken: it relies on > > transitive trust, for one thing. And it also implies=20 > > that there's some sort of trusted intermediary, which > > is not always the case; nor should it be *required* to > > be the case to get the desired authorization characteristics. > >=20 > > Much better would be for a way for the name space owner > > to assert whether something using its name space is > > authorized or not to be sending on its behalf. And DNSsec > > alone for ENUM doesn't provide this since DNSsec is a=20 > > source authentication scheme, not a source authorization=20 > > service. > >=20 > > Of course, I think that sip-identity suffers from the > > same problem... > >=20 > > Mike > >=20 > > >=20 > > > Perhaps ENUM could be used to verify that, but it wouldn't=20 > > be used to=20 > > > derive the name itself (just the owner). > > >=20 > > > Is this what you had in mind? > > >=20 > > > > -----Original Message----- > > > > From: sip-bounces@ietf.org [mailto:sip-bounces@ietf.org] On > > > > Behalf Of Peterson, Jon > > > > Sent: Friday, April 08, 2005 12:54 > > > > To: Paul Kyzivat; Brian Rosen > > > > Cc: sip@ietf.org > > > > Subject: RE: [Sip] sip-identity-05: display-name woes > > > >=20 > > > >=20 > > > >=20 > > > > Some notes inline. > > > >=20 > > > > Jon Peterson > > > > NeuStar, Inc. > > > >=20 > > > > > -----Original Message----- > > > > > From: Paul Kyzivat [mailto:pkyzivat@cisco.com] > > > > > Sent: Thursday, April 07, 2005 7:33 AM > > > > > To: Brian Rosen > > > > > Cc: Peterson, Jon; sip@ietf.org > > > > > Subject: Re: [Sip] sip-identity-05: display-name woes > > > > >=20 > > > > [snip] > > > > >=20 > > > > > The most immediate problem I can see comes when your=20 > > call lands on > > > a > > > > > gateway to the PSTN. At that point the identification > > > > conventions of the > > > > > SIP network must be interworked with those of the=20 > > public telephone=20 > > > > > network. The gateway must decide whether to populate the > > > > calling name > > > > > and number fields on the PSTN side. If it has no > > > > authentication that the > > > > > information is correct, should it populate it? > > > >=20 > > > > Let's be careful, though. If I'm calling from > > > > sip:jon@example.com, what exactly does the gateway put in the=20 > > > > ISUP CgPN field, let alone what might it share as a textual=20 > > > > string in the GNP? That sort of SIP-ISUP mapping has bigger=20 > > > > problems than just how to deal with display-name. Clearly, if=20 > > > > the gateway is going to just make up a telephone number to=20 > > > > represent the calling party, all bets are off about how to=20 > > > > understand the GNP. > > > >=20 > > > > Of course, the From header field of a SIP request might > > > > contain a tel URI, or a SIP URI with a tel URI user portion.=20 > > > > But in that instance, provided it is a valid telephone=20 > > > > number, there is most likely a CNAM record associated with it=20 > > > > in the PSTN. Gateways or subsequent PSTN signaling elements=20 > > > > can always do CNAM queries to recover the associated=20 > > > > appropriate calling name to populate the GNP. But clearly=20 > > > > there's no point in even getting the CNAM if the telephone=20 > > > > number itself can just trivially be forged in SIP From header=20 > > > > fields. This gets into the whole question of why a gateway=20 > > > > would ever trust an Identity header that asserts a telephone=20 > > > > number. As sip-identity-04 suggests, that has to be a subject=20 > > > > for future work, but the only plausible lines of thought we=20 > > > > have on this today are ENUM architectures. > > > >=20 > > > > By launching an ENUM query, the story might go, the gateway > > > > could learn who the number owner is, and thus who should=20 > > > > provide the signature over the Identity information, and=20 > > > > conceivably the gateway could also learn info like CNAM at=20 > > > > the time. This would be tantamount to just reinventing CNAM=20 > > > > in an IP context - something that is probably inevitable if=20 > > > > telephone numbers are to be used extensively in SIP,=20 > > > > something that people are no doubt noodling in various shops=20 > > > > around the world today, and something that probably wouldn't=20 > > > > necessarily require signing the display-name in order for it to > > > work. > > > >=20 > > > > But until we boil that particular ocean, I feel that PSTN > > > > interworking might not the best case on which to argue the=20 > > > > display-name issue one way or another.=20 > > > >=20 > > > > _______________________________________________ > > > > Sip mailing list https://www1.ietf.org/mailman/listinfo/sip > > > > This list is for NEW development of the core SIP Protocol Use=20 > > > > sip-implementors@cs.columbia.edu for questions on current sip > Use=20 > > > > sipping@ietf.org for new developments on the application of sip > > > >=20 > > > >=20 > > >=20 > > >=20 > > >=20 > > >=20 > > > ______________________________________________________________________ > > > _______________________________________________ > > > Sip mailing list https://www1.ietf.org/mailman/listinfo/sip > > > This list is for NEW development of the core SIP Protocol > > > Use sip-implementors@cs.columbia.edu for questions on=20 > > current sip Use=20 > > > sipping@ietf.org for new developments on the application of sip > >=20 >=20 >=20 >=20 > ______________________________________________________________________ > _______________________________________________ > Sip mailing list https://www1.ietf.org/mailman/listinfo/sip > This list is for NEW development of the core SIP Protocol > Use sip-implementors@cs.columbia.edu for questions on current sip > Use sipping@ietf.org for new developments on the application of sip --=-Q87mRdiRlHHjmZBhzCt5 Content-Type: application/pgp-signature; name=signature.asc Content-Description: This is a digitally signed message part -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.3 (GNU/Linux) iQCVAwUAQmU7P7MsDAj/Eq++AQLl4AP/R504OFA+9oodXbXJLqnsub36Q4h2sTvp PWVj6Od1UGTxOwKrCXTq8xg45Ke6yj9TjtTEbrGh82Q/Jc27ntFng6kSz/9tW9Ye HhVMGy4wxJQHwHQiqvSilEsLVKxsb8/rMvJWdQhiARKC4eSJWrlctnDyXAJ4CxWB JPgI3A9SjWQ= =/C0/ -----END PGP SIGNATURE----- --=-Q87mRdiRlHHjmZBhzCt5-- --===============0833593185== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip --===============0833593185==-- From sip-bounces@ietf.org Tue Apr 19 13:13:57 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DNwIP-0005v6-0m; Tue, 19 Apr 2005 13:13:57 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DNwIM-0005ut-BG for sip@megatron.ietf.org; Tue, 19 Apr 2005 13:13:54 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA28061 for ; Tue, 19 Apr 2005 13:13:50 -0400 (EDT) Received: from zcars04e.nortelnetworks.com ([47.129.242.56] helo=zcars04e.ca.nortel.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DNwTO-0006EL-NF for sip@ietf.org; Tue, 19 Apr 2005 13:25:19 -0400 Received: from zrtpd0jn.us.nortel.com (zrtpd0jn.us.nortel.com [47.140.202.35]) by zcars04e.ca.nortel.com (Switch-2.2.0/Switch-2.2.0) with ESMTP id j3JHDKq18544; Tue, 19 Apr 2005 13:13:21 -0400 (EDT) Received: by zrtpd0jn.us.nortel.com with Internet Mail Service (5.5.2653.19) id <2KLFB4A4>; Tue, 19 Apr 2005 13:13:30 -0400 Message-ID: <1ECE0EB50388174790F9694F77522CCF01F3F369@zrc2hxm0.corp.nortel.com> From: "Francois Audet" To: "'Michael Thomas'" Subject: RE: [Sip] sip-identity-05: display-name woes Date: Tue, 19 Apr 2005 13:13:22 -0400 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2653.19) X-Spam-Score: 0.8 (/) X-Scan-Signature: 6379955759c38e2371a49573a0932fc7 Cc: "'sip@ietf.org'" , 'Paul Kyzivat' , "'Peterson, Jon'" X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============1767372612==" Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. --===============1767372612== Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C54503.17834A6F" This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. ------_=_NextPart_001_01C54503.17834A6F Content-Type: text/plain Agreed. That's what I meant: a secure P-Asserted-Identity. > -----Original Message----- > From: Michael Thomas [mailto:mat@cisco.com] > Sent: Tuesday, April 19, 2005 10:09 > To: Audet, Francois [SC100:9T51:EXCH] > Cc: 'sip@ietf.org'; 'Paul Kyzivat'; 'Peterson, Jon' > Subject: RE: [Sip] sip-identity-05: display-name woes > > > > On Tue, 2005-04-19 at 09:48, Francois Audet wrote: > > It starts to sound like P-Asserted-Identity. > > No. P-Asserted-Identity is forgery-4-free. A > cryptographic means of establishing identity paired > with the ability to bind it with authorization is > what P-Asserted-Identity wants to be when it grows up. > > Mike > > > > > > -----Original Message----- > > > From: Michael Thomas [mailto:mat@cisco.com] > > > Sent: Monday, April 18, 2005 15:02 > > > To: Audet, Francois [SC100:9T51:EXCH] > > > Cc: 'Peterson, Jon'; 'Paul Kyzivat'; 'Brian Rosen'; 'sip@ietf.org' > > > Subject: RE: [Sip] sip-identity-05: display-name woes > > > > > > > > > On Mon, 2005-04-18 at 11:56, Francois Audet wrote: > > > > There is also the case where the ENUM database wouldn't > > > have the Name > > > > of the end-user because a block of phone numbers are assigned to > > an > > > > organization (like > > > > a corporation). > > > > > > > > It this case, I'm assuming that the display name would be > > > provided by > > > > the organization itself, but the SIP service provider > would assert > > > > that the organization was allowed to populate the display name. > > > > > > This strikes me as most likely broken: it relies on transitive > > > trust, for one thing. And it also implies that there's > some sort of > > > trusted intermediary, which is not always the case; nor > should it be > > > *required* to be the case to get the desired authorization > > > characteristics. > > > > > > Much better would be for a way for the name space owner > > > to assert whether something using its name space is authorized or > > > not to be sending on its behalf. And DNSsec alone for > ENUM doesn't > > > provide this since DNSsec is a source authentication > scheme, not a > > > source authorization service. > > > > > > Of course, I think that sip-identity suffers from the > > > same problem... > > > > > > Mike > > > > > > > > > > > Perhaps ENUM could be used to verify that, but it wouldn't > > > be used to > > > > derive the name itself (just the owner). > > > > > > > > Is this what you had in mind? > > > > > > > > > -----Original Message----- > > > > > From: sip-bounces@ietf.org [mailto:sip-bounces@ietf.org] On > > > > > Behalf Of Peterson, Jon > > > > > Sent: Friday, April 08, 2005 12:54 > > > > > To: Paul Kyzivat; Brian Rosen > > > > > Cc: sip@ietf.org > > > > > Subject: RE: [Sip] sip-identity-05: display-name woes > > > > > > > > > > > > > > > > > > > > Some notes inline. > > > > > > > > > > Jon Peterson > > > > > NeuStar, Inc. > > > > > > > > > > > -----Original Message----- > > > > > > From: Paul Kyzivat [mailto:pkyzivat@cisco.com] > > > > > > Sent: Thursday, April 07, 2005 7:33 AM > > > > > > To: Brian Rosen > > > > > > Cc: Peterson, Jon; sip@ietf.org > > > > > > Subject: Re: [Sip] sip-identity-05: display-name woes > > > > > > > > > > > [snip] > > > > > > > > > > > > The most immediate problem I can see comes when your > > > call lands on > > > > a > > > > > > gateway to the PSTN. At that point the identification > > > > > conventions of the > > > > > > SIP network must be interworked with those of the > > > public telephone > > > > > > network. The gateway must decide whether to populate the > > > > > calling name > > > > > > and number fields on the PSTN side. If it has no > > > > > authentication that the > > > > > > information is correct, should it populate it? > > > > > > > > > > Let's be careful, though. If I'm calling from > > > > > sip:jon@example.com, what exactly does the gateway put in the > > > > > ISUP CgPN field, let alone what might it share as a textual > > > > > string in the GNP? That sort of SIP-ISUP mapping has bigger > > > > > problems than just how to deal with display-name. Clearly, if > > > > > the gateway is going to just make up a telephone number to > > > > > represent the calling party, all bets are off about how to > > > > > understand the GNP. > > > > > > > > > > Of course, the From header field of a SIP request > might contain > > > > > a tel URI, or a SIP URI with a tel URI user portion. > But in that > > > > > instance, provided it is a valid telephone number, > there is most > > > > > likely a CNAM record associated with it in the PSTN. > Gateways or > > > > > subsequent PSTN signaling elements can always do CNAM > queries to > > > > > recover the associated appropriate calling name to > populate the > > > > > GNP. But clearly there's no point in even getting the CNAM if > > > > > the telephone number itself can just trivially be > forged in SIP > > > > > From header fields. This gets into the whole question > of why a > > > > > gateway would ever trust an Identity header that asserts a > > > > > telephone number. As sip-identity-04 suggests, that > has to be a > > > > > subject for future work, but the only plausible lines > of thought > > > > > we have on this today are ENUM architectures. > > > > > > > > > > By launching an ENUM query, the story might go, the gateway > > > > > could learn who the number owner is, and thus who > should provide > > > > > the signature over the Identity information, and > conceivably the > > > > > gateway could also learn info like CNAM at the time. > This would > > > > > be tantamount to just reinventing CNAM in an IP context - > > > > > something that is probably inevitable if telephone > numbers are > > > > > to be used extensively in SIP, something that people are no > > > > > doubt noodling in various shops around the world today, and > > > > > something that probably wouldn't necessarily require > signing the > > > > > display-name in order for it to > > > > work. > > > > > > > > > > But until we boil that particular ocean, I feel that PSTN > > > > > interworking might not the best case on which to argue the > > > > > display-name issue one way or another. > > > > > > > > > > _______________________________________________ > > > > > Sip mailing list https://www1.ietf.org/mailman/listinfo/sip > > > > > This list is for NEW development of the core SIP Protocol Use > > > > > sip-implementors@cs.columbia.edu for questions on current sip > > Use > > > > > sipping@ietf.org for new developments on the > application of sip > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > ______________________________________________________________________ > > > > _______________________________________________ > > > > Sip mailing list https://www1.ietf.org/mailman/listinfo/sip > > > > This list is for NEW development of the core SIP Protocol Use > > > > sip-implementors@cs.columbia.edu for questions on > > > current sip Use > > > > sipping@ietf.org for new developments on the application of sip > > > > > > > > > > > > ______________________________________________________________________ > > _______________________________________________ > > Sip mailing list https://www1.ietf.org/mailman/listinfo/sip > > This list is for NEW development of the core SIP Protocol > > Use sip-implementors@cs.columbia.edu for questions on > current sip Use > > sipping@ietf.org for new developments on the application of sip > ------_=_NextPart_001_01C54503.17834A6F Content-Type: text/html RE: [Sip] sip-identity-05: display-name woes

Agreed. That's what I meant: a secure P-Asserted-Identity.

> -----Original Message-----
> From: Michael Thomas [mailto:mat@cisco.com]
> Sent: Tuesday, April 19, 2005 10:09
> To: Audet, Francois [SC100:9T51:EXCH]
> Cc: 'sip@ietf.org'; 'Paul Kyzivat'; 'Peterson, Jon'
> Subject: RE: [Sip] sip-identity-05: display-name woes
>
>
>
> On Tue, 2005-04-19 at 09:48, Francois Audet wrote:
> > It starts to sound like P-Asserted-Identity.
>
>   No. P-Asserted-Identity is forgery-4-free. A
>   cryptographic means of establishing identity paired
>   with the ability to bind it with authorization is
>   what P-Asserted-Identity wants to be when it grows up.
>
>               Mike
>
> >
> > > -----Original Message-----
> > > From: Michael Thomas [mailto:mat@cisco.com]
> > > Sent: Monday, April 18, 2005 15:02
> > > To: Audet, Francois [SC100:9T51:EXCH]
> > > Cc: 'Peterson, Jon'; 'Paul Kyzivat'; 'Brian Rosen'; 'sip@ietf.org'
> > > Subject: RE: [Sip] sip-identity-05: display-name woes
> > >
> > >
> > > On Mon, 2005-04-18 at 11:56, Francois Audet wrote:
> > > > There is also the case where the ENUM database wouldn't
> > > have the Name
> > > > of the end-user because a block of phone numbers are assigned to
> > an
> > > > organization (like
> > > > a corporation).
> > > >
> > > > It this case, I'm assuming that the display name would be
> > > provided by
> > > > the organization itself, but the SIP service provider
> would assert
> > > > that the organization was allowed to populate the display name.
> > >
> > > This strikes me as most likely broken: it relies on transitive
> > > trust, for one thing. And it also implies that there's
> some sort of
> > > trusted intermediary, which is not always the case; nor
> should it be
> > > *required* to be the case to get the desired authorization
> > > characteristics.
> > >
> > > Much better would be for a way for the name space owner
> > > to assert whether something using its name space is authorized or
> > > not to be sending on its behalf. And DNSsec alone for
> ENUM doesn't
> > > provide this since DNSsec is a source authentication
> scheme, not a
> > > source authorization service.
> > >
> > > Of course, I think that sip-identity suffers from the
> > > same problem...
> > >
> > >               Mike
> > >
> > > >
> > > > Perhaps ENUM could be used to verify that, but it wouldn't
> > > be used to
> > > > derive the name itself (just the owner).
> > > >
> > > > Is this what you had in mind?
> > > >
> > > > > -----Original Message-----
> > > > > From: sip-bounces@ietf.org [mailto:sip-bounces@ietf.org] On
> > > > > Behalf Of Peterson, Jon
> > > > > Sent: Friday, April 08, 2005 12:54
> > > > > To: Paul Kyzivat; Brian Rosen
> > > > > Cc: sip@ietf.org
> > > > > Subject: RE: [Sip] sip-identity-05: display-name woes
> > > > >
> > > > >
> > > > >
> > > > > Some notes inline.
> > > > >
> > > > > Jon Peterson
> > > > > NeuStar, Inc.
> > > > >
> > > > > > -----Original Message-----
> > > > > > From: Paul Kyzivat [mailto:pkyzivat@cisco.com]
> > > > > > Sent: Thursday, April 07, 2005 7:33 AM
> > > > > > To: Brian Rosen
> > > > > > Cc: Peterson, Jon; sip@ietf.org
> > > > > > Subject: Re: [Sip] sip-identity-05: display-name woes
> > > > > >
> > > > > [snip]
> > > > > >
> > > > > > The most immediate problem I can see comes when your
> > > call lands on
> > > > a
> > > > > > gateway to the PSTN. At that point the identification
> > > > > conventions of the
> > > > > > SIP network must be interworked with those of the
> > > public telephone
> > > > > > network. The gateway must decide whether to populate the
> > > > > calling name
> > > > > > and number fields on the PSTN side. If it has no
> > > > > authentication that the
> > > > > > information is correct, should it populate it?
> > > > >
> > > > > Let's be careful, though. If I'm calling from
> > > > > sip:jon@example.com, what exactly does the gateway put in the
> > > > > ISUP CgPN field, let alone what might it share as a textual
> > > > > string in the GNP? That sort of SIP-ISUP mapping has bigger
> > > > > problems than just how to deal with display-name. Clearly, if
> > > > > the gateway is going to just make up a telephone number to
> > > > > represent the calling party, all bets are off about how to
> > > > > understand the GNP.
> > > > >
> > > > > Of course, the From header field of a SIP request
> might contain
> > > > > a tel URI, or a SIP URI with a tel URI user portion.
> But in that
> > > > > instance, provided it is a valid telephone number,
> there is most
> > > > > likely a CNAM record associated with it in the PSTN.
> Gateways or
> > > > > subsequent PSTN signaling elements can always do CNAM
> queries to
> > > > > recover the associated appropriate calling name to
> populate the
> > > > > GNP. But clearly there's no point in even getting the CNAM if
> > > > > the telephone number itself can just trivially be
> forged in SIP
> > > > > From header fields. This gets into the whole question
> of why a
> > > > > gateway would ever trust an Identity header that asserts a
> > > > > telephone number. As sip-identity-04 suggests, that
> has to be a
> > > > > subject for future work, but the only plausible lines
> of thought
> > > > > we have on this today are ENUM architectures.
> > > > >
> > > > > By launching an ENUM query, the story might go, the gateway
> > > > > could learn who the number owner is, and thus who
> should provide
> > > > > the signature over the Identity information, and
> conceivably the
> > > > > gateway could also learn info like CNAM at the time.
> This would
> > > > > be tantamount to just reinventing CNAM in an IP context -
> > > > > something that is probably inevitable if telephone
> numbers are
> > > > > to be used extensively in SIP, something that people are no
> > > > > doubt noodling in various shops around the world today, and
> > > > > something that probably wouldn't necessarily require
> signing the
> > > > > display-name in order for it to
> > > > work.
> > > > >
> > > > > But until we boil that particular ocean, I feel that PSTN
> > > > > interworking might not the best case on which to argue the
> > > > > display-name issue one way or another.
> > > > >
> > > > > _______________________________________________
> > > > > Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
> > > > > This list is for NEW development of the core SIP Protocol Use
> > > > > sip-implementors@cs.columbia.edu for questions on current sip
> > Use
> > > > > sipping@ietf.org for new developments on the
> application of sip
> > > > >
> > > > >
> > > >
> > > >
> > > >
> > > >
> > >
> >
> ______________________________________________________________________
> > > > _______________________________________________
> > > > Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
> > > > This list is for NEW development of the core SIP Protocol Use
> > > > sip-implementors@cs.columbia.edu for questions on
> > > current sip Use
> > > > sipping@ietf.org for new developments on the application of sip
> > >
> >
> >
> >
> >
> ______________________________________________________________________
> > _______________________________________________
> > Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
> > This list is for NEW development of the core SIP Protocol
> > Use sip-implementors@cs.columbia.edu for questions on
> current sip Use
> > sipping@ietf.org for new developments on the application of sip
>

------_=_NextPart_001_01C54503.17834A6F-- --===============1767372612== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip --===============1767372612==-- From sip-bounces@ietf.org Tue Apr 19 13:25:42 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DNwTm-0000Bz-Nm; Tue, 19 Apr 2005 13:25:42 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DNwTj-0000Bu-Rq for sip@megatron.ietf.org; Tue, 19 Apr 2005 13:25:39 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA29405 for ; Tue, 19 Apr 2005 13:25:35 -0400 (EDT) Received: from sj-iport-3-in.cisco.com ([171.71.176.72] helo=sj-iport-3.cisco.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DNwem-0006ij-Iy for sip@ietf.org; Tue, 19 Apr 2005 13:37:05 -0400 Received: from sj-core-5.cisco.com (171.71.177.238) by sj-iport-3.cisco.com with ESMTP; 19 Apr 2005 10:23:30 -0700 X-IronPort-AV: i="3.92,114,1112598000"; d="asc'?scan'208"; a="251663758:sNHT867631830" Received: from imail.cisco.com (imail.cisco.com [128.107.200.91]) by sj-core-5.cisco.com (8.12.10/8.12.6) with ESMTP id j3JHNRhu003894; Tue, 19 Apr 2005 10:23:28 -0700 (PDT) Received: from thomasm-lnx.cisco.com (thomasm-lnx.cisco.com [171.71.96.50]) by imail.cisco.com (8.12.11/8.12.10) with ESMTP id j3JHEWMm024124; Tue, 19 Apr 2005 10:14:33 -0700 Subject: RE: [Sip] sip-identity-05: display-name woes From: Michael Thomas To: Francois Audet In-Reply-To: <1ECE0EB50388174790F9694F77522CCF01F3F369@zrc2hxm0.corp.nortel.com> References: <1ECE0EB50388174790F9694F77522CCF01F3F369@zrc2hxm0.corp.nortel.com> Organization: Cisco Systems Message-Id: <1113931406.2296.30.camel@thomasm-lnx.cisco.com> Mime-Version: 1.0 X-Mailer: Ximian Evolution 1.4.6 Date: Tue, 19 Apr 2005 10:23:27 -0700 IIM-SIG: v:"1.1"; h:"imail.cisco.com"; d:"cisco.com"; z:"home"; m:"krs"; t:"1113930873.74804"; x:"432200"; a:"rsa-sha1"; b:"nofws:6983"; e:"Iw=="; n:"sQYarK2E51MdcTiUqeif3F7cWdxIfoCiXhdfb9vD5ee/j0jXL15gbFxF2p" "XIweAblu0N6XAgK7k+wrbr7bQDJaCDqOmzqpRUBjIRQAXQ7NzadpmR3pUL6wxaRUtW+c43sl9jC" "50Qg1sXHpPjt8Y+Y16ioyQAQAdSunM4YhevURc="; s:"B/wdDGQZ1FMia4Tr7quSl8INc2B9/eehgrntYg1VS95W1GVi6kx9/byaO2cEoeC9j8Gq0E7t" "qzt+uZk7m5KCHkHWm0lGEoaHtDbgiIqJPFZbNnl+s/UfwW6866RWuhPw6eyiG9SWfyNsqFeCnHs" "6altbDjKcW6AH3+ti0SEGpgw="; c:"Subject: RE: [Sip] sip-identity-05: display-name woes"; c:"From: Michael Thomas "; c:"Date: Tue, 19 Apr 2005 10:23:27 -0700" IIM-VERIFY: s:"y"; v:"y"; r:"60"; h:"imail.cisco.com"; c:"message from imail.cisco.com verified; " X-Spam-Score: 0.0 (/) X-Scan-Signature: 6a45e05c1e4343200aa6b327df2c43fc Cc: "'sip@ietf.org'" , 'Paul Kyzivat' , "'Peterson, Jon'" X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============0758262725==" Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org --===============0758262725== Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="=-6uScJpQdoQMjNHgKVKpm" --=-6uScJpQdoQMjNHgKVKpm Content-Type: text/plain Content-Transfer-Encoding: quoted-printable On Tue, 2005-04-19 at 10:13, Francois Audet wrote: > Agreed. That's what I meant: a secure P-Asserted-Identity. Oh, ok. I'm not a fan of P-A-I, so I thought you were pressing one of my hot buttons :) Mike >=20 > > -----Original Message----- > > From: Michael Thomas [mailto:mat@cisco.com]=20 > > Sent: Tuesday, April 19, 2005 10:09 > > To: Audet, Francois [SC100:9T51:EXCH] > > Cc: 'sip@ietf.org'; 'Paul Kyzivat'; 'Peterson, Jon' > > Subject: RE: [Sip] sip-identity-05: display-name woes > >=20 > >=20 > >=20 > > On Tue, 2005-04-19 at 09:48, Francois Audet wrote: > > > It starts to sound like P-Asserted-Identity. > >=20 > > No. P-Asserted-Identity is forgery-4-free. A > > cryptographic means of establishing identity paired > > with the ability to bind it with authorization is > > what P-Asserted-Identity wants to be when it grows up. > >=20 > > Mike > >=20 > > >=20 > > > > -----Original Message----- > > > > From: Michael Thomas [mailto:mat@cisco.com] > > > > Sent: Monday, April 18, 2005 15:02 > > > > To: Audet, Francois [SC100:9T51:EXCH] > > > > Cc: 'Peterson, Jon'; 'Paul Kyzivat'; 'Brian Rosen'; > 'sip@ietf.org' > > > > Subject: RE: [Sip] sip-identity-05: display-name woes > > > >=20 > > > >=20 > > > > On Mon, 2005-04-18 at 11:56, Francois Audet wrote: > > > > > There is also the case where the ENUM database wouldn't > > > > have the Name > > > > > of the end-user because a block of phone numbers are assigned > to > > > an > > > > > organization (like > > > > > a corporation). > > > > >=20 > > > > > It this case, I'm assuming that the display name would be > > > > provided by > > > > > the organization itself, but the SIP service provider=20 > > would assert=20 > > > > > that the organization was allowed to populate the display > name. > > > >=20 > > > > This strikes me as most likely broken: it relies on transitive=20 > > > > trust, for one thing. And it also implies that there's=20 > > some sort of=20 > > > > trusted intermediary, which is not always the case; nor=20 > > should it be=20 > > > > *required* to be the case to get the desired authorization=20 > > > > characteristics. > > > >=20 > > > > Much better would be for a way for the name space owner > > > > to assert whether something using its name space is authorized > or=20 > > > > not to be sending on its behalf. And DNSsec alone for=20 > > ENUM doesn't=20 > > > > provide this since DNSsec is a source authentication=20 > > scheme, not a=20 > > > > source authorization service. > > > >=20 > > > > Of course, I think that sip-identity suffers from the > > > > same problem... > > > >=20 > > > > Mike > > > >=20 > > > > >=20 > > > > > Perhaps ENUM could be used to verify that, but it wouldn't > > > > be used to > > > > > derive the name itself (just the owner). > > > > >=20 > > > > > Is this what you had in mind? > > > > >=20 > > > > > > -----Original Message----- > > > > > > From: sip-bounces@ietf.org [mailto:sip-bounces@ietf.org] On=20 > > > > > > Behalf Of Peterson, Jon > > > > > > Sent: Friday, April 08, 2005 12:54 > > > > > > To: Paul Kyzivat; Brian Rosen > > > > > > Cc: sip@ietf.org > > > > > > Subject: RE: [Sip] sip-identity-05: display-name woes > > > > > >=20 > > > > > >=20 > > > > > >=20 > > > > > > Some notes inline. > > > > > >=20 > > > > > > Jon Peterson > > > > > > NeuStar, Inc. > > > > > >=20 > > > > > > > -----Original Message----- > > > > > > > From: Paul Kyzivat [mailto:pkyzivat@cisco.com] > > > > > > > Sent: Thursday, April 07, 2005 7:33 AM > > > > > > > To: Brian Rosen > > > > > > > Cc: Peterson, Jon; sip@ietf.org > > > > > > > Subject: Re: [Sip] sip-identity-05: display-name woes > > > > > > >=20 > > > > > > [snip] > > > > > > >=20 > > > > > > > The most immediate problem I can see comes when your > > > > call lands on > > > > > a > > > > > > > gateway to the PSTN. At that point the identification > > > > > > conventions of the > > > > > > > SIP network must be interworked with those of the > > > > public telephone > > > > > > > network. The gateway must decide whether to populate the > > > > > > calling name > > > > > > > and number fields on the PSTN side. If it has no > > > > > > authentication that the > > > > > > > information is correct, should it populate it? > > > > > >=20 > > > > > > Let's be careful, though. If I'm calling from=20 > > > > > > sip:jon@example.com, what exactly does the gateway put in > the=20 > > > > > > ISUP CgPN field, let alone what might it share as a textual=20 > > > > > > string in the GNP? That sort of SIP-ISUP mapping has bigger=20 > > > > > > problems than just how to deal with display-name. Clearly, > if=20 > > > > > > the gateway is going to just make up a telephone number to=20 > > > > > > represent the calling party, all bets are off about how to=20 > > > > > > understand the GNP. > > > > > >=20 > > > > > > Of course, the From header field of a SIP request=20 > > might contain=20 > > > > > > a tel URI, or a SIP URI with a tel URI user portion.=20 > > But in that=20 > > > > > > instance, provided it is a valid telephone number,=20 > > there is most=20 > > > > > > likely a CNAM record associated with it in the PSTN.=20 > > Gateways or=20 > > > > > > subsequent PSTN signaling elements can always do CNAM=20 > > queries to=20 > > > > > > recover the associated appropriate calling name to=20 > > populate the=20 > > > > > > GNP. But clearly there's no point in even getting the CNAM > if=20 > > > > > > the telephone number itself can just trivially be=20 > > forged in SIP=20 > > > > > > From header fields. This gets into the whole question=20 > > of why a=20 > > > > > > gateway would ever trust an Identity header that asserts a=20 > > > > > > telephone number. As sip-identity-04 suggests, that=20 > > has to be a=20 > > > > > > subject for future work, but the only plausible lines=20 > > of thought=20 > > > > > > we have on this today are ENUM architectures. > > > > > >=20 > > > > > > By launching an ENUM query, the story might go, the gateway=20 > > > > > > could learn who the number owner is, and thus who=20 > > should provide=20 > > > > > > the signature over the Identity information, and=20 > > conceivably the=20 > > > > > > gateway could also learn info like CNAM at the time.=20 > > This would=20 > > > > > > be tantamount to just reinventing CNAM in an IP context -=20 > > > > > > something that is probably inevitable if telephone=20 > > numbers are=20 > > > > > > to be used extensively in SIP, something that people are no=20 > > > > > > doubt noodling in various shops around the world today, and=20 > > > > > > something that probably wouldn't necessarily require=20 > > signing the=20 > > > > > > display-name in order for it to > > > > > work. > > > > > >=20 > > > > > > But until we boil that particular ocean, I feel that PSTN=20 > > > > > > interworking might not the best case on which to argue the=20 > > > > > > display-name issue one way or another. > > > > > >=20 > > > > > > _______________________________________________ > > > > > > Sip mailing list https://www1.ietf.org/mailman/listinfo/sip > > > > > > This list is for NEW development of the core SIP Protocol > Use > > > > > > sip-implementors@cs.columbia.edu for questions on current > sip > > > Use > > > > > > sipping@ietf.org for new developments on the=20 > > application of sip > > > > > >=20 > > > > > >=20 > > > > >=20 > > > > >=20 > > > > >=20 > > > > >=20 > > > > > > >=20 > > > ______________________________________________________________________ > > > > > _______________________________________________ > > > > > Sip mailing list https://www1.ietf.org/mailman/listinfo/sip > > > > > This list is for NEW development of the core SIP Protocol Use=20 > > > > > sip-implementors@cs.columbia.edu for questions on > > > > current sip Use > > > > > sipping@ietf.org for new developments on the application of > sip > > > >=20 > > >=20 > > >=20 > > >=20 > > >=20 > > > ______________________________________________________________________ > > > _______________________________________________ > > > Sip mailing list https://www1.ietf.org/mailman/listinfo/sip > > > This list is for NEW development of the core SIP Protocol > > > Use sip-implementors@cs.columbia.edu for questions on=20 > > current sip Use=20 > > > sipping@ietf.org for new developments on the application of sip > >=20 >=20 --=-6uScJpQdoQMjNHgKVKpm Content-Type: application/pgp-signature; name=signature.asc Content-Description: This is a digitally signed message part -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.3 (GNU/Linux) iQCVAwUAQmU+jrMsDAj/Eq++AQK5GAP/XTKt+cSCyZSnPq2MywyEun2TbO6upNsw 5MuePZkIJc0roym4C7KKIwXwU9+Z3lNfW+c0hdFqBPxwowZFbSwiB3WUEIuynTbP flKHGFk8Brbbk8RDMbh/9uKoJColrIprc3r+cJ6GZZbVFDhsKgqwgeTQCKpOQuTT X3UF6MN6Jpc= =mxHt -----END PGP SIGNATURE----- --=-6uScJpQdoQMjNHgKVKpm-- --===============0758262725== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip --===============0758262725==-- From sip-bounces@ietf.org Tue Apr 19 13:50:29 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DNwrk-0004x8-Ve; Tue, 19 Apr 2005 13:50:28 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DNwri-0004x3-7u for sip@megatron.ietf.org; Tue, 19 Apr 2005 13:50:26 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA01564 for ; Tue, 19 Apr 2005 13:50:24 -0400 (EDT) Received: from mailhost.iperia.com ([204.57.52.4] helo=iperia.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DNx2l-0007eN-1K for sip@ietf.org; Tue, 19 Apr 2005 14:01:52 -0400 X-MimeOLE: Produced By Microsoft Exchange V6.5.6944.0 Content-class: urn:content-classes:message MIME-Version: 1.0 Subject: RE: [Sip] sip-identity-05: display-name woes Date: Tue, 19 Apr 2005 13:49:56 -0400 Message-ID: <8019F8581B5FC14DBD94BAF86844868E5F77C0@viridis.IPeria.local> Thread-topic: [Sip] sip-identity-05: display-name woes Thread-index: AcVFBCyPkEFwjC9ASs6oENnol6Vl5AAA/ELA From: "Gordon Ledgard" To: "Francois Audet" , "Michael Thomas" X-Spam-Score: 0.3 (/) X-Scan-Signature: 5a985ed7c9101086bea2cd7287e9f83a Cc: sip@ietf.org, Paul Kyzivat , "Peterson, Jon" X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============0250717649==" Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org This is a multi-part message in MIME format. --===============0250717649== Content-class: urn:content-classes:message Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C54508.32D3661C" This is a multi-part message in MIME format. ------_=_NextPart_001_01C54508.32D3661C Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable =20 Now your talking. =20 =20 ________________________________ From: sip-bounces@ietf.org [mailto:sip-bounces@ietf.org] On Behalf Of Francois Audet Sent: Tuesday, April 19, 2005 1:13 PM To: 'Michael Thomas' Cc: 'sip@ietf.org'; 'Paul Kyzivat'; 'Peterson, Jon' Subject: RE: [Sip] sip-identity-05: display-name woes =20 Agreed. That's what I meant: a secure P-Asserted-Identity.=20 > -----Original Message-----=20 > From: Michael Thomas [mailto:mat@cisco.com]=20 > Sent: Tuesday, April 19, 2005 10:09=20 > To: Audet, Francois [SC100:9T51:EXCH]=20 > Cc: 'sip@ietf.org'; 'Paul Kyzivat'; 'Peterson, Jon'=20 > Subject: RE: [Sip] sip-identity-05: display-name woes=20 >=20 >=20 >=20 > On Tue, 2005-04-19 at 09:48, Francois Audet wrote:=20 > > It starts to sound like P-Asserted-Identity.=20 >=20 > No. P-Asserted-Identity is forgery-4-free. A=20 > cryptographic means of establishing identity paired=20 > with the ability to bind it with authorization is=20 > what P-Asserted-Identity wants to be when it grows up.=20 >=20 > Mike=20 >=20 > >=20 > > > -----Original Message-----=20 > > > From: Michael Thomas [mailto:mat@cisco.com]=20 > > > Sent: Monday, April 18, 2005 15:02=20 > > > To: Audet, Francois [SC100:9T51:EXCH]=20 > > > Cc: 'Peterson, Jon'; 'Paul Kyzivat'; 'Brian Rosen'; 'sip@ietf.org' > > > Subject: RE: [Sip] sip-identity-05: display-name woes=20 > > >=20 > > >=20 > > > On Mon, 2005-04-18 at 11:56, Francois Audet wrote:=20 > > > > There is also the case where the ENUM database wouldn't=20 > > > have the Name=20 > > > > of the end-user because a block of phone numbers are assigned to > > an=20 > > > > organization (like=20 > > > > a corporation).=20 > > > >=20 > > > > It this case, I'm assuming that the display name would be=20 > > > provided by=20 > > > > the organization itself, but the SIP service provider=20 > would assert=20 > > > > that the organization was allowed to populate the display name.=20 > > >=20 > > > This strikes me as most likely broken: it relies on transitive=20 > > > trust, for one thing. And it also implies that there's=20 > some sort of=20 > > > trusted intermediary, which is not always the case; nor=20 > should it be=20 > > > *required* to be the case to get the desired authorization=20 > > > characteristics.=20 > > >=20 > > > Much better would be for a way for the name space owner=20 > > > to assert whether something using its name space is authorized or=20 > > > not to be sending on its behalf. And DNSsec alone for=20 > ENUM doesn't=20 > > > provide this since DNSsec is a source authentication=20 > scheme, not a=20 > > > source authorization service.=20 > > >=20 > > > Of course, I think that sip-identity suffers from the=20 > > > same problem...=20 > > >=20 > > > Mike=20 > > >=20 > > > >=20 > > > > Perhaps ENUM could be used to verify that, but it wouldn't=20 > > > be used to=20 > > > > derive the name itself (just the owner).=20 > > > >=20 > > > > Is this what you had in mind?=20 > > > >=20 > > > > > -----Original Message-----=20 > > > > > From: sip-bounces@ietf.org [mailto:sip-bounces@ietf.org] On=20 > > > > > Behalf Of Peterson, Jon=20 > > > > > Sent: Friday, April 08, 2005 12:54=20 > > > > > To: Paul Kyzivat; Brian Rosen=20 > > > > > Cc: sip@ietf.org=20 > > > > > Subject: RE: [Sip] sip-identity-05: display-name woes=20 > > > > >=20 > > > > >=20 > > > > >=20 > > > > > Some notes inline.=20 > > > > >=20 > > > > > Jon Peterson=20 > > > > > NeuStar, Inc.=20 > > > > >=20 > > > > > > -----Original Message-----=20 > > > > > > From: Paul Kyzivat [mailto:pkyzivat@cisco.com]=20 > > > > > > Sent: Thursday, April 07, 2005 7:33 AM=20 > > > > > > To: Brian Rosen=20 > > > > > > Cc: Peterson, Jon; sip@ietf.org=20 > > > > > > Subject: Re: [Sip] sip-identity-05: display-name woes=20 > > > > > >=20 > > > > > [snip]=20 > > > > > >=20 > > > > > > The most immediate problem I can see comes when your=20 > > > call lands on=20 > > > > a=20 > > > > > > gateway to the PSTN. At that point the identification=20 > > > > > conventions of the=20 > > > > > > SIP network must be interworked with those of the=20 > > > public telephone=20 > > > > > > network. The gateway must decide whether to populate the=20 > > > > > calling name=20 > > > > > > and number fields on the PSTN side. If it has no=20 > > > > > authentication that the=20 > > > > > > information is correct, should it populate it?=20 > > > > >=20 > > > > > Let's be careful, though. If I'm calling from=20 > > > > > sip:jon@example.com, what exactly does the gateway put in the=20 > > > > > ISUP CgPN field, let alone what might it share as a textual=20 > > > > > string in the GNP? That sort of SIP-ISUP mapping has bigger=20 > > > > > problems than just how to deal with display-name. Clearly, if=20 > > > > > the gateway is going to just make up a telephone number to=20 > > > > > represent the calling party, all bets are off about how to=20 > > > > > understand the GNP.=20 > > > > >=20 > > > > > Of course, the From header field of a SIP request=20 > might contain=20 > > > > > a tel URI, or a SIP URI with a tel URI user portion.=20 > But in that=20 > > > > > instance, provided it is a valid telephone number,=20 > there is most=20 > > > > > likely a CNAM record associated with it in the PSTN.=20 > Gateways or=20 > > > > > subsequent PSTN signaling elements can always do CNAM=20 > queries to=20 > > > > > recover the associated appropriate calling name to=20 > populate the=20 > > > > > GNP. But clearly there's no point in even getting the CNAM if=20 > > > > > the telephone number itself can just trivially be=20 > forged in SIP=20 > > > > > From header fields. This gets into the whole question=20 > of why a=20 > > > > > gateway would ever trust an Identity header that asserts a=20 > > > > > telephone number. As sip-identity-04 suggests, that=20 > has to be a=20 > > > > > subject for future work, but the only plausible lines=20 > of thought=20 > > > > > we have on this today are ENUM architectures.=20 > > > > >=20 > > > > > By launching an ENUM query, the story might go, the gateway=20 > > > > > could learn who the number owner is, and thus who=20 > should provide=20 > > > > > the signature over the Identity information, and=20 > conceivably the=20 > > > > > gateway could also learn info like CNAM at the time.=20 > This would=20 > > > > > be tantamount to just reinventing CNAM in an IP context -=20 > > > > > something that is probably inevitable if telephone=20 > numbers are=20 > > > > > to be used extensively in SIP, something that people are no=20 > > > > > doubt noodling in various shops around the world today, and=20 > > > > > something that probably wouldn't necessarily require=20 > signing the=20 > > > > > display-name in order for it to=20 > > > > work.=20 > > > > >=20 > > > > > But until we boil that particular ocean, I feel that PSTN=20 > > > > > interworking might not the best case on which to argue the=20 > > > > > display-name issue one way or another.=20 > > > > >=20 > > > > > _______________________________________________=20 > > > > > Sip mailing list https://www1.ietf.org/mailman/listinfo/sip=20 > > > > > This list is for NEW development of the core SIP Protocol Use=20 > > > > > sip-implementors@cs.columbia.edu for questions on current sip=20 > > Use=20 > > > > > sipping@ietf.org for new developments on the=20 > application of sip=20 > > > > >=20 > > > > >=20 > > > >=20 > > > >=20 > > > >=20 > > > >=20 > > >=20 > >=20 > ______________________________________________________________________ > > > > _______________________________________________=20 > > > > Sip mailing list https://www1.ietf.org/mailman/listinfo/sip=20 > > > > This list is for NEW development of the core SIP Protocol Use=20 > > > > sip-implementors@cs.columbia.edu for questions on=20 > > > current sip Use=20 > > > > sipping@ietf.org for new developments on the application of sip=20 > > >=20 > >=20 > >=20 > >=20 > >=20 > ______________________________________________________________________ > > _______________________________________________=20 > > Sip mailing list https://www1.ietf.org/mailman/listinfo/sip=20 > > This list is for NEW development of the core SIP Protocol=20 > > Use sip-implementors@cs.columbia.edu for questions on=20 > current sip Use=20 > > sipping@ietf.org for new developments on the application of sip=20 >=20 ------_=_NextPart_001_01C54508.32D3661C Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable RE: [Sip] sip-identity-05: display-name woes

 

Now your = talking.

 

 


From: sip-bounces@ietf.org [mailto:sip-bounces@ietf.org] On Behalf Of Francois Audet
Sent: Tuesday, April 19, = 2005 1:13 PM
To: 'Michael Thomas'
Cc: 'sip@ietf.org'; 'Paul Kyzivat'; 'Peterson, Jon'
Subject: RE: [Sip] sip-identity-05: display-name woes

 

Agreed. That's what I meant: a secure P-Asserted-Identity. =

> -----Original Message-----
> From: Michael = Thomas [mailto:mat@cisco.com] =
> Sent: Tuesday, = April 19, 2005 10:09
> To: Audet, Francois [SC100:9T51:EXCH]
> Cc: 'sip@ietf.org'; = 'Paul Kyzivat'; 'Peterson, Jon'
> Subject: RE: [Sip] sip-identity-05: display-name woes
>
>
>
> On Tue, 2005-04-19 = at 09:48, Francois Audet wrote:
> > It starts to = sound like P-Asserted-Identity.
>
>   No. P-Asserted-Identity is forgery-4-free. A
>   = cryptographic means of establishing identity paired
>   with = the ability to bind it with authorization is
>   what P-Asserted-Identity wants to be when it grows up.
>
> =               Mike
>
> > =
> > > = -----Original Message-----
> > > From: = Michael Thomas [mailto:mat@cisco.com] =
> > > Sent: = Monday, April 18, 2005 15:02
> > > To: = Audet, Francois [SC100:9T51:EXCH]
> > > Cc: = 'Peterson, Jon'; 'Paul Kyzivat'; 'Brian Rosen'; 'sip@ietf.org'
> > > Subject: = RE: [Sip] sip-identity-05: display-name woes
> > > =
> > > =
> > > On Mon, = 2005-04-18 at 11:56, Francois Audet wrote:
> > > > = There is also the case where the ENUM database wouldn't
> > > have the = Name
> > > > of = the end-user because a block of phone numbers are assigned to
> > = an
> > > > = organization (like
> > > > a = corporation).
> > > > =
> > > > It = this case, I'm assuming that the display name would be
> > > provided = by
> > > > the organization itself, but the SIP service provider
> would assert =
> > > > that = the organization was allowed to populate the display name. =
> > > =
> > > This = strikes me as most likely broken: it relies on transitive
> > > trust, = for one thing. And it also implies that there's
> some sort of =
> > > trusted intermediary, which is not always the case; nor
> should it be =
> > > = *required* to be the case to get the desired authorization
> > > = characteristics.
> > > =
> > > Much = better would be for a way for the name space owner
> > > to assert = whether something using its name space is authorized or
> > > not to be = sending on its behalf. And DNSsec alone for
> ENUM doesn't =
> > > provide = this since DNSsec is a source authentication
> scheme, not a =
> > > source = authorization service.
> > > =
> > > Of = course, I think that sip-identity suffers from the
> > > same = problem...
> > > =
> > >           &nb= sp;   Mike
> > > =
> > > > =
> > > > = Perhaps ENUM could be used to verify that, but it wouldn't
> > > be used = to
> > > > = derive the name itself (just the owner).
> > > > =
> > > > Is = this what you had in mind?
> > > > =
> > > > > -----Original Message-----
> > > > > = From: sip-bounces@ietf.org [mailto:sip-bounces@ietf.org] On
> > > > > = Behalf Of Peterson, Jon
> > > > > = Sent: Friday, April 08, 2005 12:54
> > > > > = To: Paul Kyzivat; Brian Rosen
> > > > > = Cc: sip@ietf.org
> > > > > = Subject: RE: [Sip] sip-identity-05: display-name woes
> > > > > =
> > > > > =
> > > > > =
> > > > > = Some notes inline.
> > > > > =
> > > > > = Jon Peterson
> > > > > = NeuStar, Inc.
> > > > > =
> > > > > = > -----Original Message-----
> > > > > = > From: Paul Kyzivat [mailto:pkyzivat@cisco.com]<= /font>
> > > > > = > Sent: Thursday, April 07, 2005 7:33 AM
> > > > > = > To: Brian Rosen
> > > > > = > Cc: Peterson, Jon; sip@ietf.org
> > > > > = > Subject: Re: [Sip] sip-identity-05: display-name woes
> > > > > = >
> > > > > = [snip]
> > > > > = >
> > > > > = > The most immediate problem I can see comes when your
> > > call = lands on
> > > > = a
> > > > > = > gateway to the PSTN. At that point the identification
> > > > > conventions of the
> > > > > = > SIP network must be interworked with those of the
> > > public = telephone
> > > > > = > network. The gateway must decide whether to populate the =
> > > > > = calling name
> > > > > = > and number fields on the PSTN side. If it has no
> > > > > authentication that the
> > > > > = > information is correct, should it populate it?
> > > > > =
> > > > > = Let's be careful, though. If I'm calling from
> > > > > sip:jon@example.com, what exactly does the gateway put in the =
> > > > > = ISUP CgPN field, let alone what might it share as a textual
> > > > > = string in the GNP? That sort of SIP-ISUP mapping has bigger
> > > > > = problems than just how to deal with display-name. Clearly, if
> > > > > = the gateway is going to just make up a telephone number to =
> > > > > = represent the calling party, all bets are off about how to
> > > > > = understand the GNP.
> > > > > =
> > > > > = Of course, the From header field of a SIP request
> might contain =
> > > > > = a tel URI, or a SIP URI with a tel URI user portion.
> But in that =
> > > > > = instance, provided it is a valid telephone number,
> there is most =
> > > > > = likely a CNAM record associated with it in the PSTN.
> Gateways or =
> > > > > = subsequent PSTN signaling elements can always do CNAM
> queries to =
> > > > > = recover the associated appropriate calling name to
> populate the =
> > > > > = GNP. But clearly there's no point in even getting the CNAM if
> > > > > = the telephone number itself can just trivially be
> forged in SIP =
> > > > > = From header fields. This gets into the whole question
> of why a =
> > > > > = gateway would ever trust an Identity header that asserts a
> > > > > = telephone number. As sip-identity-04 suggests, that
> has to be a =
> > > > > = subject for future work, but the only plausible lines
> of thought =
> > > > > = we have on this today are ENUM architectures.
> > > > > =
> > > > > = By launching an ENUM query, the story might go, the gateway =
> > > > > = could learn who the number owner is, and thus who
> should provide =
> > > > > = the signature over the Identity information, and
> conceivably the =
> > > > > = gateway could also learn info like CNAM at the time.
> This would =
> > > > > = be tantamount to just reinventing CNAM in an IP context - =
> > > > > = something that is probably inevitable if telephone
> numbers are =
> > > > > = to be used extensively in SIP, something that people are no
> > > > > = doubt noodling in various shops around the world today, and
> > > > > = something that probably wouldn't necessarily require
> signing the =
> > > > > display-name in order for it to
> > > > = work.
> > > > > =
> > > > > = But until we boil that particular ocean, I feel that PSTN
> > > > > = interworking might not the best case on which to argue the
> > > > > display-name issue one way or another.
> > > > > =
> > > > > _______________________________________________
> > > > > = Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
> > > > > = This list is for NEW development of the core SIP Protocol Use
> > > > > sip-implementors@cs.columbia.edu for questions on current = sip
> > = Use
> > > > > sipping@ietf.org for new developments on the
> application of = sip
> > > > > =
> > > > > =
> > > > =
> > > > =
> > > > =
> > > > =
> > = >
> > =
> ______________________________________________________________________
> > > > _______________________________________________
> > > > Sip = mailing list  https://www1.ietf.org/mailman/listinfo/sip
> > > > This = list is for NEW development of the core SIP Protocol Use
> > > > sip-implementors@cs.columbia.edu for questions on
> > > current = sip Use
> > > > sipping@ietf.org for new developments on the application of = sip
> > > =
> > =
> > =
> > =
> > =
> ______________________________________________________________________
> > _______________________________________________
> > Sip mailing = list  https://www1.ietf.org/mailman/listinfo/sip
> > This list is = for NEW development of the core SIP Protocol
> > Use sip-implementors@cs.columbia.edu for questions on
> current sip Use =
> > = sipping@ietf.org for new developments on the application of sip
> =

------_=_NextPart_001_01C54508.32D3661C-- --===============0250717649== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip --===============0250717649==-- From sip-bounces@ietf.org Tue Apr 19 13:59:31 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DNx0V-0006P5-QZ; Tue, 19 Apr 2005 13:59:31 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DNx0R-0006KG-Ka for sip@megatron.ietf.org; Tue, 19 Apr 2005 13:59:29 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA02358 for ; Tue, 19 Apr 2005 13:59:25 -0400 (EDT) Received: from sj-iport-3-in.cisco.com ([171.71.176.72] helo=sj-iport-3.cisco.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DNxBV-0007yO-AC for sip@ietf.org; Tue, 19 Apr 2005 14:10:53 -0400 Received: from sj-core-5.cisco.com (171.71.177.238) by sj-iport-3.cisco.com with ESMTP; 19 Apr 2005 10:59:26 -0700 X-IronPort-AV: i="3.92,114,1112598000"; d="asc'?scan'208"; a="251690052:sNHT49081380" Received: from imail.cisco.com (imail.cisco.com [128.107.200.91]) by sj-core-5.cisco.com (8.12.10/8.12.6) with ESMTP id j3JHxNhu016777; Tue, 19 Apr 2005 10:59:24 -0700 (PDT) Received: from thomasm-lnx.cisco.com (thomasm-lnx.cisco.com [171.71.96.50]) by imail.cisco.com (8.12.11/8.12.10) with ESMTP id j3JHoSQO024568; Tue, 19 Apr 2005 10:50:29 -0700 Subject: RE: [Sip] sip-identity-05: display-name woes From: Michael Thomas To: Brian Rosen In-Reply-To: <40qjfr$1n6p3c@sj-inbound-b.cisco.com> References: <40qjfr$1n6p3c@sj-inbound-b.cisco.com> Organization: Cisco Systems Message-Id: <1113933562.2294.44.camel@thomasm-lnx.cisco.com> Mime-Version: 1.0 X-Mailer: Ximian Evolution 1.4.6 Date: Tue, 19 Apr 2005 10:59:23 -0700 IIM-SIG: v:"1.1"; h:"imail.cisco.com"; d:"cisco.com"; z:"home"; m:"krs"; t:"1113933029.60955"; x:"432200"; a:"rsa-sha1"; b:"nofws:3580"; e:"Iw=="; n:"sQYarK2E51MdcTiUqeif3F7cWdxIfoCiXhdfb9vD5ee/j0jXL15gbFxF2p" "XIweAblu0N6XAgK7k+wrbr7bQDJaCDqOmzqpRUBjIRQAXQ7NzadpmR3pUL6wxaRUtW+c43sl9jC" "50Qg1sXHpPjt8Y+Y16ioyQAQAdSunM4YhevURc="; s:"hGWr2Qix1LhQZCtTxbVbaH2B4V/xakvbx33D+DIJdk3atPFMshGRE+HTYCGh/uf2jxOg03Hk" "HA3iDLzgG9b1Az+pdjdCoPXL4htfFKFzf3VBQEdedNxpVkOKL+foGr26u9U2E2+ifK3eRcz2eBR" "lnYXwVAnUACOdGPsWokXaPCo="; c:"Subject: RE: [Sip] sip-identity-05: display-name woes"; c:"From: Michael Thomas "; c:"Date: Tue, 19 Apr 2005 10:59:23 -0700" IIM-VERIFY: s:"y"; v:"y"; r:"60"; h:"imail.cisco.com"; c:"message from imail.cisco.com verified; " X-Spam-Score: 0.0 (/) X-Scan-Signature: 37af5f8fbf6f013c5b771388e24b09e7 Cc: sip@ietf.org, 'Paul Kyzivat' , "'Peterson, Jon'" X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============1373012324==" Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org --===============1373012324== Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="=-27tn6bcdO7dCLlA6GPWm" --=-27tn6bcdO7dCLlA6GPWm Content-Type: text/plain Content-Transfer-Encoding: quoted-printable On Tue, 2005-04-19 at 04:27, Brian Rosen wrote: > Which do you find more useful: Caller name in the PSTN or display name in > email? This a false dilemma: both are "useful", or at least ought to be "useful". > One is "authenticated", the other is not. Uh, I'll bite: which one is authenticated? > Let's face it, the PSTN caller name system is fundamentally broken, and i= t > doesn't work as well, or as reliably FROM THE POINT OF VIEW OF THE USER, = as > nearly anything else. Imitating that is a poor choice. To be sure, much= of > what doesn't work is due to poor implementation and "star syndrome" (I bl= ock > my Caller ID and I don't take calls without CallerId). _You_ might not, but the world is full of people who do, including some major users of call centers who should have known better. Nature abhors a vacuum. If there is nothing better, the crappy identities _will_ be used. And that's bad for SIP just like it's bad for email. >=20 > No one really trusts display name in the PSTN. Few even understand it. > Everyone who uses email knows what to expect of a display name. I'm sorry, but I beg to differ. Phishers are *right* *now* exploiting people's gullibility and lack of understanding about this area. > With session initiation on the Internet, it's not very useful to hide beh= ind > the trust of the originating carrier, because there are too many of them = and > you have no reasonable way to distinguish a trustworthy one from an > untrustworthy one. There may not even be an originating carrier. I don't understand what you mean by "too many of them". If I get a call from foo@bar.com, I'd like to have some reasonable assurance - key word being reasonable -- that I will be talking to foo@bar.com and not ferdferkle@scammer.com if I pick up the phone. >=20 > In this case, I think we trust users to be polite, and when they aren't, > you have the option of not taking their calls. =20 The world has vastly changed, and expectations of politeness are gone with the wind. Mike > es have some point in what he's saying. Usually, the number is=20 > >>displayed (the sip address in out case) unless the receiver has the=20 > >>caller in the address book. In this case the name displayed is the one=20 > >>in the local address book. But is it too late to think that way? It=20 > >>probably is since a lot of implementations out there already display=20 > >>the Display Name in the From header field, but we could recommend=20 > >>against it. > >=20 > >=20 > > I think that people are tempting the fates if they > > think that proscriptions against misuse buried in > > some arcane RFC will stop developers from putting > > juicy identity bits in front their users. Even if it's > > really, really stupid. And insecure.=20 > >=20 > > And SIP is not just about voice rendezvous. Imagine a > > proscription on an IM user agent against putting a=20 > > display name in front of their user. It's not only > > ludicrous, it would make the protocol useless. > >=20 > > Mike > >=20 > >=20 > > -----------------------------------------------------------------------= - > >=20 > > _______________________________________________ > > Sip mailing list https://www1.ietf.org/mailman/listinfo/sip > > This list is for NEW development of the core SIP Protocol > > Use sip-implementors@cs.columbia.edu for questions on current sip > > Use sipping@ietf.org for new developments on the application of sip >=20 > _______________________________________________ > Sip mailing list https://www1.ietf.org/mailman/listinfo/sip > This list is for NEW development of the core SIP Protocol > Use sip-implementors@cs.columbia.edu for questions on current sip > Use sipping@ietf.org for new developments on the application of sip --=-27tn6bcdO7dCLlA6GPWm Content-Type: application/pgp-signature; name=signature.asc Content-Description: This is a digitally signed message part -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.3 (GNU/Linux) iQCVAwUAQmVG+rMsDAj/Eq++AQLbZwP/T8wj1uBcXD/6mGkD5XtSoGTds2oj/lMH zWv3mjz8jl/zk5RBbs7wv4AY8EIesYp+0AijkCNrFN2ZrdVhO7uaXWl9J6Z/EQpo 2toCLOzPpdn1z+zhh4QBLRswKGwqbZxV1Io2BOh/iQnn/KPjLwx4VUkOa5UklCvN Was/EsQ/1PQ= =P1nu -----END PGP SIGNATURE----- --=-27tn6bcdO7dCLlA6GPWm-- --===============1373012324== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip --===============1373012324==-- From sip-bounces@ietf.org Tue Apr 19 14:28:46 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DNxSo-0004lg-0l; Tue, 19 Apr 2005 14:28:46 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DNxSm-0004lO-AE for sip@megatron.ietf.org; Tue, 19 Apr 2005 14:28:44 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA05704 for ; Tue, 19 Apr 2005 14:28:42 -0400 (EDT) From: Udit_Goyal@3com.com Received: from ahmler4.mail.eds.com ([192.85.154.77]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DNxdp-0000k9-Nb for sip@ietf.org; Tue, 19 Apr 2005 14:40:10 -0400 Received: from ahmlir4.mail.eds.com (ahmlir4-2.mail.eds.com [192.85.154.134]) by ahmler4.mail.eds.com (8.13.2/8.12.10) with ESMTP id j3JIS3RI019715; Tue, 19 Apr 2005 14:28:05 -0400 Received: from ahmlir4.mail.eds.com (localhost [127.0.0.1]) by ahmlir4.mail.eds.com (8.13.2/8.12.10) with ESMTP id j3JIRSXb005511; Tue, 19 Apr 2005 14:27:28 -0400 Received: from usut001.3com.com ([205.142.126.149]) by ahmlir4.mail.eds.com (8.13.2/8.12.10) with ESMTP id j3JIRR1V005482; Tue, 19 Apr 2005 14:27:27 -0400 In-Reply-To: To: Wayne.Davies@mmv.vic.gov.au MIME-Version: 1.0 X-Mailer: Lotus Notes Release 6.5.2 June 01, 2004 Message-ID: Date: Tue, 19 Apr 2005 14:33:17 -0400 X-MIMETrack: Serialize by Router on USUT001/US/3Com(Release 6.0.3|September 26, 2003) at 04/19/2005 11:27:28 AM, Serialize complete at 04/19/2005 11:27:28 AM X-Spam-Score: 0.3 (/) X-Scan-Signature: 515708a075ffdf0a79d1c83b601e2afd Cc: sip@ietf.org, sip-implementors@cs.columbia.edu Subject: [Sip] Re: [Sip-implementors] Busy condition X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============0735167340==" Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org This is a multipart message in MIME format. --===============0735167340== Content-Type: multipart/alternative; boundary="=_alternative 0065576185256FE8_=" This is a multipart message in MIME format. --=_alternative 0065576185256FE8_= Content-Type: text/plain; charset="US-ASCII" Hi Wayne, I agree that for Warning header field, the scope is limited because of the codes already defined in 3261 Moreover, they mainy defines the failures induced by the SDP Giving more error status information in the reason phrase is also ok but it is more like implementation dependent as per RFC 3261. It does not define any standard error phrases for this purpose. Even we cant use "Reason" header (RFC 3326) for this purpose because it defines cause to be the SIP status code so it will also not serve any purpose. What I think is providing more error warning codes for failure cases will be better as error codes are always better than reason phrases because of ease of automatic action. Cant we have something like 4xx warning codes too.. or is it like 3xx is only available for SIP. -Udit Wayne.Davies@mmv.vic.gov.au Sent by: sip-implementors-bounces@cs.columbia.edu 04/19/2005 01:43 AM To Udit Goyal/C/US/3Com@3Com cc sip-implementors-bounces@cs.columbia.edu, sip-implementors@cs.columbia.edu Subject Re: [Sip-implementors] Busy condition Udit, Both methods of communicating more detail for the error condition seem valid / ok to me. It appears the main difference in their use is that the Warning header entries are mandated in 3261 and furthered by IANA registered ones. The warning codes range for SIP is stated as being the 3xx block which are already divided up into categories, currently there seems limited scope in using this range (390 - 399 for miscellaneous). 3261 supports extending the default reason phrase for responses and gives some specific examples of this is advocated 261 gives examples of doing this for specific responses (182, 400, 480). Advocating a standard for the wording for common conditions like your examples below might be a good idea. Regards - Wayne. Udit asked: ************************************************************* Hi, I was just wondering that are there any ways to give different indications when user is not able to take the call. There are error responses like 480, 486 used to indicate the busy condition but still they are not able to indicate the exact failure status. However, there can be scenarios like: i) User rejects the call. ii) All lines are busy and user cant take the call. iii) Ringing timeout occur: No Answer and more.... I feel there are possibilities of indicating to the end user by using error response status text, "Warning" header, or "Reason" header. Please let me know which is more standard approach followed. Thanks, Udit _______________________________________________ Sip-implementors mailing list Sip-implementors@cs.columbia.edu http://lists.cs.columbia.edu/mailman/listinfo/sip-implementors ********************************************************************** Any personal or sensitive information contained in this email and attachments must be handled in accordance with the Victorian Information Privacy Act 2000, the Health Records Act 2001 or the Privacy Act 1988 (Commonwealth), as applicable. This email, including all attachments, is confidential. If you are not the intended recipient, you must not disclose, distribute, copy or use the information contained in this email or attachments. Any confidentiality or privilege is not waived or lost because this email has been sent to you in error. If you have received it in error, please let us know by reply email, delete it from your system and destroy any copies. ********************************************************************** _______________________________________________ Sip-implementors mailing list Sip-implementors@cs.columbia.edu http://lists.cs.columbia.edu/mailman/listinfo/sip-implementors --=_alternative 0065576185256FE8_= Content-Type: text/html; charset="US-ASCII"
Hi Wayne,

I agree that for Warning header field, the scope is limited because of the codes already defined in 3261
Moreover, they mainy defines the failures induced by the SDP

Giving more error status information in the reason phrase is also ok but it is more like implementation dependent as per RFC 3261.
It does not define any standard error phrases for this purpose.

Even we cant use "Reason" header (RFC 3326) for this purpose because it defines cause to be the SIP status code so it will also not serve any purpose.

What I think is providing more error warning codes for failure cases will be better as error codes are always better than reason phrases because of ease of automatic action.
Cant we have something like 4xx warning codes too.. or is it like 3xx is only available for SIP.

-Udit



Wayne.Davies@mmv.vic.gov.au
Sent by: sip-implementors-bounces@cs.columbia.edu

04/19/2005 01:43 AM

To
Udit Goyal/C/US/3Com@3Com
cc
sip-implementors-bounces@cs.columbia.edu, sip-implementors@cs.columbia.edu
Subject
Re: [Sip-implementors] Busy condition









Udit,
Both methods of communicating more detail for the error condition

seem valid / ok to me.

It appears the main difference in their use is that the Warning
header entries are mandated in 3261 and furthered by IANA registered ones.
The warning codes range for SIP is stated as being the 3xx block which are
already divided up into categories, currently there seems limited scope in
using this range (390 - 399 for miscellaneous).

3261 supports extending the default reason phrase for responses and
gives some specific examples of this is advocated 261 gives examples of
doing this for specific responses (182, 400, 480). Advocating a standard
for the wording for common conditions like your examples below might be a
good idea.

Regards - Wayne.


Udit asked:
*************************************************************
Hi,

I was just wondering that are there any ways to give different indications
when user is not able to take the call.
There are error responses like 480, 486 used to indicate the busy
condition but still they are not able to indicate the exact failure
status.
However, there can be scenarios like:
i)   User rejects the call.
ii)  All lines are busy and user cant take the call.
iii) Ringing timeout occur: No Answer and more....

I feel there are possibilities of indicating to the end user by using
error response status text, "Warning" header, or "Reason" header.
Please let me know which is more standard approach followed.

Thanks,
Udit
_______________________________________________
Sip-implementors mailing list
Sip-implementors@cs.columbia.edu
http://lists.cs.columbia.edu/mailman/listinfo/sip-implementors


**********************************************************************
Any personal or sensitive information contained in this email and
attachments must be handled in accordance with the Victorian Information
Privacy Act 2000, the Health Records Act 2001 or the Privacy Act 1988
(Commonwealth), as applicable.

This email, including all attachments, is confidential.  If you are not the
intended recipient, you must not disclose, distribute, copy or use the
information contained in this email or attachments.  Any confidentiality or
privilege is not waived or lost because this email has been sent to you in
error.  If you have received it in error, please let us know by reply
email, delete it from your system and destroy any copies.
**********************************************************************


_______________________________________________
Sip-implementors mailing list
Sip-implementors@cs.columbia.edu

http://lists.cs.columbia.edu/mailman/listinfo/sip-implementors
--=_alternative 0065576185256FE8_=-- --===============0735167340== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip --===============0735167340==-- From sip-bounces@ietf.org Tue Apr 19 14:37:53 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DNxbd-0006ne-2U; Tue, 19 Apr 2005 14:37:53 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DNxba-0006nZ-91 for sip@megatron.ietf.org; Tue, 19 Apr 2005 14:37:50 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA06557 for ; Tue, 19 Apr 2005 14:37:48 -0400 (EDT) Received: from oak.neustar.com ([209.173.53.70]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DNxme-00015D-K1 for sip@ietf.org; Tue, 19 Apr 2005 14:49:16 -0400 Received: from stntsmtp1.cis.neustar.com (smartexch.neustar.com [10.31.13.79]) by oak.neustar.com (8.12.8/8.11.0) with ESMTP id j3JIbeKD023063; Tue, 19 Apr 2005 18:37:40 GMT Received: from stntexch03.cis.neustar.com ([10.31.13.45]) by stntsmtp1.cis.neustar.com with Microsoft SMTPSVC(6.0.3790.211); Tue, 19 Apr 2005 14:37:40 -0400 X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Subject: authority for a domain (was RE: [Sip] sip-identity-05: display-name woes) Date: Tue, 19 Apr 2005 14:37:39 -0400 Message-ID: <24EAE5D4448B9D4592C6D234CBEBD59701502E40@stntexch03.cis.neustar.com> Thread-Topic: [Sip] sip-identity-05: display-name woes Thread-Index: AcVE8mlJj2MyoB9pTmuU28fPfeyt5AAFep0w From: "Peterson, Jon" To: "Michael Thomas" X-OriginalArrivalTime: 19 Apr 2005 18:37:40.0148 (UTC) FILETIME=[DDB60740:01C5450E] X-Spam-Score: 0.0 (/) X-Scan-Signature: b280b4db656c3ca28dd62e5e0b03daa8 Content-Transfer-Encoding: quoted-printable Cc: sip@ietf.org, Francois Audet , Paul Kyzivat X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org Mike, > As far as I can tell, there's an implicit assumption in > sip-identity that the way that example.com would prevent=20 > me from signing sip-identites for the whole domain is=20 > to... just not give me that cert.=20 The draft does assume that if you hold a cert for example.com (i.e., a = CA-signed cert with the subjectAltName 'example.com'), then you are the = legitimate authority for example.com. It does not assume that if you = hold the cert sip.example.com. or sip:matt@example.com, that you are the = authority for example.com. How does one get a cert for example.com? That = is matter of CA policy, to a large extent, but there is typically a = validation process. The validation process consists of the CA = determining whether or not the requestor of a certificate has authority = over that particular name in the DNS. So, "[the domain] just not giving [a random user] the cert" is not the = issue. The domain is not the CA, and it is not the domain's business to = distribute certs. The authority for the domain is eligible to receive a = cert from a CA, and a random user of that domain is not. While one could argue that CA processes for issuing certs are flawed, or = what have you, a draft about SIP identity is hardly going to rectify = that. > That's not a very=20 > good assumption as credentials can be used for a wide > variety of things, and having to run parallel namespaces > which each gate a particular authorization domain would > be a horrible management nightmare.=20 Your point that a domain uses credentials for a wide variety of things = is relevant, and it is a limitation of the sip-identity mechanism. It = is, as you say, an operational limitation. It's hard for me to see how = impactful this will ultimately be. If cisco.com, say, doesn't want some = SIP authentication service to store and use the private key associated = with its 'cisco.com' cert, then cisco.com would be forced to create a = parallel namespace, like sip.cisco.com, for its SIP users. While either or both alternatives could be awkward for particular = administrative domains, I would submit I have hard time looking at this = as a "horrible management nightmare". > Worse is that a naive > cross domain receiver has *no* way to know which of example.com's > namespaces ought to be considered valid. So it doesn't even > work in this case. Well, no, I'm not sure that is true. If cisco.com uses a cert with a = subject of 'cisco.com' in their auth service, then SIP users would have = names of the form 'sip:matt@cisco.com'. If it uses, say, sip.cisco.com = in their auth service, then SIP users would have need to have names of = the form 'sip:matt@sip.cisco.com'. So, saying that it doesn't work isn't = fair. It will be clear to a cross domain user whether or not the domain = in the From header field matches the domain the subjectAltName of the = cert. There is some treatment of name subordination issues in the -04 version = of the draft, and I am beefing up that language a bit in the -05 to make = this more clear. -05 also leaves a few doors open for future work to = improve on the name subordination story. However, I believe that the = current story is practicable, and that we can go forward with it for = this initial iteration. > NB: this is a common conflation with would-be cert users. > What you get with certs is authentication and nothing more. > Authorization is necessary to bind identity with role. That's > missing in the sip-identity draft. Yes, the cert authenticates the owner of the namespace. The act of = creating the Identity header makes an authorization assertion about the = use of the From header field in a particular message. Whatever else one = may think a cert means, it means that the holder of the cert was = verified by the CA to have authority over that domain name in the DNS. = That is the only 'role' we are concerned with here. Jon Peterson NeuStar, Inc. > Mike _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Tue Apr 19 14:51:38 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DNxow-0000mf-RL; Tue, 19 Apr 2005 14:51:38 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DNxov-0000ma-2v for sip@megatron.ietf.org; Tue, 19 Apr 2005 14:51:37 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA07643 for ; Tue, 19 Apr 2005 14:51:34 -0400 (EDT) Received: from oak.neustar.com ([209.173.53.70]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DNxzw-0001YK-U0 for sip@ietf.org; Tue, 19 Apr 2005 15:03:03 -0400 Received: from stntsmtp1.cis.neustar.com (smartexch.neustar.com [10.31.13.79]) by oak.neustar.com (8.12.8/8.11.0) with ESMTP id j3JIoFKD023796; Tue, 19 Apr 2005 18:50:15 GMT Received: from stntexch03.cis.neustar.com ([10.31.13.45]) by stntsmtp1.cis.neustar.com with Microsoft SMTPSVC(6.0.3790.211); Tue, 19 Apr 2005 14:50:15 -0400 X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Subject: RE: [Sip] sip-identity-05: display-name woes Date: Tue, 19 Apr 2005 14:50:15 -0400 Message-ID: <24EAE5D4448B9D4592C6D234CBEBD59701502E41@stntexch03.cis.neustar.com> Thread-Topic: [Sip] sip-identity-05: display-name woes Thread-Index: AcVE5H6/p3UDekzDTui1Lvn4ln4zswAI2EOQ From: "Peterson, Jon" To: "Paul Kyzivat" X-OriginalArrivalTime: 19 Apr 2005 18:50:15.0582 (UTC) FILETIME=[9FFC1BE0:01C54510] X-Spam-Score: 0.0 (/) X-Scan-Signature: cdb443e3957ca9b4c5b55e78cfcf4b26 Content-Transfer-Encoding: quoted-printable Cc: sip@ietf.org, Francois Audet X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org > Jon, >=20 > So what you are suggesting is: >=20 > - your identity draft is based on ability to determine > authenticator based on domain name in URI. It doesn't > work for phone numbers >=20 > - potentially that could be solved by having something > (e.g. enum) provide a specification for who the > authenticator should be for a particular tel: URI. > Given that, the identity draft could then provide > the authentication. You have indeed hit the nail on the head. > I think that makes a lot of sense as a potential way forward, though = it=20 > further increases the potential latency for a call. >=20 > And yes, this is just a bunch of hypotheticals. But a potentially=20 > important bunch. It may form bhe beginning of a plan for where to go.=20 > SIP is starting to get real traction in the consumer market now. This=20 > stuff seems important for continued progress. No doubt this is very significant, especially given that many SIP = services in the marketplace use telephone numbers today. > I think those hypotheticals need to include how meet perceived needs=20 > such as display of calling name. Whether it comes from the display = name=20 > or from somewhere else can remain an open question for awhile. Yes, we do need to have a story about display-names, and there is a = (weak) one in the -04 version of sip-identity, even. I am increasingly = of the opinion that we need a way to leave sip-identity-05 open about = this as a topic of future work... I guess I'll make a proposal for that. Jon Peterson NeuStar, Inc. > Paul >=20 > Peterson, Jon wrote: > > =20 > > Understand that most of what I wrote below was intended=20 > only to support=20 > > the design decision that identity for telephone numbers is=20 > out of scope=20 > > for the current sip-identity draft, and thus that TNs=20 > wouldn't serve as=20 > > a clear argument about display-names one way or another.=20 > So, this is all=20 > > just hypotheticals. > > =20 > > Currently, the ENUM database has no capability whatsoever=20 > to provide=20 > > names of end users; any such capability would need to be=20 > invented before=20 > > it could be leveraged. Presumably, if a block of phone numbers is=20 > > delegated to an organization with ENUM, it is the=20 > responsibility of that=20 > > organization to populate any and all ENUM records, including any=20 > > hypothetical records that assisted in providing names for=20 > end users.=20 > > Note that in many principalities, organizations are not=20 > allowed to "own"=20 > > telephone numbers, only carriers have that privilege. In=20 > such contexts=20 > > the idea of, say, an enterprise being responsible for this function=20 > > wouldn't make any sense. > > =20 > > Strictly following my logic below, in a case where an=20 > organization is=20 > > responsible for a block of telephone numbers in ENUM, they=20 > would be the=20 > > appropriate signatory for any and all authentication service=20 > > responsibilities when telephone numbers are used in the From header=20 > > field of SIP requests. Thus, ENUM could be used to discover the=20 > > organization responsible for the number, yes, and so to=20 > determine who is=20 > > eligible to provide an authentication service for the user=20 > in question.=20 > > While it could theoretically be used furthermore to derive the=20 > > appropriate name, if we were to invent such a mechanism,=20 > this would be a=20 > > separable capability. > > =20 > > Jon Peterson > > NeuStar, Inc. > >=20 > > -----Original Message----- > > *From:* Francois Audet [mailto:audet@nortel.com] > > *Sent:* Monday, April 18, 2005 11:56 AM > > *To:* Peterson, Jon; 'Paul Kyzivat'; 'Brian Rosen' > > *Cc:* 'sip@ietf.org' > > *Subject:* RE: [Sip] sip-identity-05: display-name woes > >=20 > > There is also the case where the ENUM database wouldn't have the > > Name of the > > end-user because a block of phone numbers are assigned to an > > organization (like > > a corporation). > >=20 > > It this case, I'm assuming that the display name would=20 > be provided > > by the organization itself, but the SIP service provider would > > assert that the organization was allowed to populate=20 > the display name. > >=20 > > Perhaps ENUM could be used to verify that, but it=20 > wouldn't be used > > to derive the name itself (just the owner). > >=20 > > Is this what you had in mind? > >=20 > > > -----Original Message----- > > > From: sip-bounces@ietf.org [mailto:sip-bounces@ietf.org] On > > > Behalf Of Peterson, Jon > > > Sent: Friday, April 08, 2005 12:54 > > > To: Paul Kyzivat; Brian Rosen > > > Cc: sip@ietf.org > > > Subject: RE: [Sip] sip-identity-05: display-name woes > > > > > > > > > > > > Some notes inline. > > > > > > Jon Peterson > > > NeuStar, Inc. > > > > > > > -----Original Message----- > > > > From: Paul Kyzivat [mailto:pkyzivat@cisco.com] > > > > Sent: Thursday, April 07, 2005 7:33 AM > > > > To: Brian Rosen > > > > Cc: Peterson, Jon; sip@ietf.org > > > > Subject: Re: [Sip] sip-identity-05: display-name woes > > > > > > > [snip] > > > > > > > > The most immediate problem I can see comes when=20 > your call lands > > on a > > > > gateway to the PSTN. At that point the identification > > > conventions of the > > > > SIP network must be interworked with those of the=20 > public telephone > > > > network. The gateway must decide whether to populate the > > > calling name > > > > and number fields on the PSTN side. If it has no > > > authentication that the > > > > information is correct, should it populate it? > > > > > > Let's be careful, though. If I'm calling from > > > sip:jon@example.com, what exactly does the gateway put in the > > > ISUP CgPN field, let alone what might it share as a textual > > > string in the GNP? That sort of SIP-ISUP mapping has bigger > > > problems than just how to deal with display-name. Clearly, if > > > the gateway is going to just make up a telephone number to > > > represent the calling party, all bets are off about how to > > > understand the GNP. > > > > > > Of course, the From header field of a SIP request might > > > contain a tel URI, or a SIP URI with a tel URI user portion. > > > But in that instance, provided it is a valid telephone > > > number, there is most likely a CNAM record associated with it > > > in the PSTN. Gateways or subsequent PSTN signaling elements > > > can always do CNAM queries to recover the associated > > > appropriate calling name to populate the GNP. But clearly > > > there's no point in even getting the CNAM if the telephone > > > number itself can just trivially be forged in SIP From header > > > fields. This gets into the whole question of why a gateway > > > would ever trust an Identity header that asserts a telephone > > > number. As sip-identity-04 suggests, that has to be a subject > > > for future work, but the only plausible lines of thought we > > > have on this today are ENUM architectures. > > > > > > By launching an ENUM query, the story might go, the gateway > > > could learn who the number owner is, and thus who should > > > provide the signature over the Identity information, and > > > conceivably the gateway could also learn info like CNAM at > > > the time. This would be tantamount to just reinventing CNAM > > > in an IP context - something that is probably inevitable if > > > telephone numbers are to be used extensively in SIP, > > > something that people are no doubt noodling in various shops > > > around the world today, and something that probably wouldn't > > > necessarily require signing the display-name in=20 > order for it to > > work. > > > > > > But until we boil that particular ocean, I feel that PSTN > > > interworking might not the best case on which to argue the > > > display-name issue one way or another. > > > > > > _______________________________________________ > > > Sip mailing list https://www1.ietf.org/mailman/listinfo/sip > > > This list is for NEW development of the core SIP Protocol > > > Use sip-implementors@cs.columbia.edu for questions on current > > > sip Use sipping@ietf.org for new developments on the > > > application of sip > > > > > > > >=20 >=20 _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Tue Apr 19 14:56:08 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DNxtI-000125-EY; Tue, 19 Apr 2005 14:56:08 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DNxtG-000120-Ot for sip@megatron.ietf.org; Tue, 19 Apr 2005 14:56:06 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA08101 for ; Tue, 19 Apr 2005 14:56:04 -0400 (EDT) Received: from oak.neustar.com ([209.173.53.70]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DNy4L-0001hc-63 for sip@ietf.org; Tue, 19 Apr 2005 15:07:33 -0400 Received: from stntsmtp1.cis.neustar.com (smartexch.neustar.com [10.31.13.79]) by oak.neustar.com (8.12.8/8.11.0) with ESMTP id j3JItkKD024075; Tue, 19 Apr 2005 18:55:46 GMT Received: from stntexch03.cis.neustar.com ([10.31.13.45]) by stntsmtp1.cis.neustar.com with Microsoft SMTPSVC(6.0.3790.211); Tue, 19 Apr 2005 14:55:46 -0400 X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Subject: RE: [Sip] RE: Question to Identity draft Date: Tue, 19 Apr 2005 14:55:46 -0400 Message-ID: <24EAE5D4448B9D4592C6D234CBEBD59701502E42@stntexch03.cis.neustar.com> Thread-Topic: [Sip] RE: Question to Identity draft Thread-Index: AcVBAPrUmuX9ZnQTRciZ4mB4U5rYeAED5e1g From: "Peterson, Jon" To: "Fries Steffen" , X-OriginalArrivalTime: 19 Apr 2005 18:55:46.0651 (UTC) FILETIME=[65513AB0:01C54511] X-Spam-Score: 0.0 (/) X-Scan-Signature: 848ed35f2a4fc0638fa89629cb640f48 Content-Transfer-Encoding: quoted-printable Cc: IETF SIP List X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org I do agree that sip-identity provides body integrity, and as such, that = it could be used to provide integrity protection for a self-signed = certificate in the body of a SIP message, and furthermore, that such a = self-signed certificate could be used in subsequently messages to = provide confidentiality services for SIP message bodies in order to = encrypt symmetric keys used for SRTP. I have reservations when we start describing the use of that self-signed = certificate to provide integrity services for subsequent requests, = thereby obviating the need to use an authentication services. I = furthermore think that sipping-certs provides a better way to discover = certificates for confidentiality than this method of tunneling = certificates in SIP requests.=20 That much said, I would not rule out tunneling self-signed certificates = in this fashion, no. Jon Peterson NeuStar, Inc. > -----Original Message----- > From: Fries Steffen [mailto:steffen.fries@siemens.com] > Sent: Thursday, April 14, 2005 7:48 AM > To: Peterson, Jon; fluffy@cisco.com > Cc: IETF SIP List > Subject: RE: [Sip] RE: Question to Identity draft >=20 >=20 > Hi Jon, >=20 > I'm still not sure what the answer to the scenarios is.=20 >=20 > Do you see the option with the identity draft to assert a FROM field = of a > SIP message and also an embedded certificate in the body and thus have = a > security context for that dialog. The security context may be used on > subsequent messages (e.g., to negotiate media encryption), which do = not need > to be sent via the authentication service? >=20 > Regards > Steffen > =20 >=20 > > -----Original Message----- > > From: sip-bounces@ietf.org [mailto:sip-bounces@ietf.org] On=20 > > Behalf Of Fries Steffen > > Sent: Thursday, April 07, 2005 4:56 PM > > To: Peterson, Jon; fluffy@cisco.com > > Cc: IETF SIP List > > Subject: [Sip] RE: Question to Identity draft > > Importance: High > >=20 > > Hi Jon, > >=20 > > > > [stf] yes, RFC3261 talks about certificate exchhange. But > > > here it is > > > > only possible to take certificates, which are (more or > > > less) bound to a person. > > > > Assume that you use certificates, which are bound to the > > > host used for > > > > phone calls. Then you would need some instance assuring,=20 > > that this=20 > > > > certificate is connected with the registration under some AOR. > > > >=20 > > > > What I had in mind is an inband certificate exchange from, > > > e.g., self > > > > signed certificates, were the authentication services basically=20 > > > > assures that the message (and thus the certificate) came > > > from a person > > > > registered under a certain AOR. > > >=20 > > > RFC3261 does in fact describe the self-signed certificate case. > > [stf] Okay, I put it in a wrong way, I meant the certificate=20 > > must follow some dedicated syntax, connected with the domain=20 > > you are registering in. > > When you have something like device certificates, which are=20 > > issued by a corporate CA on the base of machine names, these=20 > > certificates may be used in SIP scenarios. After successful=20 > > registering, the Proxy knows, that a user, who authenticated=20 > > himself using digest authentication over a TLS link that he=20 > > uses the dedicated device certificate for the duration of his=20 > > registration for security purposes. That means next time he=20 > > registers, his identity may be connected with a different=20 > > certificate, as he may use a different phone. Sure, the user=20 > > could publish the certificate to a cert server, as described=20 > > in the certs draft, but I was thinking of some kind of=20 > > "inband provisioning" for such a scenario.=20 > >=20 > > >=20 > > > > The certificate itself may then be used for end-to-end=20 > integrity=20 > > > > services. > > >=20 > > > In what respect would using this certificates for an end-to-end=20 > > > integrity service be superior to just using > > > sip-identity-04 for integrity? Note that that strength of a=20 > > > self-signed credential is necessarily equivalent to the=20 > strength of=20 > > > the security mechanism used to deliver that self-signed=20 > > credential to=20 > > > potential users. So, if > > > sip-identity-04 is used to secure the cert, it isn't=20 > clear how the=20 > > > cert provides a stronger or more attractive assurance than=20 > > > sip-identity-04 itself would provide. > > [stf]Using the certificate would require to send just one=20 > > message over the authentication service and use the supplied=20 > > certificate for the rest of the communication. > >=20 > >=20 > > > > A usage example would be the key management for SRTP using > > > MIKEY, were > > > > one option is the usage of certificates. When here a=20 > > certificate is=20 > > > > used, which is completely unknown to the receiver, then=20 > > there is no=20 > > > > real value. But when a trusted component (the > > > authentication service) > > > > assures, that a person registered with a dedicated AOR is=20 > > connected=20 > > > > with this certificate, then it gets a meaning. It would=20 > basically=20 > > > > provide the assurance, that for the time I am in the call, > > > I am using > > > > this certificate, which may be sufficient. > > >=20 > > > No question that using sip-identity-04 would guarantee the=20 > > integrity=20 > > > of the certificate contained in a SIP message body. > > > But why not have sip-identity-04 secure the SDP body=20 > containing the=20 > > > keymgmt attribute for MIKEY, rather than going through a=20 > > certificate=20 > > > exchange phase in order to subsequently use the a cert=20 > > (whose strength=20 > > > is equivalent to > > > sip-identity-04) to secure the SDP body containing the=20 > keymgmt? In=20 > > > what respect is this not a redundant step? > > [stf] as stated above, the authentication server would only=20 > > be needed for one message, to support the establishment of a=20 > > session security context. The other thing is that for the key=20 > > management for SRTP the client itself needs to include the=20 > > appropriate message body for MIKEY, as the MIKEY container is=20 > > protected. The same would be true in scenarios were S/MIME=20 > > would be required to protect sdescriptions. > >=20 > >=20 > > Regards > > Steffen > >=20 > > >=20 > > > Jon Peterson > > > NeuStar, Inc. > > >=20 > > > > Regards > > > > Steffen > > > >=20 > > > >=20 > > >=20 > >=20 > > _______________________________________________ > > Sip mailing list https://www1.ietf.org/mailman/listinfo/sip > > This list is for NEW development of the core SIP Protocol Use=20 > > sip-implementors@cs.columbia.edu for questions on current sip=20 > > Use sipping@ietf.org for new developments on the application of sip > >=20 >=20 _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Tue Apr 19 16:30:44 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DNzMq-0002jn-LW; Tue, 19 Apr 2005 16:30:44 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DNzMo-0002jF-2U for sip@megatron.ietf.org; Tue, 19 Apr 2005 16:30:42 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA24236 for ; Tue, 19 Apr 2005 16:30:39 -0400 (EDT) Received: from sj-iport-5.cisco.com ([171.68.10.87]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DNzXt-0007AY-1w for sip@ietf.org; Tue, 19 Apr 2005 16:42:09 -0400 Received: from sj-core-3.cisco.com (171.68.223.137) by sj-iport-5.cisco.com with ESMTP; 19 Apr 2005 13:30:32 -0700 Received: from vtg-um-e2k4.sj21ad.cisco.com (vtg-um-e2k4.cisco.com [171.70.93.57]) by sj-core-3.cisco.com (8.12.10/8.12.6) with ESMTP id j3JKUUb4010228; Tue, 19 Apr 2005 13:30:30 -0700 (PDT) Received: from 10.32.130.175 ([10.32.130.175]) by vtg-um-e2k4.sj21ad.cisco.com ([171.70.93.57]) with Microsoft Exchange Server HTTP-DAV ; Tue, 19 Apr 2005 20:31:24 +0000 User-Agent: Microsoft-Entourage/11.1.0.040913 Date: Tue, 19 Apr 2005 13:30:28 -0700 Subject: Re: [Sip] RE: Question to Identity draft From: Cullen Jennings To: Fries Steffen Message-ID: In-Reply-To: <24EAE5D4448B9D4592C6D234CBEBD59701502E42@stntexch03.cis.neustar.com> Mime-version: 1.0 Content-type: text/plain; charset="US-ASCII" Content-transfer-encoding: 7bit X-Spam-Score: 0.8 (/) X-Scan-Signature: 33cc095b503da4365ce57c727e553cf1 Content-Transfer-Encoding: 7bit Cc: "sip@ietf.org" , Jon Peterson X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org Agreeing with Jon here and want to point out a critical thing about the certificates. For the AOR alice@example.com, the certificate in a body would most likely be for the user alice@example.com while the certificate used for identity is for the domain example.com. You can't use a certificate for a user, like alice@example.com to assert identity using the identity draft mechanism. Cullen On 4/19/05 11:55 AM, "Peterson, Jon" wrote: > > I do agree that sip-identity provides body integrity, and as such, that it > could be used to provide integrity protection for a self-signed certificate in > the body of a SIP message, and furthermore, that such a self-signed > certificate could be used in subsequently messages to provide confidentiality > services for SIP message bodies in order to encrypt symmetric keys used for > SRTP. > > I have reservations when we start describing the use of that self-signed > certificate to provide integrity services for subsequent requests, thereby > obviating the need to use an authentication services. I furthermore think that > sipping-certs provides a better way to discover certificates for > confidentiality than this method of tunneling certificates in SIP requests. > > That much said, I would not rule out tunneling self-signed certificates in > this fashion, no. > > Jon Peterson > NeuStar, Inc. > >> -----Original Message----- >> From: Fries Steffen [mailto:steffen.fries@siemens.com] >> Sent: Thursday, April 14, 2005 7:48 AM >> To: Peterson, Jon; fluffy@cisco.com >> Cc: IETF SIP List >> Subject: RE: [Sip] RE: Question to Identity draft >> >> >> Hi Jon, >> >> I'm still not sure what the answer to the scenarios is. >> >> Do you see the option with the identity draft to assert a FROM field of a >> SIP message and also an embedded certificate in the body and thus have a >> security context for that dialog. The security context may be used on >> subsequent messages (e.g., to negotiate media encryption), which do not need >> to be sent via the authentication service? >> >> Regards >> Steffen >> >> >>> -----Original Message----- >>> From: sip-bounces@ietf.org [mailto:sip-bounces@ietf.org] On >>> Behalf Of Fries Steffen >>> Sent: Thursday, April 07, 2005 4:56 PM >>> To: Peterson, Jon; fluffy@cisco.com >>> Cc: IETF SIP List >>> Subject: [Sip] RE: Question to Identity draft >>> Importance: High >>> >>> Hi Jon, >>> >>>>> [stf] yes, RFC3261 talks about certificate exchhange. But >>>> here it is >>>>> only possible to take certificates, which are (more or >>>> less) bound to a person. >>>>> Assume that you use certificates, which are bound to the >>>> host used for >>>>> phone calls. Then you would need some instance assuring, >>> that this >>>>> certificate is connected with the registration under some AOR. >>>>> >>>>> What I had in mind is an inband certificate exchange from, >>>> e.g., self >>>>> signed certificates, were the authentication services basically >>>>> assures that the message (and thus the certificate) came >>>> from a person >>>>> registered under a certain AOR. >>>> >>>> RFC3261 does in fact describe the self-signed certificate case. >>> [stf] Okay, I put it in a wrong way, I meant the certificate >>> must follow some dedicated syntax, connected with the domain >>> you are registering in. >>> When you have something like device certificates, which are >>> issued by a corporate CA on the base of machine names, these >>> certificates may be used in SIP scenarios. After successful >>> registering, the Proxy knows, that a user, who authenticated >>> himself using digest authentication over a TLS link that he >>> uses the dedicated device certificate for the duration of his >>> registration for security purposes. That means next time he >>> registers, his identity may be connected with a different >>> certificate, as he may use a different phone. Sure, the user >>> could publish the certificate to a cert server, as described >>> in the certs draft, but I was thinking of some kind of >>> "inband provisioning" for such a scenario. >>> >>>> >>>>> The certificate itself may then be used for end-to-end >> integrity >>>>> services. >>>> >>>> In what respect would using this certificates for an end-to-end >>>> integrity service be superior to just using >>>> sip-identity-04 for integrity? Note that that strength of a >>>> self-signed credential is necessarily equivalent to the >> strength of >>>> the security mechanism used to deliver that self-signed >>> credential to >>>> potential users. So, if >>>> sip-identity-04 is used to secure the cert, it isn't >> clear how the >>>> cert provides a stronger or more attractive assurance than >>>> sip-identity-04 itself would provide. >>> [stf]Using the certificate would require to send just one >>> message over the authentication service and use the supplied >>> certificate for the rest of the communication. >>> >>> >>>>> A usage example would be the key management for SRTP using >>>> MIKEY, were >>>>> one option is the usage of certificates. When here a >>> certificate is >>>>> used, which is completely unknown to the receiver, then >>> there is no >>>>> real value. But when a trusted component (the >>>> authentication service) >>>>> assures, that a person registered with a dedicated AOR is >>> connected >>>>> with this certificate, then it gets a meaning. It would >> basically >>>>> provide the assurance, that for the time I am in the call, >>>> I am using >>>>> this certificate, which may be sufficient. >>>> >>>> No question that using sip-identity-04 would guarantee the >>> integrity >>>> of the certificate contained in a SIP message body. >>>> But why not have sip-identity-04 secure the SDP body >> containing the >>>> keymgmt attribute for MIKEY, rather than going through a >>> certificate >>>> exchange phase in order to subsequently use the a cert >>> (whose strength >>>> is equivalent to >>>> sip-identity-04) to secure the SDP body containing the >> keymgmt? In >>>> what respect is this not a redundant step? >>> [stf] as stated above, the authentication server would only >>> be needed for one message, to support the establishment of a >>> session security context. The other thing is that for the key >>> management for SRTP the client itself needs to include the >>> appropriate message body for MIKEY, as the MIKEY container is >>> protected. The same would be true in scenarios were S/MIME >>> would be required to protect sdescriptions. >>> >>> >>> Regards >>> Steffen >>> >>>> >>>> Jon Peterson >>>> NeuStar, Inc. >>>> >>>>> Regards >>>>> Steffen >>>>> >>>>> >>>> >>> >>> _______________________________________________ >>> Sip mailing list https://www1.ietf.org/mailman/listinfo/sip >>> This list is for NEW development of the core SIP Protocol Use >>> sip-implementors@cs.columbia.edu for questions on current sip >>> Use sipping@ietf.org for new developments on the application of sip >>> >> _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Tue Apr 19 16:55:57 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DNzlF-0007YY-0f; Tue, 19 Apr 2005 16:55:57 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DNzl8-0007Wd-LL for sip@megatron.ietf.org; Tue, 19 Apr 2005 16:55:53 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA26235 for ; Tue, 19 Apr 2005 16:55:47 -0400 (EDT) Received: from sj-iport-5.cisco.com ([171.68.10.87]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DNzwD-0007qg-Ub for sip@ietf.org; Tue, 19 Apr 2005 17:07:18 -0400 Received: from sj-core-5.cisco.com (171.71.177.238) by sj-iport-5.cisco.com with ESMTP; 19 Apr 2005 13:55:41 -0700 Received: from mira-sjc5-d.cisco.com (IDENT:mirapoint@mira-sjc5-d.cisco.com [171.71.163.28]) by sj-core-5.cisco.com (8.12.10/8.12.6) with ESMTP id j3JKtchu024016; Tue, 19 Apr 2005 13:55:39 -0700 (PDT) Received: from [10.32.130.193] ([10.32.130.193]) by mira-sjc5-d.cisco.com (MOS 3.4.6-GR) with ESMTP id AJL67996; Tue, 19 Apr 2005 13:55:37 -0700 (PDT) Message-ID: <42651601.4010201@cisco.com> Date: Tue, 19 Apr 2005 10:30:25 -0400 From: Jonathan Rosenberg User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7.3) Gecko/20040910 X-Accept-Language: en-us, en MIME-Version: 1.0 To: Paul Kyzivat Subject: Re: [Sip] sip-identity-05: display-name woes References: <200504071336.JAA22655@ietf.org> <3efd5821d4f6d32e012641d801877321@telio.no> <1113862167.32605.20.camel@thomasm-lnx.cisco.com> <426439CC.2000704@cisco.com> In-Reply-To: <426439CC.2000704@cisco.com> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Score: 0.6 (/) X-Scan-Signature: 287c806b254c6353fcb09ee0e53bbc5e Content-Transfer-Encoding: 7bit Cc: sip@ietf.org, Michael Thomas , "'Peterson, Jon'" X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org I agree here as well. The reason I raised this at IETF is that I think it is very likely that today and for some time to come, that user agents will use the display name in the From field to make decisions about call treatment. Automata won't use the display names, but people will. Users of the system will not understand that there is a difference between the display name and the URI as forms of identity. As for whether a service provider has a way to reliably determine a user's display name in order to assert it, well, there is strong precedent in the existing phone system that they have ways that have been found to be good enough. There are tons of public records that link people's names to various kinds of other identifiers that they can present to verify their identity. Sure, all of them can ultimately be bypassed, but I don't want to turn the perfect into the enemy of the good. In terms of what to concretely do here, I had Paul's (F) in mind: (F) If the display name is present but unauthorized, decline to sign the message. If the display-name is present and authorized, include it. I think there is no need to convey the policies of the signing domain. When I receive a message, its really simple. Whatever is there in the From field, display name or not, is what the domain is willing to vouch for, period. If the display name is absent, a recipient has no way to know whether the caller simply didnt provide one, or whether the domain policy prohibits signing of the display name. I don't think it really matters much. The entity that DOES need to know the policy is the caller. I would propose that the spec require that there is a means for configuring the caller's UA with an indicator of whether the display name can be signed or not, and if so, what the display name for that user is that the domain is willing to sign. This can then be included verbatim by the calling UA in its INVITE. This avoids the case where the domain won't sign display names at all, but the calling UA doesnt know it, and so inserts one only to have its message completely unsigned, both display name and URI. Thanks, Jonathan R. Paul Kyzivat wrote: > I agree. > > One way or another I think we need to have an approach caller id and > calling name that works at least as well and reliably as it does in the > PSTN, and that does so whether going between two sip endpoints in > different domains, or between a sip endpoint and a PSTN gateway. And it > needs to do this whether you are using sip native URIs or telephone > numbers. For telephone numbers there probably must be consistency with > what happens for PSTN-PSTN calls. For sip native addresses there may be > some wiggle room about how it should work, but I think people will want > the same level of trust with either kind of address. > > Paul > > Michael Thomas wrote: > >> On Mon, 2005-04-18 at 08:17, Hisham Khartabil wrote: >> >>> Brian does have some point in what he's saying. Usually, the number >>> is displayed (the sip address in out case) unless the receiver has >>> the caller in the address book. In this case the name displayed is >>> the one in the local address book. But is it too late to think that >>> way? It probably is since a lot of implementations out there already >>> display the Display Name in the From header field, but we could >>> recommend against it. >> >> >> >> I think that people are tempting the fates if they >> think that proscriptions against misuse buried in >> some arcane RFC will stop developers from putting >> juicy identity bits in front their users. Even if it's >> really, really stupid. And insecure. >> And SIP is not just about voice rendezvous. Imagine a >> proscription on an IM user agent against putting a display name in >> front of their user. It's not only >> ludicrous, it would make the protocol useless. >> >> Mike >> >> >> ------------------------------------------------------------------------ >> >> _______________________________________________ >> Sip mailing list https://www1.ietf.org/mailman/listinfo/sip >> This list is for NEW development of the core SIP Protocol >> Use sip-implementors@cs.columbia.edu for questions on current sip >> Use sipping@ietf.org for new developments on the application of sip > > > _______________________________________________ > Sip mailing list https://www1.ietf.org/mailman/listinfo/sip > This list is for NEW development of the core SIP Protocol > Use sip-implementors@cs.columbia.edu for questions on current sip > Use sipping@ietf.org for new developments on the application of sip > -- Jonathan D. Rosenberg, Ph.D. 600 Lanidex Plaza Director, Service Provider VoIP Architecture Parsippany, NJ 07054-2711 Cisco Systems jdrosen@cisco.com FAX: (973) 952-5050 http://www.jdrosen.net PHONE: (973) 952-5000 http://www.cisco.com _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Tue Apr 19 16:55:58 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DNzlG-0007ZL-4f; Tue, 19 Apr 2005 16:55:58 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DNzlC-0007Wi-Hd for sip@megatron.ietf.org; Tue, 19 Apr 2005 16:55:54 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA26250 for ; Tue, 19 Apr 2005 16:55:51 -0400 (EDT) Received: from sj-iport-5.cisco.com ([171.68.10.87]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DNzwG-0007qg-NU for sip@ietf.org; Tue, 19 Apr 2005 17:07:22 -0400 Received: from sj-core-5.cisco.com (171.71.177.238) by sj-iport-5.cisco.com with ESMTP; 19 Apr 2005 13:55:52 -0700 Received: from mira-sjc5-d.cisco.com (IDENT:mirapoint@mira-sjc5-d.cisco.com [171.71.163.28]) by sj-core-5.cisco.com (8.12.10/8.12.6) with ESMTP id j3JKtnhu024271; Tue, 19 Apr 2005 13:55:50 -0700 (PDT) Received: from [10.32.130.193] ([10.32.130.193]) by mira-sjc5-d.cisco.com (MOS 3.4.6-GR) with ESMTP id AJL68001; Tue, 19 Apr 2005 13:55:48 -0700 (PDT) Message-ID: <426517B2.60300@cisco.com> Date: Tue, 19 Apr 2005 10:37:38 -0400 From: Jonathan Rosenberg User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7.3) Gecko/20040910 X-Accept-Language: en-us, en MIME-Version: 1.0 To: Paul Kyzivat Subject: Re: [Sip] sip-identity-05: display-name woes References: <24EAE5D4448B9D4592C6D234CBEBD59701502E19@stntexch03.cis.neustar.com> <4256ECCB.7020609@cisco.com> In-Reply-To: <4256ECCB.7020609@cisco.com> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Score: 0.6 (/) X-Scan-Signature: 02ec665d00de228c50c93ed6b5e4fc1a Content-Transfer-Encoding: 7bit Cc: sip@ietf.org, "Peterson, Jon" X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org inline. Paul Kyzivat wrote: > OK. I forgot that phone numbers were out of scope for this discussion. Yes and no. Identifiers that lack a domain structure are out of scope. That means tel URI won't work. But, a SIP URL with the user part as a phone number seems perfectly fine to me. There is the authorization issue, of whether you choose to trust that the domain asserting ownership of a phone number really does in fact own it. Thats hard, and not really clear to me that it needs to be solved for sip identity to be useful with phone numbers. The domain signature prevents the impersonation attacks we are primarliy concerned about. Jon wrote: >>> The most immediate problem I can see comes when your call lands on a >>> gateway to the PSTN. At that point the identification conventions of >>> the SIP network must be interworked with those of the public >>> telephone network. The gateway must decide whether to populate the >>> calling name and number fields on the PSTN side. If it has no >>> authentication that the information is correct, should it populate it? >> >> >> >> Let's be careful, though. If I'm calling from sip:jon@example.com, >> what exactly does the gateway put in the ISUP CgPN field, let alone >> what might it share as a textual string in the GNP? That sort of >> SIP-ISUP mapping has bigger problems than just how to deal with >> display-name. Clearly, if the gateway is going to just make up a >> telephone number to represent the calling party, all bets are off >> about how to understand the GNP. Ahh. This is a good point. Clearly, it makes little sense at a gateway if the From field is sip:jon@example.com. It is for this reason I believe that P-Asserted-ID allowed for multiple values, one SIP and one tel. More abstractly, the problem is that I may in fact have MANY identities, each within different namespaces. Which one of those identities are meaningful to the recipient depends on who the recipient is. Its nearly impossible for me to know ahead of time what is meaningful to them, so P-A-ID allows me to include multiples. A similar problem arises in enterprise systems, whereby there is an internal numbering plan which is effectively a different namespace from e.164. One would ideally like to supply a caller ID in both namespaces, so that internal phones can use the one from the private numbering plan, and phones outside the enterprise can use the public one. Unfortunately, RFC 3261 allows only a single value for the From header field, and so this capability in P-A-ID cannot be readily extended to sip-identity. That is the real problem, I think. -Jonathan R. -- Jonathan D. Rosenberg, Ph.D. 600 Lanidex Plaza Director, Service Provider VoIP Architecture Parsippany, NJ 07054-2711 Cisco Systems jdrosen@cisco.com FAX: (973) 952-5050 http://www.jdrosen.net PHONE: (973) 952-5000 http://www.cisco.com _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Tue Apr 19 16:56:05 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DNzlN-0007a2-Su; Tue, 19 Apr 2005 16:56:05 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DNzlH-0007Zt-NM for sip@megatron.ietf.org; Tue, 19 Apr 2005 16:56:03 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA26262 for ; Tue, 19 Apr 2005 16:55:56 -0400 (EDT) Received: from sj-iport-5.cisco.com ([171.68.10.87]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DNzwN-0007qg-88 for sip@ietf.org; Tue, 19 Apr 2005 17:07:27 -0400 Received: from sj-core-3.cisco.com (171.68.223.137) by sj-iport-5.cisco.com with ESMTP; 19 Apr 2005 13:55:59 -0700 Received: from mira-sjc5-d.cisco.com (IDENT:mirapoint@mira-sjc5-d.cisco.com [171.71.163.28]) by sj-core-3.cisco.com (8.12.10/8.12.6) with ESMTP id j3JKttb4017246; Tue, 19 Apr 2005 13:55:56 -0700 (PDT) Received: from [10.32.130.193] ([10.32.130.193]) by mira-sjc5-d.cisco.com (MOS 3.4.6-GR) with ESMTP id AJL68002; Tue, 19 Apr 2005 13:55:54 -0700 (PDT) Message-ID: <4265202D.8080906@cisco.com> Date: Tue, 19 Apr 2005 11:13:49 -0400 From: Jonathan Rosenberg User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7.3) Gecko/20040910 X-Accept-Language: en-us, en MIME-Version: 1.0 To: Hisham Khartabil Subject: Re: [Sip] Session Timer: UAC populating the refresher parameter References: In-Reply-To: Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Score: 0.7 (/) X-Scan-Signature: 52f7a77164458f8c7b36b66787c853da Content-Transfer-Encoding: 7bit Cc: IETF SIP List , "Sip-implementors@cs.columbia.edu" X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org inline. Hisham Khartabil wrote: > This came up at sipit 16. > > draft-ietf-sip-session-timer-15.txt says in section 7.1: > > "The UAC MAY include the refresher parameter with value 'uac' if it > wishes to perform the refreshes. However, it is RECOMMENDED that the > parameter be omitted, so that it can be selected by the negotiation > mechanisms described below." > > I came across an implantation that sets the refresher parameter to 'uas' > when initiating the INVITE. The claim was that the draft does not > explicitly forbid that. It doesnt forbid lots of things. However, it is not supposed to do that, and this is not a good idea. > > The problem with that is: what if the UAS does not support session > timer. The spec says in section 8.2 (proxy processing responses) > > "If, however, the proxy remembers that the UAC did > support session timer, additional processing is needed. > > Because there is no Session-Expires or Require header field in the > response, the proxy knows it is the first session-timer-aware proxy > to receive the response. This proxy MUST insert a Session-Expires > header field into the response with the value it remembered from the > forwarded request." > > Some proxies may interpret that to mean the whole value, including the > refresher parameter that contained 'uas' which will cause all sorts of > funny things to happen. Right. It would have been OK to insert the whole thing had the UAC not done the wrong thing. > > Now, the draft does go on to say > > " It (the proxy) MUST set the value of the 'refresher' > parameter to 'uac'." > > so the problem my fix itself, but i think we need to clarify this: > either say that the UAC MUST NOT set the refresh parameter to 'uas' > (which is what I prefer) or add some text clarifying the scenario and > behaviour for proxies. Its too late to clarify this, unfortunately, since the spec is about to issue as an RFC. However, Please tell those folks that this is not a correct implementation. -Jonathan R. -- Jonathan D. Rosenberg, Ph.D. 600 Lanidex Plaza Director, Service Provider VoIP Architecture Parsippany, NJ 07054-2711 Cisco Systems jdrosen@cisco.com FAX: (973) 952-5050 http://www.jdrosen.net PHONE: (973) 952-5000 http://www.cisco.com _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Tue Apr 19 18:22:49 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DO17J-0006db-JU; Tue, 19 Apr 2005 18:22:49 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DO17H-0006dW-7W for sip@megatron.ietf.org; Tue, 19 Apr 2005 18:22:47 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA02888 for ; Tue, 19 Apr 2005 18:22:43 -0400 (EDT) Received: from rtp-iport-2.cisco.com ([64.102.122.149]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DO1IN-00022Z-Ag for sip@ietf.org; Tue, 19 Apr 2005 18:34:15 -0400 Received: from rtp-core-2.cisco.com (64.102.124.13) by rtp-iport-2.cisco.com with ESMTP; 19 Apr 2005 18:22:37 -0400 Received: from flask.cisco.com (IDENT:mirapoint@flask.cisco.com [161.44.122.62]) by rtp-core-2.cisco.com (8.12.10/8.12.6) with ESMTP id j3JMMYdr029892; Tue, 19 Apr 2005 18:22:35 -0400 (EDT) Received: from cisco.com ([161.44.79.173]) by flask.cisco.com (MOS 3.4.6-GR) with ESMTP id AQS96199; Tue, 19 Apr 2005 18:22:33 -0400 (EDT) Message-ID: <426584A9.5040101@cisco.com> Date: Tue, 19 Apr 2005 18:22:33 -0400 From: Paul Kyzivat User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.1) Gecko/20020826 X-Accept-Language: en-us, en MIME-Version: 1.0 To: Jonathan Rosenberg Subject: Re: [Sip] sip-identity-05: display-name woes References: <24EAE5D4448B9D4592C6D234CBEBD59701502E19@stntexch03.cis.neustar.com> <4256ECCB.7020609@cisco.com> <426517B2.60300@cisco.com> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Score: 0.0 (/) X-Scan-Signature: a7d6aff76b15f3f56fcb94490e1052e4 Content-Transfer-Encoding: 7bit Cc: sip@ietf.org, "Peterson, Jon" X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org Jonathan Rosenberg wrote: > inline. > > Paul Kyzivat wrote: > >> OK. I forgot that phone numbers were out of scope for this discussion. > > > Yes and no. Identifiers that lack a domain structure are out of scope. > That means tel URI won't work. But, a SIP URL with the user part as a > phone number seems perfectly fine to me. There is the authorization > issue, of whether you choose to trust that the domain asserting > ownership of a phone number really does in fact own it. Thats hard, and > not really clear to me that it needs to be solved for sip identity to be > useful with phone numbers. The domain signature prevents the > impersonation attacks we are primarliy concerned about. Well, that is a partial solution, which is better than none. But it presents the caller with a dilemma: - using the sip form in From allows identity to work. But using the sip form also has the implied semantic that the caller can only be called using SIP. - using the tel form in From has no implied semantic about how the caller may be called. Could be via SIP, but could be via PSTN, H.323, whatever. But this form won't work with identity. For instance, I can imagine a dual mode phone - SIP over WiFi plus conventional cellular. I receive a call using SIP, and the phone captures the from address URI in a directory. Later, when I only have cellular coverage, I try to make a call using that directory entry. If it is a SIP URI it works. If it is a TEL URI it doesn't. Of course the phone could go ahead and parse the sip uri for a phone number and make a pstn call with it. But it isn't *supposed* to parse the user part. If we want devices doing that, we should change the rule about interpretting the user part in the case when user=phone. Paul _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Tue Apr 19 18:40:56 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DO1Oq-0001Ng-Kr; Tue, 19 Apr 2005 18:40:56 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DO1Op-0001Na-72 for sip@megatron.ietf.org; Tue, 19 Apr 2005 18:40:55 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA04189 for ; Tue, 19 Apr 2005 18:40:51 -0400 (EDT) Received: from zcars04e.nortelnetworks.com ([47.129.242.56] helo=zcars04e.ca.nortel.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DO1Zv-0002eZ-1u for sip@ietf.org; Tue, 19 Apr 2005 18:52:23 -0400 Received: from zrtpd0jn.us.nortel.com (zrtpd0jn.us.nortel.com [47.140.202.35]) by zcars04e.ca.nortel.com (Switch-2.2.0/Switch-2.2.0) with ESMTP id j3JMeVS01648; Tue, 19 Apr 2005 18:40:31 -0400 (EDT) Received: by zrtpd0jn.us.nortel.com with Internet Mail Service (5.5.2653.19) id <2KLFCTQ3>; Tue, 19 Apr 2005 18:40:42 -0400 Message-ID: <1ECE0EB50388174790F9694F77522CCF01F9784D@zrc2hxm0.corp.nortel.com> From: "Francois Audet" To: "'Cullen Jennings'" , "'Jon Peterson'" Date: Tue, 19 Apr 2005 18:40:35 -0400 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2653.19) X-Spam-Score: 0.5 (/) X-Scan-Signature: 6cca30437e2d04f45110f2ff8dc1b1d5 Cc: "'sip@ietf.org'" Subject: [Sip] Question to Identity draft & cert draft X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============1336030022==" Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. --===============1336030022== Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C54530.CE041F1D" This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. ------_=_NextPart_001_01C54530.CE041F1D Content-Type: text/plain Cullen/Jon, I'm a little confused by the following paragraph in draft-ietf-sip-identity-04 in section 10: The Identity-Info header MUST contain either an HTTPS URI or a SIPS URI. If it contains an HTTPS URI, the URI must dereference to a resource that contains a single MIME body containing the certificate of the authentication service. If it is a SIPS URI, then the authentication service intends for a user agent that wishes to fetch the certificate to form a TLS connection to that URI, acquire the certificate during normal TLS negotiation, and close the connection. I understand the HTTPS URI case (which is used in the example in draft-ietf-sip-identity-04), but I'm not sure I understand the SIPS URI which is used in draft-ietf-sipping-certs-01. What do you mean by fetching the certificate through a TLS connection? Why would sips mean TLS? Do you mean fetch it using a SIP request over TLS? I don't understand how it works (and why HTTPS is not sufficient). Can you elaborate? I'm keeping this in SIP instead of SIPPING since one draft is SIP the other is SIPPING. ------_=_NextPart_001_01C54530.CE041F1D Content-Type: text/html Question to Identity draft & cert draft

Cullen/Jon,

I'm a little confused by the following paragraph in draft-ietf-sip-identity-04
in section 10:

   The Identity-Info header MUST contain either an HTTPS URI or a SIPS
   URI.  If it contains an HTTPS URI, the URI must dereference to a
   resource that contains a single MIME body containing the certificate
   of the authentication service.  If it is a SIPS URI, then the
   authentication service intends for a user agent that wishes to fetch
   the certificate to form a TLS connection to that URI, acquire the
   certificate during normal TLS negotiation, and close the connection.

I understand the HTTPS URI case (which is used in the example in
draft-ietf-sip-identity-04), but I'm not sure I understand the
SIPS URI which is used in draft-ietf-sipping-certs-01. What do you
mean by fetching the certificate through a TLS connection? Why would
sips mean TLS? Do you mean fetch it using a SIP request over TLS?
I don't understand how it works (and why HTTPS is not sufficient).

Can you elaborate?

I'm keeping this in SIP instead of SIPPING since one draft is SIP the other
is SIPPING.

------_=_NextPart_001_01C54530.CE041F1D-- --===============1336030022== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip --===============1336030022==-- From sip-bounces@ietf.org Tue Apr 19 19:31:23 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DO2Bf-0000NE-0b; Tue, 19 Apr 2005 19:31:23 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DO2Bc-0000N6-RK for sip@megatron.ietf.org; Tue, 19 Apr 2005 19:31:20 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA06980 for ; Tue, 19 Apr 2005 19:31:13 -0400 (EDT) Received: from oak.neustar.com ([209.173.53.70]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DO2Md-000435-K6 for sip@ietf.org; Tue, 19 Apr 2005 19:42:45 -0400 Received: from stntsmtp1.cis.neustar.com (smartexch.neustar.com [10.31.13.79]) by oak.neustar.com (8.12.8/8.11.0) with ESMTP id j3JNUvKD003469; Tue, 19 Apr 2005 23:30:57 GMT Received: from stntexch03.cis.neustar.com ([10.31.13.45]) by stntsmtp1.cis.neustar.com with Microsoft SMTPSVC(6.0.3790.211); Tue, 19 Apr 2005 19:30:57 -0400 X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Subject: RE: [Sip] sip-identity-05: display-name woes Date: Tue, 19 Apr 2005 19:30:57 -0400 Message-ID: <24EAE5D4448B9D4592C6D234CBEBD59701502E48@stntexch03.cis.neustar.com> Thread-Topic: [Sip] sip-identity-05: display-name woes Thread-Index: AcVFIiY0w6IWT5RMSNKofMQSvhX3kQAEr30w From: "Peterson, Jon" To: "Jonathan Rosenberg" , "Paul Kyzivat" X-OriginalArrivalTime: 19 Apr 2005 23:30:57.0694 (UTC) FILETIME=[D6AA73E0:01C54537] X-Spam-Score: 0.0 (/) X-Scan-Signature: a2c12dacc0736f14d6b540e805505a86 Content-Transfer-Encoding: quoted-printable Cc: sip@ietf.org, Michael Thomas X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org Jonathan, > In terms of what to concretely do here, I had Paul's (F) in mind: >=20 > (F) If the display name is present but unauthorized, decline to sign = the=20 > message. If the display-name is present and authorized, include it.=20 Regardless of whether or not the display-name is validated by the = authentication service, I don't think that including the display-name in = the signature actually has any perceptible effect on the security of the = mechanism. What threat does this protect against? Let's assume for the = sake of argument that an authentication service can and does validate = the display-name, and produces the Identity header per the current = guidelines of sip-identity-04 (thus not including the display-name). = What can an impersonator then do? There's no question that a = man-in-the-middle might change the display-name after a message is = signed by the auth service, but that isn't an impersonator, that's a = man-in-the-middle; said man-in-the-middle could also change, say, the = Organization, User Agent, Subject, and so on of the request, since none = of those are included in the Identity header. An impersonator could of = course capture the signaling and try to replay it with a changed = display-name; however, there are other mechanisms provided in = sip-identity-04 mechanism that would detect this replay - it wouldn't = work. As such, I don't think including it in the signed hash actually = has any practical effect. If you agree that the "include it" part is actually inert from a = security perspective, then I might propose as a refinement: (F') If the display name is present but unauthorized, decline to sign = the message. If the display-name is present and authorized, sign the = message normally (without display-name). The difference between this and the mechanism in sip-identity-04 is that = sip-identity-04 says "reject the message" instead of "decline to sign = it". Ultimately, if a user agent provides a bogus addr-spec, I would = expect the auth service to reject the message, not forward it along. I = can't see why this should be any different for the display-name, if the = domain has a policy about it. > I think there is no need to convey the policies of the signing domain. = > When I receive a message, its really simple. Whatever is there in the=20 > From field, display name or not, is what the domain is willing to = vouch=20 > for, period. If the display name is absent, a recipient has no way to=20 > know whether the caller simply didnt provide one, or whether the = domain=20 > policy prohibits signing of the display name. I don't think it really=20 > matters much.=20 I agree with you, but I thought this is where we previously disagreed, = so I am a bit surprised. A domain's policy could be that any user can = register under any AoR without providing credentials and furthermore = claim any From header field value for outbound requests. If that is = their policy, I think it is reasonable for a domain to generate an = Identity header for any request claiming any AoR in the From header = field, since the request meets the domain's policy. I look at the = absence of a display-name policy as being roughly the same - treat the = absence of policy as if the request meets policy. I had thought the issue was that you wanted the verifier to use the = presence of the display-name in the signature as a hint that the domain = actually has a policy. That's what I found problematic. > The entity that DOES need to know the policy is the caller. I would=20 > propose that the spec require that there is a means for configuring = the=20 > caller's UA with an indicator of whether the display name can be = signed=20 > or not, and if so, what the display name for that user is that the=20 > domain is willing to sign.=20 I think that in order for sip-identity-05 to make this REQUIRED, we = would need to have some specification of what that "indicator" of the = appropriate display-name would be which we could normatively reference. = In the absence of that... I suppose this seems to me like a matter for = future work. Jon Peterson NeuStar, Inc. > This can then be included verbatim by the=20 > calling UA in its INVITE. This avoids the case where the domain won't=20 > sign display names at all, but the calling UA doesnt know it, and so=20 > inserts one only to have its message completely unsigned, both display = > name and URI. >=20 > Thanks, > Jonathan R. > _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Tue Apr 19 20:43:46 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DO3Ji-0001yA-Nk; Tue, 19 Apr 2005 20:43:46 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DO3Jf-0001y0-RB for sip@megatron.ietf.org; Tue, 19 Apr 2005 20:43:44 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA11593 for ; Tue, 19 Apr 2005 20:43:41 -0400 (EDT) Received: from zrtps0kn.nortelnetworks.com ([47.140.192.55]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DO3Um-0006BW-Sv for sip@ietf.org; Tue, 19 Apr 2005 20:55:13 -0400 Received: from zrtpd0jn.us.nortel.com (zrtpd0jn.us.nortel.com [47.140.202.35]) by zrtps0kn.nortelnetworks.com (Switch-2.2.6/Switch-2.2.0) with ESMTP id j3K0hP826011; Tue, 19 Apr 2005 20:43:25 -0400 (EDT) Received: by zrtpd0jn.us.nortel.com with Internet Mail Service (5.5.2653.19) id <2KLFCVXX>; Tue, 19 Apr 2005 20:43:25 -0400 Message-ID: <1ECE0EB50388174790F9694F77522CCF01F978D6@zrc2hxm0.corp.nortel.com> From: "Francois Audet" To: "'Peterson, Jon'" , "'Fries Steffen'" , "'fluffy@cisco.com'" Subject: RE: sipping-retarget (was RE: [Sip] RE: Question to Identity draf t) Date: Tue, 19 Apr 2005 20:43:18 -0400 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2653.19) X-Spam-Score: 1.8 (+) X-Scan-Signature: c119f9923e40f08a1d7f390ce651ea92 Cc: 'IETF SIP List' X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============0303620173==" Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. --===============0303620173== Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C54541.F244C88C" This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. ------_=_NextPart_001_01C54541.F244C88C Content-Type: text/plain OK, forget about the idea I was proposing, and instead let's try to achieve it using the something along the lines of the identity draft. What about the connected number information being essentially the same mechanism as what you have for the Calling identity, but provided in the response? Something like a new "Connected header" (or perhaps Contact would be sufficient, I'm not sure), followed by the Identity and Identity-Info? The Identity-Info header could have something like https://biloxy.example.com. The unanticipated respondent problem would be easier to deal with because: - In a lot of case, Bob and Carol (the retargetter and retargettee) could have the same certification authority, so Alice's decision to proceed or not with the call may not require going fetching the yet another certificate. - Maybe we have "Require: connected-identity" header if we need the identity. - Yes, if the SDP was encrypted (because of sRTP or whatever), it would cause another session to be re-established because of the 493 (or other appropriate rejection code). Would that be a good way to solve the Connected number problem? Now, moving to the next problem, the encrypted SDP. Alice wants to call Bob and have secure media (because she is afraid of hackers tapping in). In fact, she essentially wants all her media encrypted, regardless of who she talks too, even strangers. She does not have Bob in her contact list, as she is calling him for the first time. She also doesn't know Carol, his assistant to whom the call will be retargetted. In the example above, the sequence would be this: 1 - Alice sends SUBSCRIBE to Bob to fetch his certificate because she doesn't have it. 2 - Bob sends NOTIFY to Alice with his certificate. 3 - Alice sends INVITE to Bob, with SDP encrypted using Bob's key, along with her Identity 4 - Bob doesnt' have Alice's certificate, so he sends SUBSCRIBE to Alice to fetch her cert. 5 - Alice sends NOTIFY to Bob with her certificate. 6 - Bob retargets to Carol (forwards the INVITE to Carol). 7 - Carol responds with 493, since she can't decode the SDP, and includes her Contact and her Identity. 8 - Alice sends SUBSCRIBE to Carol to get her cert. 9 - Carol sends NOTIFY to Alice with her cert. 10 - Alice sends INVITE to Alice with her Identity, encrypted with Carol's key. 11 - Carol sends Alice a SUBSCRIBE to get her certificate. 12 - Alice sends NOTIFY to Carol with her certificate. 13 - Carol sends 200 OK to Alice, with SDP encrypted using Alice's key. This is way too complicated and will take forever to complete a call. And in my mind, lots (if not the majority) of calls would look like this in environments where unanticipated respondents are typical (which is the case for a lot of businesses). Couldn't this be avoided if not only was Identity used in both directions (solving the unanticipated respondent problem), and if Alice and Carol also included their user certificate (for the purposed of sRTP) in the INVITE and 493? Instead of a 10 roundtrip session setup, it would be a 2 roundtrip session setup. Of course, in the case of people who know each other, Alice would have subscribed to Bob and Carol's certificate, so none of this would happen: it would be a 1 round-trip session setup. In other words, I DO like the Certs draft, and it should be used whenever possible. > -----Original Message----- > From: Peterson, Jon [mailto:jon.peterson@neustar.biz] > Sent: Monday, April 11, 2005 16:09 > To: Audet, Francois [SC100:9T51:EXCH]; Fries Steffen; fluffy@cisco.com > Cc: IETF SIP List > Subject: sipping-retarget (was RE: [Sip] RE: Question to > Identity draft) > > > > (maybe this should move to SIPPING, as this is properly about > sipping-retarget, but I'll leave it here for now) > > Francois, > > sipping-retarget-00 is not intended to provide a solution > space, if any, for retargeting problems; that is why it may > seem to lack anything by way of a conclusion or concrete > proposal. When the draft gets revised, I may try to insert > some more speculation about the plausible parameters for some > limited-scope fixes, but as it stands, the draft really just > shows why a lot of things won't work. > > I guess I am not convinced that the rough proposal you > outline below really escapes the problems detailed in 2.2.1 > and 2.3 of sipping-retarget. The whole issue of using a > certificate to provide connected-party is problematic > because, in order for someone to rely on a cert to identify > the connected-party, it cannot be a self-signed cert. Issuing > publicly-verifiable certs to end users (with subjects of form > sip:jon@example.com or what have you) is known to be > extremely difficult from an operational perspective. Indeed, > if it were plausible to enroll end-users in PKIs, much of the > security work in email, SIP and most other Internet > applications would be taking a radically different form. The > current level of S/MIME support in SIP deployments is a good > indication of how well the implementation community is likely > to react to this appraoch. While the problems in 2.3 are > specific to S/MIME implementations, and thus could > conceivably be addressed with a solution that is predicated > on S/MIME, the problems in 2.2 and 2.2.1 are really generic > ones that need to be addressed for clients that don't support > S/MIME (since S/MIME is, as we all know, only a MAY in RFC3261). > > Even if there were a CA-signed certificate passed in the > backwards direction which could tell a UAC whom is responding > to their request, that doesn't make the remote side any less > unanticipated, nor tell the UAC whether or not it should > encrypt future calls to the original Request-URI with this > certificate, nor tell the UAC how to deal with multiple > responses that contain different certificates, and so on. > > Regarding your suggestion to encrypt or withhold SDP, how > would you ever decide it is safe to provide SDP in an INVITE, > if essentially it is possible for any INVITE to be > retargeted? That is tantamount to always requiring a > two-phase INVITE. When you encrypt the SDP body initially, at > least that only results in a two-phase handshake for SIP when > retargeting has occurred, but in either case this is a > definite liability. Whenever there is a possibility of a > two-phase handshake, there is a possibility that the > certificate you acquire in the first phase will not work for > the second phase, unless you change the target URI for the > request (like you suggest below, using a GRUU or something). > However, changing the target URI for the request may be > self-defeating. If I am trying to call you, and I get > retargeted to Steffen, and Steffen provides me his > certificate... and then you become available before I send > the second phase INVITE... what is the desired effect? Am I > actually trying to contact you or Steffen? If I'm trying to > talk to you, why am I encrypting my message with Steffen's > certificate? But of course I may not even know the > difference, if any, between "you" and the URI to which I have > been retargeted. If I'm trying to send an INVITE to you, and > I get back a 493 with a certificate for something really > opaque, like 'sip:user51@example.com', how am I supposed to > understand that? Is that URI a pseudonym for you, or does it > represent someone else? Do I want to encrypt my message with > that certificate or not? Do I want to use that certificate in > the future when I try to contact you? ------_=_NextPart_001_01C54541.F244C88C Content-Type: text/html RE: sipping-retarget (was RE: [Sip] RE: Question to Identity draft)

OK, forget about the idea I was proposing, and instead let's
try to achieve it using the something along the lines of the
identity draft.

What about the connected number information being essentially
the same mechanism as what you have for the Calling identity,
but provided in the response?

Something like a new "Connected header" (or perhaps Contact
would be sufficient, I'm not sure), followed by the
Identity and Identity-Info? The Identity-Info header could
have something like https://biloxy.example.com.

The unanticipated respondent problem would be easier to deal
with because:
- In a lot of case, Bob and Carol (the retargetter and retargettee)
  could have the same certification authority, so Alice's decision to
  proceed or not with the call may not require going fetching the
  yet another certificate.
- Maybe we have "Require: connected-identity" header if we need the
  identity.
- Yes, if the SDP was encrypted (because of sRTP or whatever), it would
  cause another session to be re-established because of the 493 (or
  other appropriate rejection code).

Would that be a good way to solve the Connected number problem?

Now, moving to the next problem, the encrypted SDP.

Alice wants to call Bob and have secure media (because she is afraid of hackers
tapping in).  In fact, she essentially wants all her media encrypted, regardless of
who she talks too, even strangers. She does not have Bob in her contact list, as she
is calling him for the first time. She also doesn't know Carol, his assistant to whom the
call will be retargetted.

In the example above, the sequence would be this:

1 - Alice sends SUBSCRIBE to Bob to fetch his certificate because she doesn't have it.
2 - Bob sends NOTIFY to Alice with his certificate.
3 - Alice sends INVITE to Bob, with SDP encrypted using Bob's key, along with her Identity
4 - Bob doesnt' have Alice's certificate, so he sends SUBSCRIBE to Alice to fetch her cert.
5 - Alice sends NOTIFY to Bob with her certificate.
6 - Bob retargets to Carol (forwards the INVITE to Carol).
7 - Carol responds with 493, since she can't decode the SDP, and includes her Contact
    and her Identity.
8 - Alice sends SUBSCRIBE to Carol to get her cert.
9 - Carol sends NOTIFY to Alice with her cert.
10 - Alice sends INVITE to Alice with her Identity, encrypted with Carol's key.
11 - Carol sends Alice a SUBSCRIBE to get her certificate.
12 - Alice sends NOTIFY to Carol with her certificate.
13 - Carol sends 200 OK to Alice, with SDP encrypted using Alice's key.

This is way too complicated and will take forever to complete a call. And in my mind,
lots (if not the majority) of calls would look like this in environments where
unanticipated respondents are typical (which is the case for a lot of
businesses).

Couldn't this be avoided if not only was Identity used in both directions
(solving the unanticipated respondent problem), and if Alice and Carol also
included their user certificate (for the purposed of sRTP) in the INVITE and
493? Instead of a 10 roundtrip session setup, it would be a 2 roundtrip
session setup.

Of course, in the case of people who know each other, Alice would have subscribed to
Bob and Carol's certificate, so none of this would happen: it would be a 1 round-trip
session setup. In other words, I DO like the Certs draft, and it should be used
whenever possible.


> -----Original Message-----
> From: Peterson, Jon [mailto:jon.peterson@neustar.biz]
> Sent: Monday, April 11, 2005 16:09
> To: Audet, Francois [SC100:9T51:EXCH]; Fries Steffen; fluffy@cisco.com
> Cc: IETF SIP List
> Subject: sipping-retarget (was RE: [Sip] RE: Question to
> Identity draft)
>
>
>
> (maybe this should move to SIPPING, as this is properly about
> sipping-retarget, but I'll leave it here for now)
>
> Francois,
>
> sipping-retarget-00 is not intended to provide a solution
> space, if any, for retargeting problems; that is why it may
> seem to lack anything by way of a conclusion or concrete
> proposal. When the draft gets revised, I may try to insert
> some more speculation about the plausible parameters for some
> limited-scope fixes, but as it stands, the draft really just
> shows why a lot of things won't work.
>
> I guess I am not convinced that the rough proposal you
> outline below really escapes the problems detailed in 2.2.1
> and 2.3 of sipping-retarget. The whole issue of using a
> certificate to provide connected-party is problematic
> because, in order for someone to rely on a cert to identify
> the connected-party, it cannot be a self-signed cert. Issuing
> publicly-verifiable certs to end users (with subjects of form
> sip:jon@example.com or what have you) is known to be
> extremely difficult from an operational perspective. Indeed,
> if it were plausible to enroll end-users in PKIs, much of the
> security work in email, SIP and most other Internet
> applications would be taking a radically different form. The
> current level of S/MIME support in SIP deployments is a good
> indication of how well the implementation community is likely
> to react to this appraoch. While the problems in 2.3 are
> specific to S/MIME implementations, and thus could
> conceivably be addressed with a solution that is predicated
> on S/MIME, the problems in 2.2 and 2.2.1 are really generic
> ones that need to be addressed for clients that don't support
> S/MIME (since S/MIME is, as we all know, only a MAY in RFC3261).
>
> Even if there were a CA-signed certificate passed in the
> backwards direction which could tell a UAC whom is responding
> to their request, that doesn't make the remote side any less
> unanticipated, nor tell the UAC whether or not it should
> encrypt future calls to the original Request-URI with this
> certificate, nor tell the UAC how to deal with multiple
> responses that contain different certificates, and so on.
>
> Regarding your suggestion to encrypt or withhold SDP, how
> would you ever decide it is safe to provide SDP in an INVITE,
> if essentially it is possible for any INVITE to be
> retargeted? That is tantamount to always requiring a
> two-phase INVITE. When you encrypt the SDP body initially, at
> least that only results in a two-phase handshake for SIP when
> retargeting has occurred, but in either case this is a
> definite liability. Whenever there is a possibility of a
> two-phase handshake, there is a possibility that the
> certificate you acquire in the first phase will not work for
> the second phase, unless you change the target URI for the
> request (like you suggest below, using a GRUU or something).
> However, changing the target URI for the request may be
> self-defeating. If I am trying to call you, and I get
> retargeted to Steffen, and Steffen provides me his
> certificate... and then you become available before I send
> the second phase INVITE... what is the desired effect? Am I
> actually trying to contact you or Steffen? If I'm trying to
> talk to you, why am I encrypting my message with Steffen's
> certificate? But of course I may not even know the
> difference, if any, between "you" and the URI to which I have
> been retargeted. If I'm trying to send an INVITE to you, and
> I get back a 493 with a certificate for something really
> opaque, like 'sip:user51@example.com', how am I supposed to
> understand that? Is that URI a pseudonym for you, or does it
> represent someone else? Do I want to encrypt my message with
> that certificate or not? Do I want to use that certificate in
> the future when I try to contact you?

------_=_NextPart_001_01C54541.F244C88C-- --===============0303620173== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip --===============0303620173==-- From sip-bounces@ietf.org Tue Apr 19 21:02:24 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DO3bj-0004ue-U0; Tue, 19 Apr 2005 21:02:23 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DO3bi-0004uV-Qq for sip@megatron.ietf.org; Tue, 19 Apr 2005 21:02:22 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA13183 for ; Tue, 19 Apr 2005 21:02:20 -0400 (EDT) Received: from willow.neustar.com ([209.173.53.84]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DO3mq-0006pa-Ci for sip@ietf.org; Tue, 19 Apr 2005 21:13:52 -0400 Received: from stntsmtp1.cis.neustar.com (smartexch.neustar.com [10.31.13.79]) by willow.neustar.com (8.12.8/8.11.6) with ESMTP id j3K12Cs3001890; Wed, 20 Apr 2005 01:02:12 GMT Received: from stntexch03.cis.neustar.com ([10.31.13.45]) by stntsmtp1.cis.neustar.com with Microsoft SMTPSVC(6.0.3790.211); Tue, 19 Apr 2005 21:02:12 -0400 X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Subject: RE: [Sip] sip-identity-05: display-name woes Date: Tue, 19 Apr 2005 21:02:11 -0400 Message-ID: <24EAE5D4448B9D4592C6D234CBEBD59701502E49@stntexch03.cis.neustar.com> Thread-Topic: [Sip] sip-identity-05: display-name woes Thread-Index: AcVFLksuzbIU0vPNQe+L2A/6tUrm8QACXdCg From: "Peterson, Jon" To: "Paul Kyzivat" , "Jonathan Rosenberg" X-OriginalArrivalTime: 20 Apr 2005 01:02:12.0241 (UTC) FILETIME=[95C00810:01C54544] X-Spam-Score: 0.0 (/) X-Scan-Signature: 995b2e24d23b953c94bac5288c432399 Content-Transfer-Encoding: quoted-printable Cc: sip@ietf.org X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org I agree with Paul that simply transposing a TEL URI into a SIP URI will = not help certain classes of verifiers to make authorization decisions - = most importantly PSTN gateways. An SS7 gateway doesn't want to take = example.com's word that it is responsible for a given TN for the = purposes of populating the corresponding ISUP fields, say. What this = does provide is some degree of accountability for the source of the = request, which is very important when handling certain uses of = impersonation (finding someone to complain to about malicious or spam = calls). sip-identity-05 does talk about the fact that assertion can be = made for identities of the form sip:@. However, it is worth = noting that source accountability is not the primary motivation for = sip-identity - the primary motive is to allow a way for recipients of = requests to make a verify requests with the signaling they have on hand. To your second point: > Ahh. This is a good point. Clearly, it makes little sense at a gateway = > if the From field is sip:jon@example.com. It is for this reason I=20 > believe that P-Asserted-ID allowed for multiple values, one SIP and = one=20 > tel. More abstractly, the problem is that I may in fact have MANY=20 > identities, each within different namespaces. Which one of those=20 > identities are meaningful to the recipient depends on who the = recipient=20 > is. Its nearly impossible for me to know ahead of time what is=20 > meaningful to them, so P-A-ID allows me to include multiples. > > A similar problem arises in enterprise systems, whereby there is an=20 > internal numbering plan which is effectively a different namespace = from=20 > e.164. One would ideally like to supply a caller ID in both = namespaces,=20 > so that internal phones can use the one from the private numbering = plan,=20 > and phones outside the enterprise can use the public one. >=20 > Unfortunately, RFC 3261 allows only a single value for the From header = > field, and so this capability in P-A-ID cannot be readily extended to=20 > sip-identity. That is the real problem, I think. I'm not sure this is the real problem, and moreover, I'm not sure that = going down the path of solving the problem in the context of = sip-identity-05 would turn out to be practical anyway. It is true that one may have many identities within different = namespaces, and that potential recipients may have varying (possibly = contradictory, even) policies about those identities. It goes beyond = what is simply meaningful to the recipient - it is a question of what = permissions will be applied by recipients. But, agreed that it is = instructive to look at the case of different URI schemes, SIP and TEL, = that might be a priority for different types of recipients. The first issue I have is that my SIP service may not be associated with = any telephone number. I have several telephone numbers that are = associated with me, of course, none of which I get from any SIP service = provider, and consequently none that I might expect to be signed by an = authentication service. The value of having my SIP service provider sign = for these numbers is very small. Accordingly, inventing an Also-Known-As = (AKA) header doesn't completely solve the problem for gateways. If I do have a SIP service with a specifically associated telephone = number, and I include it in an AKA header, this still leaves open the = question of who should sign that AKA header. Even if my SIP service is = responsible for that telephone number (whatever that means), how will a = recipient ever know whether the SIP service is responsible or not? This = is the real problem, from my perspective, with approaching telephone = number identities. Assuming the existance of AKA headers, arranging for the necessary = authentication services to sign ten or fifteen identities is also a = problem. If I have identities at iptel.org, fwd.net, neustar.biz, and so = on, must I route each request through all of those services to get = requisite signatures for AKA headers, on the hope that one of these = identities might have a permission with a given recipient? Not an = attractive architecture.=20 It clearly isn't appropriate to include all possible AKAs for a given = user in every call; users might not want to reveal the linkages between = their various identities. But how can you decide which ones to include, = given that you cannot anticipate the destination? Inventing the AKA = header will not make it any easier for users to understand when they do = and do not want to include particular identities. >From a user interface perspective, I'm not sure how a user agent is = supposed to render the presence of multiple AKAs if it understands all = of them. Clearly only one thing should be rendered to a human recipient = immediately (as opposed to what they can access if they are interested = in inspecting the message in more detail). When the phone rings, though, = you certainly can't render ten or fifteen identities as the caller. I think users are accustomed to the idea of calling "as" someone, or = accessing a service "as" someone. When I try to log in to Amazon, my = eBay username doesn't work. When I talk to eBay, I am an eBay user. = Similarly, when I place a call in the PSTN, I don't have multiple = originating identities - I call from a specific number. Someone = screening calls who does not receive or recognize my number may elect = not to pick up the phone. My gmail account is not subscribed to the SIP = mailing list, and I understand that if I send messages to sip@ietf.org = from my gmail account, they will be held for moderator approval. This is = not rocket science; users deal with this all the time. Finally, let me conclude by saying that the problem of linking multiple = identities together is a well studied one in the security industry. I = hate to keep referring intractable problems for sip-identity to SAML, = but SAML was born to link your various identities at various providers = together. If there is a story to provide this capability, I'd like to = suggest it probably lies in that work, and doesn't belong in = sip-identity. Jon Peterson NeuStar, Inc. > -----Original Message----- > From: Paul Kyzivat [mailto:pkyzivat@cisco.com] > Sent: Tuesday, April 19, 2005 3:23 PM > To: Jonathan Rosenberg > Cc: Peterson, Jon; sip@ietf.org > Subject: Re: [Sip] sip-identity-05: display-name woes >=20 >=20 >=20 >=20 > Jonathan Rosenberg wrote: > > inline. > >=20 > > Paul Kyzivat wrote: > >=20 > >> OK. I forgot that phone numbers were out of scope for this=20 > discussion. > >=20 > >=20 > > Yes and no. Identifiers that lack a domain structure are=20 > out of scope.=20 > > That means tel URI won't work. But, a SIP URL with the user=20 > part as a=20 > > phone number seems perfectly fine to me. There is the authorization=20 > > issue, of whether you choose to trust that the domain asserting=20 > > ownership of a phone number really does in fact own it.=20 > Thats hard, and=20 > > not really clear to me that it needs to be solved for sip=20 > identity to be=20 > > useful with phone numbers. The domain signature prevents the=20 > > impersonation attacks we are primarliy concerned about. >=20 > Well, that is a partial solution, which is better than none. But it=20 > presents the caller with a dilemma: >=20 > - using the sip form in From allows identity to work. But=20 > using the sip=20 > form also has the implied semantic that the caller can only be called=20 > using SIP. >=20 > - using the tel form in From has no implied semantic about how the=20 > caller may be called. Could be via SIP, but could be via PSTN, H.323,=20 > whatever. But this form won't work with identity. >=20 > For instance, I can imagine a dual mode phone - SIP over WiFi plus=20 > conventional cellular. I receive a call using SIP, and the phone=20 > captures the from address URI in a directory. Later, when I only have=20 > cellular coverage, I try to make a call using that directory=20 > entry. If=20 > it is a SIP URI it works. If it is a TEL URI it doesn't. >=20 > Of course the phone could go ahead and parse the sip uri for a phone=20 > number and make a pstn call with it. But it isn't *supposed* to parse=20 > the user part. If we want devices doing that, we should=20 > change the rule=20 > about interpretting the user part in the case when user=3Dphone. >=20 > Paul >=20 _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Tue Apr 19 21:05:17 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DO3eX-00054f-Qh; Tue, 19 Apr 2005 21:05:17 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DO3eW-00054a-66 for sip@megatron.ietf.org; Tue, 19 Apr 2005 21:05:16 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA13393 for ; Tue, 19 Apr 2005 21:05:13 -0400 (EDT) Received: from willow.neustar.com ([209.173.53.84]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DO3pd-0006x5-Uo for sip@ietf.org; Tue, 19 Apr 2005 21:16:46 -0400 Received: from stntsmtp1.cis.neustar.com (smartexch.neustar.com [10.31.13.79]) by willow.neustar.com (8.12.8/8.11.6) with ESMTP id j3K156s3001952; Wed, 20 Apr 2005 01:05:06 GMT Received: from stntexch03.cis.neustar.com ([10.31.13.45]) by stntsmtp1.cis.neustar.com with Microsoft SMTPSVC(6.0.3790.211); Tue, 19 Apr 2005 21:05:06 -0400 X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0 Content-class: urn:content-classes:message MIME-Version: 1.0 Date: Tue, 19 Apr 2005 21:05:05 -0400 Message-ID: <24EAE5D4448B9D4592C6D234CBEBD59701502E4A@stntexch03.cis.neustar.com> Thread-Topic: Question to Identity draft & cert draft Thread-Index: AcVFMNLdBBP7XFqdQ/aRo7yTJFbyqwAE+zEw From: "Peterson, Jon" To: "Francois Audet" , "Cullen Jennings" X-OriginalArrivalTime: 20 Apr 2005 01:05:06.0253 (UTC) FILETIME=[FD7827D0:01C54544] X-Spam-Score: 0.9 (/) X-Scan-Signature: dbb8771284c7a36189745aa720dc20ab Cc: sip@ietf.org Subject: [Sip] RE: Question to Identity draft & cert draft X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============0631593263==" Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org This is a multi-part message in MIME format. --===============0631593263== Content-class: urn:content-classes:message Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C54544.FD37B91D" This is a multi-part message in MIME format. ------_=_NextPart_001_01C54544.FD37B91D Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable That language has been substantially changed in sip-identity-05. The = whole idea of using a SIPS URI for this has been removed; it was ugly = and in many ways non-functional. =20 Jon Peterson NeuStar, Inc. -----Original Message----- From: Francois Audet [mailto:audet@nortel.com] Sent: Tuesday, April 19, 2005 3:41 PM To: 'Cullen Jennings'; Peterson, Jon Cc: 'sip@ietf.org' Subject: Question to Identity draft & cert draft Cullen/Jon,=20 I'm a little confused by the following paragraph in = draft-ietf-sip-identity-04=20 in section 10:=20 The Identity-Info header MUST contain either an HTTPS URI or a SIPS=20 URI. If it contains an HTTPS URI, the URI must dereference to a=20 resource that contains a single MIME body containing the certificate=20 of the authentication service. If it is a SIPS URI, then the=20 authentication service intends for a user agent that wishes to fetch=20 the certificate to form a TLS connection to that URI, acquire the=20 certificate during normal TLS negotiation, and close the connection.=20 I understand the HTTPS URI case (which is used in the example in=20 draft-ietf-sip-identity-04), but I'm not sure I understand the=20 SIPS URI which is used in draft-ietf-sipping-certs-01. What do you=20 mean by fetching the certificate through a TLS connection? Why would=20 sips mean TLS? Do you mean fetch it using a SIP request over TLS?=20 I don't understand how it works (and why HTTPS is not sufficient).=20 Can you elaborate?=20 I'm keeping this in SIP instead of SIPPING since one draft is SIP the = other=20 is SIPPING.=20 ------_=_NextPart_001_01C54544.FD37B91D Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Question to Identity draft & cert draft
That=20 language has been substantially changed in sip-identity-05. The whole = idea of=20 using a SIPS URI for this has been removed; it was ugly and in many ways = non-functional.
 
Jon=20 Peterson
NeuStar, Inc.
-----Original Message-----
From: Francois Audet=20 [mailto:audet@nortel.com]
Sent: Tuesday, April 19, 2005 3:41 = PM
To: 'Cullen Jennings'; Peterson, Jon
Cc:=20 'sip@ietf.org'
Subject: Question to Identity draft & = cert=20 draft

Cullen/Jon,

I'm a little confused by the following paragraph in=20 draft-ietf-sip-identity-04
in section = 10:

   The Identity-Info header MUST contain = either an=20 HTTPS URI or a SIPS
   URI.  = If it=20 contains an HTTPS URI, the URI must dereference to a
   resource that contains a single MIME body = containing the=20 certificate

   of the = authentication=20 service.  If it is a SIPS URI, then the
   authentication service intends for a user agent = that=20 wishes to fetch

   the certificate = to form a=20 TLS connection to that URI, acquire the
  =20 certificate during normal TLS negotiation, and close the = connection.=20

I understand the HTTPS URI case (which is used in = the example=20 in
draft-ietf-sip-identity-04), but I'm not = sure I=20 understand the
SIPS URI which is used in=20 draft-ietf-sipping-certs-01. What do you
mean by=20 fetching the certificate through a TLS connection? Why would =
sips mean TLS? Do you mean fetch it using a SIP request over=20 TLS?
I don't understand how it works (and = why HTTPS is=20 not sufficient).

Can you elaborate?

I'm keeping this in SIP instead of SIPPING since one = draft is=20 SIP the other
is SIPPING.=20

------_=_NextPart_001_01C54544.FD37B91D-- --===============0631593263== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip --===============0631593263==-- From sip-bounces@ietf.org Tue Apr 19 21:21:30 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DO3uE-0008Cg-Lp; Tue, 19 Apr 2005 21:21:30 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DO3uD-0008Cb-58 for sip@megatron.ietf.org; Tue, 19 Apr 2005 21:21:29 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA14656 for ; Tue, 19 Apr 2005 21:21:26 -0400 (EDT) From: Udit_Goyal@3com.com Received: from plmler5.mail.eds.com ([199.228.142.70]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DO45G-0007Re-NB for sip@ietf.org; Tue, 19 Apr 2005 21:32:59 -0400 Received: from plmlir1.mail.eds.com (plmlir1-2.mail.eds.com [199.228.142.131]) by plmler5.mail.eds.com (8.13.2/8.12.10) with ESMTP id j3K1L33T015941; Tue, 19 Apr 2005 20:21:04 -0500 Received: from plmlir1.mail.eds.com (localhost [127.0.0.1]) by plmlir1.mail.eds.com (8.13.2/8.12.10) with ESMTP id j3K1KSvV027842; Tue, 19 Apr 2005 20:20:28 -0500 Received: from usut001.3com.com ([205.142.126.149]) by plmlir1.mail.eds.com (8.13.2/8.12.10) with ESMTP id j3K1KSnP027837; Tue, 19 Apr 2005 20:20:28 -0500 To: sip-implementors@cs.columbia.edu MIME-Version: 1.0 X-Mailer: Lotus Notes Release 6.5.2 June 01, 2004 Message-ID: Date: Tue, 19 Apr 2005 21:26:20 -0400 X-MIMETrack: Serialize by Router on USUT001/US/3Com(Release 6.0.3|September 26, 2003) at 04/19/2005 06:20:28 PM, Serialize complete at 04/19/2005 06:20:28 PM X-Spam-Score: 0.3 (/) X-Scan-Signature: 769a46790fb42fbb0b0cc700c82f7081 Cc: sip@ietf.org Subject: [Sip] UAC behaviour X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============1715389856==" Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org This is a multipart message in MIME format. --===============1715389856== Content-Type: multipart/alternative; boundary="=_alternative 000751D785256FE9_=" This is a multipart message in MIME format. --=_alternative 000751D785256FE9_= Content-Type: text/plain; charset="US-ASCII" Hi, I want to know what should be the behaviour of UAC after receiving 180 response when dialog is already in confirmed state. I think it should process it, is this behaviour mentioned anywhere in RFC? This scenario can occur in prepaid calling card application where user A first calls B, and after finsihing talking, he calls another user C on the same call. To connect user C, we can send Re-invite to user A agent resulting in call connected between A and C as per thirdparty call control. But before the call is answered by user C, if 180 Ringing is send to user agent A, it should play ringback as user need to hear the ringback to know the status of the second call. -Udit --=_alternative 000751D785256FE9_= Content-Type: text/html; charset="US-ASCII"
Hi,

I want to know what should be the behaviour of UAC after receiving 180 response when dialog is already in confirmed state.
I think it should process it, is this behaviour mentioned anywhere in RFC?

This scenario can occur in prepaid calling card application where user A first calls B, and after finsihing talking, he calls another user C on the same call.
To connect user C, we can send Re-invite to user A agent resulting in call connected between A and C as per thirdparty call control.

But before the call is answered by user C, if 180 Ringing is send to user agent A, it should play ringback as user need to hear the ringback to know the status of the second call.

-Udit
--=_alternative 000751D785256FE9_=-- --===============1715389856== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip --===============1715389856==-- From sip-bounces@ietf.org Wed Apr 20 03:55:22 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DOA3N-0008Vu-2V; Wed, 20 Apr 2005 03:55:21 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DOA3I-0008Tu-6Q for sip@megatron.ietf.org; Wed, 20 Apr 2005 03:55:16 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA13027 for ; Wed, 20 Apr 2005 03:55:12 -0400 (EDT) Received: from mail.oefeg.at ([62.47.121.5]) by ietf-mx.ietf.org with smtp (Exim 4.33) id 1DOAEP-0001Cm-Vu for sip@ietf.org; Wed, 20 Apr 2005 04:06:46 -0400 X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Subject: RE: [Sip] sip-identity-05: display-name woes Date: Wed, 20 Apr 2005 09:57:13 +0200 Message-ID: <32755D354E6B65498C3BD9FD496C7D4601D8F0@oefeg-s04.oefeg.loc> Thread-Topic: [Sip] sip-identity-05: display-name woes Thread-Index: AcVFLksuzbIU0vPNQe+L2A/6tUrm8QACXdCgABEmSzA= From: "Stastny Richard" To: "Peterson, Jon" , "Paul Kyzivat" , "Jonathan Rosenberg" X-Spam-Score: 0.0 (/) X-Scan-Signature: 8cb9b411340046bf4080a729180a0672 Content-Transfer-Encoding: quoted-printable Cc: sip@ietf.org X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org Hi Jon, Since I was not following this complicated thread completely, I may not be up to date completely. Anyway: > The first issue I have is that my SIP service may not be associated with > any telephone number. I have several telephone numbers that are > associated with me, of course, none of which I get from any SIP service > provider, and consequently none that I might expect to be signed by an > authentication service. The value of having my SIP service provider sign > for these numbers is very small. Accordingly, inventing an Also-Known-As > (AKA) header doesn't completely solve the problem for gateways. I agree what you stated here and with the rest of it. I just want to point out from an emergency call point of view (this is out-of-scope in ecrit), that if one wants to make an emergency call from a VoIP account without an associated E.164 number to a PSAP on the PSTN,=20 a CLI MUST be displayed at least to allow call-back. Therefore it is required to generate a temporary CLI in the ESRP valid for some time. Some remarks on the ENUM stuff from previous posts: I also want to note that ENUM is only for incoming calls, so a VoIP provider may have no idea that an ENUM NAPTR is pointing to him. I did not quite understand your proposal using ENUM for verification of name for OUTGOING calls. The only way I could imagine is that a GW to the PSTN before he inserts a E.164 CLI contained in the INVITE into=20 the SS7 signaling to check if a corresponding NAPTR pointing to the SIP URI contained in the From: Header exists. I have no idea how truthworthy this is. Of course one could enter a pointer to or directly a name in the ENUM Domain (we did this for fun with a TXT record), but then you would have the privacy people again all over the place. Regards Richard > -----Original Message----- > From: sip-bounces@ietf.org [mailto:sip-bounces@ietf.org] On Behalf Of > Peterson, Jon > Sent: Wednesday, April 20, 2005 3:02 AM > To: Paul Kyzivat; Jonathan Rosenberg > Cc: sip@ietf.org > Subject: RE: [Sip] sip-identity-05: display-name woes >=20 >=20 > I agree with Paul that simply transposing a TEL URI into a SIP URI will > not help certain classes of verifiers to make authorization decisions - > most importantly PSTN gateways. An SS7 gateway doesn't want to take > example.com's word that it is responsible for a given TN for the purposes > of populating the corresponding ISUP fields, say. What this does provide > is some degree of accountability for the source of the request, which is > very important when handling certain uses of impersonation (finding > someone to complain to about malicious or spam calls). sip-identity-05 > does talk about the fact that assertion can be made for identities of the > form sip:@. However, it is worth noting that source > accountability is not the primary motivation for sip-identity - the > primary motive is to allow a way for recipients of requests to make a > verify requests with the signaling they have on hand. >=20 > To your second point: >=20 > > Ahh. This is a good point. Clearly, it makes little sense at a gateway > > if the From field is sip:jon@example.com. It is for this reason I > > believe that P-Asserted-ID allowed for multiple values, one SIP and one > > tel. More abstractly, the problem is that I may in fact have MANY > > identities, each within different namespaces. Which one of those > > identities are meaningful to the recipient depends on who the recipient > > is. Its nearly impossible for me to know ahead of time what is > > meaningful to them, so P-A-ID allows me to include multiples. > > > > A similar problem arises in enterprise systems, whereby there is an > > internal numbering plan which is effectively a different namespace from > > e.164. One would ideally like to supply a caller ID in both namespaces, > > so that internal phones can use the one from the private numbering plan, > > and phones outside the enterprise can use the public one. > > > > Unfortunately, RFC 3261 allows only a single value for the From header > > field, and so this capability in P-A-ID cannot be readily extended to > > sip-identity. That is the real problem, I think. >=20 > I'm not sure this is the real problem, and moreover, I'm not sure that > going down the path of solving the problem in the context of sip-identity- > 05 would turn out to be practical anyway. >=20 > It is true that one may have many identities within different namespaces, > and that potential recipients may have varying (possibly contradictory, > even) policies about those identities. It goes beyond what is simply > meaningful to the recipient - it is a question of what permissions will be > applied by recipients. But, agreed that it is instructive to look at the > case of different URI schemes, SIP and TEL, that might be a priority for > different types of recipients. >=20 > The first issue I have is that my SIP service may not be associated with > any telephone number. I have several telephone numbers that are > associated with me, of course, none of which I get from any SIP service > provider, and consequently none that I might expect to be signed by an > authentication service. The value of having my SIP service provider sign > for these numbers is very small. Accordingly, inventing an Also-Known-As > (AKA) header doesn't completely solve the problem for gateways. >=20 > If I do have a SIP service with a specifically associated telephone > number, and I include it in an AKA header, this still leaves open the > question of who should sign that AKA header. Even if my SIP service is > responsible for that telephone number (whatever that means), how will a > recipient ever know whether the SIP service is responsible or not? This is > the real problem, from my perspective, with approaching telephone number > identities. >=20 > Assuming the existance of AKA headers, arranging for the necessary > authentication services to sign ten or fifteen identities is also a > problem. If I have identities at iptel.org, fwd.net, neustar.biz, and so > on, must I route each request through all of those services to get > requisite signatures for AKA headers, on the hope that one of these > identities might have a permission with a given recipient? Not an > attractive architecture. >=20 > It clearly isn't appropriate to include all possible AKAs for a given user > in every call; users might not want to reveal the linkages between their > various identities. But how can you decide which ones to include, given > that you cannot anticipate the destination? Inventing the AKA header will > not make it any easier for users to understand when they do and do not > want to include particular identities. >=20 > >From a user interface perspective, I'm not sure how a user agent is > supposed to render the presence of multiple AKAs if it understands all of > them. Clearly only one thing should be rendered to a human recipient > immediately (as opposed to what they can access if they are interested in > inspecting the message in more detail). When the phone rings, though, you > certainly can't render ten or fifteen identities as the caller. >=20 > I think users are accustomed to the idea of calling "as" someone, or > accessing a service "as" someone. When I try to log in to Amazon, my eBay > username doesn't work. When I talk to eBay, I am an eBay user. Similarly, > when I place a call in the PSTN, I don't have multiple originating > identities - I call from a specific number. Someone screening calls who > does not receive or recognize my number may elect not to pick up the > phone. My gmail account is not subscribed to the SIP mailing list, and I > understand that if I send messages to sip@ietf.org from my gmail account, > they will be held for moderator approval. This is not rocket science; > users deal with this all the time. >=20 > Finally, let me conclude by saying that the problem of linking multiple > identities together is a well studied one in the security industry. I hate > to keep referring intractable problems for sip-identity to SAML, but SAML > was born to link your various identities at various providers together. If > there is a story to provide this capability, I'd like to suggest it > probably lies in that work, and doesn't belong in sip-identity. >=20 > Jon Peterson > NeuStar, Inc. >=20 > > -----Original Message----- > > From: Paul Kyzivat [mailto:pkyzivat@cisco.com] > > Sent: Tuesday, April 19, 2005 3:23 PM > > To: Jonathan Rosenberg > > Cc: Peterson, Jon; sip@ietf.org > > Subject: Re: [Sip] sip-identity-05: display-name woes > > > > > > > > > > Jonathan Rosenberg wrote: > > > inline. > > > > > > Paul Kyzivat wrote: > > > > > >> OK. I forgot that phone numbers were out of scope for this > > discussion. > > > > > > > > > Yes and no. Identifiers that lack a domain structure are > > out of scope. > > > That means tel URI won't work. But, a SIP URL with the user > > part as a > > > phone number seems perfectly fine to me. There is the authorization > > > issue, of whether you choose to trust that the domain asserting > > > ownership of a phone number really does in fact own it. > > Thats hard, and > > > not really clear to me that it needs to be solved for sip > > identity to be > > > useful with phone numbers. The domain signature prevents the > > > impersonation attacks we are primarliy concerned about. > > > > Well, that is a partial solution, which is better than none. But it > > presents the caller with a dilemma: > > > > - using the sip form in From allows identity to work. But > > using the sip > > form also has the implied semantic that the caller can only be called > > using SIP. > > > > - using the tel form in From has no implied semantic about how the > > caller may be called. Could be via SIP, but could be via PSTN, H.323, > > whatever. But this form won't work with identity. > > > > For instance, I can imagine a dual mode phone - SIP over WiFi plus > > conventional cellular. I receive a call using SIP, and the phone > > captures the from address URI in a directory. Later, when I only have > > cellular coverage, I try to make a call using that directory > > entry. If > > it is a SIP URI it works. If it is a TEL URI it doesn't. > > > > Of course the phone could go ahead and parse the sip uri for a phone > > number and make a pstn call with it. But it isn't *supposed* to parse > > the user part. If we want devices doing that, we should > > change the rule > > about interpretting the user part in the case when user=3Dphone. > > > > Paul > > >=20 > _______________________________________________ > Sip mailing list https://www1.ietf.org/mailman/listinfo/sip > This list is for NEW development of the core SIP Protocol > Use sip-implementors@cs.columbia.edu for questions on current sip > Use sipping@ietf.org for new developments on the application of sip _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Wed Apr 20 04:06:01 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DOADg-0001VM-26; Wed, 20 Apr 2005 04:06:00 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DOADc-0001Uo-OC for sip@megatron.ietf.org; Wed, 20 Apr 2005 04:05:57 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id EAA13742 for ; Wed, 20 Apr 2005 04:05:55 -0400 (EDT) Received: from david.siemens.de ([192.35.17.14]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DOAOk-0001Ye-Eo for sip@ietf.org; Wed, 20 Apr 2005 04:17:27 -0400 Received: from mail2.siemens.de (mail2.siemens.de [139.25.208.11]) by david.siemens.de (8.12.6/8.12.6) with ESMTP id j3K85iQ9021239; Wed, 20 Apr 2005 10:05:44 +0200 Received: from mchp9daa.mch.sbs.de (mchp9daa.mch.sbs.de [139.25.137.99]) by mail2.siemens.de (8.12.6/8.12.6) with ESMTP id j3K85iA4002866; Wed, 20 Apr 2005 10:05:44 +0200 Received: by mchp9daa.mch.sbs.de with Internet Mail Service (5.5.2657.72) id <2SQ5NCTG>; Wed, 20 Apr 2005 10:05:44 +0200 Message-ID: From: Fries Steffen To: Cullen Jennings , Jon Peterson Subject: RE: [Sip] RE: Question to Identity draft Date: Wed, 20 Apr 2005 10:05:44 +0200 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2657.72) Content-Type: text/plain X-Spam-Score: 0.8 (/) X-Scan-Signature: 5fb88b8381f3896aeacc5a021513237b Cc: sip@ietf.org X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org Agreed. What I had in mind was more that Alice from example.com uses a cert issued for 00342506@mysip.example.com, which may be a self-signed certificate or come from a corporate CA, which has not public available root certificate. In this case the authentication service asserts the FROM field and the cert (in the body) may be used within the dialog. @Jon, I dont think this approach obviates the authentication service at all. On the contrary, the authentication service MUST assert the identity at the beginning of the session, and the receiver is able to keep this assertion together with the certificate received in the asserted message. The authentication service may be then left out of the path for the rest of the session, when not needed or may be invoked for further assertions. From my point of view this would be worth mentioning it as an example in the identity ID. Regarding the cert service, this service is extermely useful, especially for the approach of storing credentials. But there may be scenarios, were the usage may be simplyfied by using just the authentication service. For instance in cases were the user has no certificate at all but the used device has one assigned (I used that example at the beginning of this discussion too). The certificate may have no meaning outside an enterprise but using the authentication service provides the meaning for the receiver, at least for the duration of the session. The worst case here would be that the caller uses a different phone for each call. Well, it might not be very likely, but it may be the worst case. Using a cert service here would mean, that I would have to propagate my certificate information each time I change the device. The certificate server would use the authentication server to assert the FROM field and provide integrity protection for the body when sending a NOTIFY. In those scenarios, the user may also sent the certificate information inline via an authentication service and thus save additional communication with the cert server. Another scenario may be the case were the cert server is not reachable by every receiver of a call. Regards Steffen > -----Original Message----- > From: Cullen Jennings [mailto:fluffy@cisco.com] > Sent: Tuesday, April 19, 2005 10:30 PM > To: Fries Steffen > Cc: sip@ietf.org; Jon Peterson > Subject: Re: [Sip] RE: Question to Identity draft > Importance: High > > > Agreeing with Jon here and want to point out a critical thing > about the certificates. For the AOR alice@example.com, the > certificate in a body would most likely be for the user > alice@example.com while the certificate used for identity is > for the domain example.com. You can't use a certificate for a > user, like alice@example.com to assert identity using the > identity draft mechanism. > > Cullen > > > On 4/19/05 11:55 AM, "Peterson, Jon" wrote: > > > > > I do agree that sip-identity provides body integrity, and as such, > > that it could be used to provide integrity protection for a > > self-signed certificate in the body of a SIP message, and > furthermore, > > that such a self-signed certificate could be used in subsequently > > messages to provide confidentiality services for SIP > message bodies in > > order to encrypt symmetric keys used for SRTP. > > > > I have reservations when we start describing the use of that > > self-signed certificate to provide integrity services for > subsequent > > requests, thereby obviating the need to use an authentication > > services. I furthermore think that sipping-certs provides a > better way > > to discover certificates for confidentiality than this > method of tunneling certificates in SIP requests. > > > > That much said, I would not rule out tunneling self-signed > > certificates in this fashion, no. > > > > Jon Peterson > > NeuStar, Inc. > > > >> -----Original Message----- > >> From: Fries Steffen [mailto:steffen.fries@siemens.com] > >> Sent: Thursday, April 14, 2005 7:48 AM > >> To: Peterson, Jon; fluffy@cisco.com > >> Cc: IETF SIP List > >> Subject: RE: [Sip] RE: Question to Identity draft > >> > >> > >> Hi Jon, > >> > >> I'm still not sure what the answer to the scenarios is. > >> > >> Do you see the option with the identity draft to assert a > FROM field > >> of a SIP message and also an embedded certificate in the body and > >> thus have a security context for that dialog. The > security context > >> may be used on subsequent messages (e.g., to negotiate media > >> encryption), which do not need to be sent via the > authentication service? > >> > >> Regards > >> Steffen > >> > >> > >>> -----Original Message----- > >>> From: sip-bounces@ietf.org [mailto:sip-bounces@ietf.org] > On Behalf > >>> Of Fries Steffen > >>> Sent: Thursday, April 07, 2005 4:56 PM > >>> To: Peterson, Jon; fluffy@cisco.com > >>> Cc: IETF SIP List > >>> Subject: [Sip] RE: Question to Identity draft > >>> Importance: High > >>> > >>> Hi Jon, > >>> > >>>>> [stf] yes, RFC3261 talks about certificate exchhange. But > >>>> here it is > >>>>> only possible to take certificates, which are (more or > >>>> less) bound to a person. > >>>>> Assume that you use certificates, which are bound to the > >>>> host used for > >>>>> phone calls. Then you would need some instance assuring, > >>> that this > >>>>> certificate is connected with the registration under some AOR. > >>>>> > >>>>> What I had in mind is an inband certificate exchange from, > >>>> e.g., self > >>>>> signed certificates, were the authentication services basically > >>>>> assures that the message (and thus the certificate) came > >>>> from a person > >>>>> registered under a certain AOR. > >>>> > >>>> RFC3261 does in fact describe the self-signed certificate case. > >>> [stf] Okay, I put it in a wrong way, I meant the certificate must > >>> follow some dedicated syntax, connected with the domain you are > >>> registering in. > >>> When you have something like device certificates, which > are issued > >>> by a corporate CA on the base of machine names, these > certificates > >>> may be used in SIP scenarios. After successful registering, the > >>> Proxy knows, that a user, who authenticated himself using digest > >>> authentication over a TLS link that he uses the dedicated device > >>> certificate for the duration of his registration for security > >>> purposes. That means next time he registers, his identity may be > >>> connected with a different certificate, as he may use a different > >>> phone. Sure, the user could publish the certificate to a cert > >>> server, as described in the certs draft, but I was > thinking of some > >>> kind of "inband provisioning" for such a scenario. > >>> > >>>> > >>>>> The certificate itself may then be used for end-to-end > >> integrity > >>>>> services. > >>>> > >>>> In what respect would using this certificates for an end-to-end > >>>> integrity service be superior to just using > >>>> sip-identity-04 for integrity? Note that that strength of a > >>>> self-signed credential is necessarily equivalent to the > >> strength of > >>>> the security mechanism used to deliver that self-signed > >>> credential to > >>>> potential users. So, if > >>>> sip-identity-04 is used to secure the cert, it isn't > >> clear how the > >>>> cert provides a stronger or more attractive assurance than > >>>> sip-identity-04 itself would provide. > >>> [stf]Using the certificate would require to send just one message > >>> over the authentication service and use the supplied > certificate for > >>> the rest of the communication. > >>> > >>> > >>>>> A usage example would be the key management for SRTP using > >>>> MIKEY, were > >>>>> one option is the usage of certificates. When here a > >>> certificate is > >>>>> used, which is completely unknown to the receiver, then > >>> there is no > >>>>> real value. But when a trusted component (the > >>>> authentication service) > >>>>> assures, that a person registered with a dedicated AOR is > >>> connected > >>>>> with this certificate, then it gets a meaning. It would > >> basically > >>>>> provide the assurance, that for the time I am in the call, > >>>> I am using > >>>>> this certificate, which may be sufficient. > >>>> > >>>> No question that using sip-identity-04 would guarantee the > >>> integrity > >>>> of the certificate contained in a SIP message body. > >>>> But why not have sip-identity-04 secure the SDP body > >> containing the > >>>> keymgmt attribute for MIKEY, rather than going through a > >>> certificate > >>>> exchange phase in order to subsequently use the a cert > >>> (whose strength > >>>> is equivalent to > >>>> sip-identity-04) to secure the SDP body containing the > >> keymgmt? In > >>>> what respect is this not a redundant step? > >>> [stf] as stated above, the authentication server would only be > >>> needed for one message, to support the establishment of a session > >>> security context. The other thing is that for the key > management for > >>> SRTP the client itself needs to include the appropriate > message body > >>> for MIKEY, as the MIKEY container is protected. The same would be > >>> true in scenarios were S/MIME would be required to protect > >>> sdescriptions. > >>> > >>> > >>> Regards > >>> Steffen > >>> > >>>> > >>>> Jon Peterson > >>>> NeuStar, Inc. > >>>> > >>>>> Regards > >>>>> Steffen > >>>>> > >>>>> > >>>> > >>> > >>> _______________________________________________ > >>> Sip mailing list https://www1.ietf.org/mailman/listinfo/sip > >>> This list is for NEW development of the core SIP Protocol Use > >>> sip-implementors@cs.columbia.edu for questions on current sip Use > >>> sipping@ietf.org for new developments on the application of sip > >>> > >> > _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Wed Apr 20 09:54:10 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DOFec-0003Eb-Fc; Wed, 20 Apr 2005 09:54:10 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DOFea-0003ET-Nj for sip@megatron.ietf.org; Wed, 20 Apr 2005 09:54:08 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA09637 for ; Wed, 20 Apr 2005 09:54:07 -0400 (EDT) Received: from ihemail1.lucent.com ([192.11.222.161]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DOFpp-0003JP-5q for sip@ietf.org; Wed, 20 Apr 2005 10:05:45 -0400 Received: from oh0012exch001p.wins.lucent.com (h135-7-157-6.lucent.com [135.7.157.6]) by ihemail1.lucent.com (8.12.11/8.12.11) with ESMTP id j3KDrhMN023114 for ; Wed, 20 Apr 2005 08:53:48 -0500 (CDT) Received: by oh0012exch001p.cb.lucent.com with Internet Mail Service (5.5.2657.72) id <2553KN1M>; Wed, 20 Apr 2005 09:53:39 -0400 Message-ID: <4C37CF2D8DF07E4CA6357BAD5EB9A5D7189FC486@oh0012exch004u.cb.lucent.com> From: "Shekar, Nagesh Soma (Shekar)** CTR **" To: "'Udit_Goyal@3com.com'" , sip-implementors@cs.columbia.edu Subject: RE: [Sip] UAC behaviour Date: Wed, 20 Apr 2005 09:53:38 -0400 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2657.72) X-Spam-Score: 0.9 (/) X-Scan-Signature: 8de5f93cb2b4e3bee75302e9eacc33db Cc: sip@ietf.org X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============1139045549==" Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. --===============1139045549== Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C545B0.5A991670" This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. ------_=_NextPart_001_01C545B0.5A991670 Content-Type: text/plain Udit, It is valid for the ReInvite transaction to contain a provisional response.Of course for the 180 Ringing to be valid, it has to be part of the Reinvite transaction, i.e. the CSeq No should be valid, etc,.. The 180 Ringing generation is mentioned in section 14.2 of RFC 3261. It says that a UAS MAY generate a 180 for the Reinvite. Shekar -----Original Message----- From: sip-bounces@ietf.org [mailto:sip-bounces@ietf.org]On Behalf Of Udit_Goyal@3com.com Sent: Tuesday, April 19, 2005 9:26 PM To: sip-implementors@cs.columbia.edu Cc: sip@ietf.org Subject: [Sip] UAC behaviour Hi, I want to know what should be the behaviour of UAC after receiving 180 response when dialog is already in confirmed state. I think it should process it, is this behaviour mentioned anywhere in RFC? This scenario can occur in prepaid calling card application where user A first calls B, and after finsihing talking, he calls another user C on the same call. To connect user C, we can send Re-invite to user A agent resulting in call connected between A and C as per thirdparty call control. But before the call is answered by user C, if 180 Ringing is send to user agent A, it should play ringback as user need to hear the ringback to know the status of the second call. -Udit ------_=_NextPart_001_01C545B0.5A991670 Content-Type: text/html
Udit,
 
It is valid for the ReInvite transaction to contain a provisional response.Of course for
the 180 Ringing to be valid, it has to be part of the Reinvite transaction, i.e. the CSeq No
should be valid, etc,..
 
The 180 Ringing generation is mentioned in section 14.2 of RFC 3261. It says that a
UAS MAY generate a 180 for the Reinvite.
 
Shekar
-----Original Message-----
From: sip-bounces@ietf.org [mailto:sip-bounces@ietf.org]On Behalf Of Udit_Goyal@3com.com
Sent: Tuesday, April 19, 2005 9:26 PM
To: sip-implementors@cs.columbia.edu
Cc: sip@ietf.org
Subject: [Sip] UAC behaviour


Hi,

I want to know what should be the behaviour of UAC after receiving 180 response when dialog is already in confirmed state.
I think it should process it, is this behaviour mentioned anywhere in RFC?

This scenario can occur in prepaid calling card application where user A first calls B, and after finsihing talking, he calls another user C on the same call.
To connect user C, we can send Re-invite to user A agent resulting in call connected between A and C as per thirdparty call control.

But before the call is answered by user C, if 180 Ringing is send to user agent A, it should play ringback as user need to hear the ringback to know the status of the second call.

-Udit
------_=_NextPart_001_01C545B0.5A991670-- --===============1139045549== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip --===============1139045549==-- From sip-bounces@ietf.org Wed Apr 20 10:50:18 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DOGWw-00022Q-11; Wed, 20 Apr 2005 10:50:18 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DOGWs-00022H-Vm for sip@megatron.ietf.org; Wed, 20 Apr 2005 10:50:15 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA16318 for ; Wed, 20 Apr 2005 10:50:13 -0400 (EDT) Received: from sj-iport-1-in.cisco.com ([171.71.176.70] helo=sj-iport-1.cisco.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DOGi6-0005Fz-J5 for sip@ietf.org; Wed, 20 Apr 2005 11:01:52 -0400 Received: from sj-core-2.cisco.com (171.71.177.254) by sj-iport-1.cisco.com with ESMTP; 20 Apr 2005 07:50:04 -0700 X-IronPort-AV: i="3.92,117,1112598000"; d="asc'?scan'208"; a="630679878:sNHT52864972" Received: from imail.cisco.com (imail.cisco.com [128.107.200.91]) by sj-core-2.cisco.com (8.12.10/8.12.6) with ESMTP id j3KEo1Kx023123; Wed, 20 Apr 2005 07:50:01 -0700 (PDT) Received: from thomasm-lnx.cisco.com (thomasm-lnx.cisco.com [171.71.96.50]) by imail.cisco.com (8.12.11/8.12.10) with ESMTP id j3KEf3JU031650; Wed, 20 Apr 2005 07:41:03 -0700 Subject: Re: authority for a domain (was RE: [Sip] sip-identity-05: display-name woes) From: Michael Thomas To: "Peterson, Jon" In-Reply-To: <24EAE5D4448B9D4592C6D234CBEBD59701502E40@stntexch03.cis.neustar.com> References: <24EAE5D4448B9D4592C6D234CBEBD59701502E40@stntexch03.cis.neustar.com> Organization: Cisco Systems Message-Id: <1114008600.5211.34.camel@thomasm-lnx.cisco.com> Mime-Version: 1.0 X-Mailer: Ximian Evolution 1.4.6 Date: Wed, 20 Apr 2005 07:50:00 -0700 IIM-SIG: v:"1.1"; h:"imail.cisco.com"; d:"cisco.com"; z:"home"; m:"krs"; t:"1114008063.571167"; x:"432200"; a:"rsa-sha1"; b:"nofws:5048"; e:"Iw=="; n:"sQYarK2E51MdcTiUqeif3F7cWdxIfoCiXhdfb9vD5ee/j0jXL15gbFxF2p" "XIweAblu0N6XAgK7k+wrbr7bQDJaCDqOmzqpRUBjIRQAXQ7NzadpmR3pUL6wxaRUtW+c43sl9jC" "50Qg1sXHpPjt8Y+Y16ioyQAQAdSunM4YhevURc="; s:"gBfef7sQEPyAAxMxT+ztvVYWJizilICMxaVZgEhD/bzn31papkKsjDL4IMriippWSqDEcN7w" "cFbSdycum/ZAuExZUJQR62j5WMdku0x/7QPc7Fwpx+3tY+H26bhurwK6jd1pBDsYnr/pf3NMUHV" "kChHOGFFyYW6tJNnJUpLuwxs="; c:"Subject: Re: authority for a domain (was RE: [Sip] sip-identity-05:=" "0A display-name woes)"; c:"From: Michael Thomas "; c:"Date: Wed, 20 Apr 2005 07:50:00 -0700" IIM-VERIFY: s:"y"; v:"y"; r:"60"; h:"imail.cisco.com"; c:"message from imail.cisco.com verified; " X-Spam-Score: 0.0 (/) X-Scan-Signature: 93e7fb8fef2e780414389440f367c879 Cc: sip@ietf.org, Francois Audet , Paul Kyzivat X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============0033614114==" Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org --===============0033614114== Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="=-pGBWrqVi8hhAl20LCXZg" --=-pGBWrqVi8hhAl20LCXZg Content-Type: text/plain Content-Transfer-Encoding: quoted-printable On Tue, 2005-04-19 at 11:37, Peterson, Jon wrote: > Mike, >=20 > > As far as I can tell, there's an implicit assumption in > > sip-identity that the way that example.com would prevent=20 > > me from signing sip-identites for the whole domain is=20 > > to... just not give me that cert.=20 >=20 > The draft does assume that if you hold a cert for example.com (i.e., a CA= -signed cert with the subjectAltName 'example.com'), then you are the legit= imate authority for example.com.=20 Authority for _what_? SIP? Prize Rooster trading? All of the above? If not all of the above, what if I want to use the same technique for the Prize Rooster Trading Protocol... but it seems that I can't because SIP got there first[*]. If it is all of the above, then that's a real problem in the delegation arena since I don't want my telephony guys having any authority over who's allowed to trade my Prize Roosters. [*] no you cannot use a different root to separate them out because the receiver doesn't know which roots represent which service. > It does not assume that if you hold the cert sip.example.com. or sip:matt= @example.com, that you are the authority for example.com. How does one get = a cert for example.com? That is matter of CA policy, to a large extent, but= there is typically a validation process. The validation process consists o= f the CA determining whether or not the requestor of a certificate has auth= ority over that particular name in the DNS I don't understand the DNS part, and don't recall seeing anything about DNS in the draft.=20 . >=20 > So, "[the domain] just not giving [a random user] the cert" is not the is= sue. The domain is not the CA, and it is not the domain's business to distr= ibute certs. The authority for the domain is eligible to receive a cert fro= m a CA, and a random user of that domain is not. >=20 > While one could argue that CA processes for issuing certs are flawed, or = what have you, a draft about SIP identity is hardly going to rectify that. >=20 > > That's not a very=20 > > good assumption as credentials can be used for a wide > > variety of things, and having to run parallel namespaces > > which each gate a particular authorization domain would > > be a horrible management nightmare.=20 >=20 > Your point that a domain uses credentials for a wide variety of things is= relevant, and it is a limitation of the sip-identity mechanism. It is, as = you say, an operational limitation. It's hard for me to see how impactful t= his will ultimately be. If cisco.com, say, doesn't want some SIP authentica= tion service to store and use the private key associated with its 'cisco.co= m' cert, then cisco.com would be forced to create a parallel namespace, lik= e sip.cisco.com, for its SIP users. As I said, you cannot create a parallel namespace unless the receiver has a way to know which namespace is appropriate for which service. Consider the actual fact that I'm completely ignorant about example.com's namespace(s). Which one do I consider to be valid when I get an incoming INVITE? > While either or both alternatives could be awkward for particular adminis= trative domains, I would submit I have hard time looking at this as a "horr= ible management nightmare". Right now, there typically exists zero PKI namespaces (with the lone exception of http server certs) within most organizations. I don't think that bodes well for handwaving. >=20 > > Worse is that a naive > > cross domain receiver has *no* way to know which of example.com's > > namespaces ought to be considered valid. So it doesn't even > > work in this case. >=20 > Well, no, I'm not sure that is true. If cisco.com uses a cert with a subj= ect of 'cisco.com' in their auth service, then SIP users would have names o= f the form 'sip:matt@cisco.com'. If it uses, say, sip.cisco.com in their au= th service, then SIP users would have need to have names of the form 'sip:m= att@sip.cisco.com'. So, saying that it doesn't work isn't fair. It will be = clear to a cross domain user whether or not the domain in the From header f= ield matches the domain the subjectAltName of the cert. >=20 > There is some treatment of name subordination issues in the -04 version o= f the draft, and I am beefing up that language a bit in the -05 to make thi= s more clear. -05 also leaves a few doors open for future work to improve o= n the name subordination story. However, I believe that the current story i= s practicable, and that we can go forward with it for this initial iteratio= n. So is the idea to segregate out the name space with the sip: preceding the subject alt name? This is getting=20 weirder and weirder, because that implies that I'm going have a pile of different purpose built certs per/user=20 which is really awful because enrollment is the actual Really Hard Problem of PKI. If you're going to go down this cert route at all, you really ought to look into=20 attribute certs instead of overloading namespace with authz semantics. >=20 > > NB: this is a common conflation with would-be cert users. > > What you get with certs is authentication and nothing more. > > Authorization is necessary to bind identity with role. That's > > missing in the sip-identity draft. >=20 > Yes, the cert authenticates the owner of the namespace. The act of creati= ng the Identity header makes an authorization assertion about the use of th= e From header field in a particular message.=20 It can assert all it likes. If I can't verify the authority of that assertion it's worthless. That's the problem here. Mike --=-pGBWrqVi8hhAl20LCXZg Content-Type: application/pgp-signature; name=signature.asc Content-Description: This is a digitally signed message part -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.3 (GNU/Linux) iQCVAwUAQmZsGLMsDAj/Eq++AQKvWwQAqzQ8JDeDqC09vf6XKIynweottqCas+xY uY4rGE0nzABm89zpbutN2PVKTp/M468A6dzt6URIh+sIa8G40Jjk5UwsHd9oB7R7 I+phX+DWmO71KgMlND1/vvWB4Zvfj1sFuMB0wCMV6hfUVSrPjp7T49BEY0yZzaPg H5z0CQGgBrM= =Wj+v -----END PGP SIGNATURE----- --=-pGBWrqVi8hhAl20LCXZg-- --===============0033614114== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip --===============0033614114==-- From sip-bounces@ietf.org Wed Apr 20 11:30:18 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DOH9d-00081Y-Ue; Wed, 20 Apr 2005 11:30:17 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DOH9b-00081Q-Ki for sip@megatron.ietf.org; Wed, 20 Apr 2005 11:30:15 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA19883 for ; Wed, 20 Apr 2005 11:30:13 -0400 (EDT) From: Udit_Goyal@3com.com Received: from plmler6.mail.eds.com ([199.228.142.66]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DOHKo-0006V1-OJ for sip@ietf.org; Wed, 20 Apr 2005 11:41:52 -0400 Received: from plmlir2.mail.eds.com (plmlir2-2.mail.eds.com [199.228.142.132]) by plmler6.mail.eds.com (8.13.2/8.12.10) with ESMTP id j3KFU3df019349; Wed, 20 Apr 2005 10:30:03 -0500 Received: from plmlir2.mail.eds.com (localhost [127.0.0.1]) by plmlir2.mail.eds.com (8.13.2/8.12.10) with ESMTP id j3KFTNvb030667; Wed, 20 Apr 2005 10:29:23 -0500 Received: from usut001.3com.com ([205.142.126.149]) by plmlir2.mail.eds.com (8.13.2/8.12.10) with ESMTP id j3KFTMFZ030662; Wed, 20 Apr 2005 10:29:22 -0500 In-Reply-To: To: Wayne.Davies@mmv.vic.gov.au MIME-Version: 1.0 X-Mailer: Lotus Notes Release 6.5.2 June 01, 2004 Message-ID: Date: Wed, 20 Apr 2005 11:35:13 -0400 X-MIMETrack: Serialize by Router on USUT001/US/3Com(Release 6.0.3|September 26, 2003) at 04/20/2005 08:30:14 AM, Serialize complete at 04/20/2005 08:30:14 AM X-Spam-Score: 1.1 (+) X-Scan-Signature: 3643ee1fccf5d6cf2af25f27d28abb29 Cc: sip@ietf.org, sip-implementors@cs.columbia.edu Subject: [Sip] Re: [Sip-implementors] UAC behaviour X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============0098025208==" Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org This is a multipart message in MIME format. --===============0098025208== Content-Type: multipart/alternative; boundary="=_alternative 005509A485256FE9_=" This is a multipart message in MIME format. --=_alternative 005509A485256FE9_= Content-Type: text/plain; charset="US-ASCII" Consider the following prepaid card application scenario:: Assuming party A and B are talking and following steps occur: i) Party B hung up. ii) B2BUA end the dialog with user B and connect user A to media server using REINVITE asking for another number. iii) After A presses the digits, B2BUA initiates a new dialog for user C iv) When party C is ringing, B2BUA sends 180 Ringing to agent A. User A B2BUA User B Media Server | |(1) BYE | | | |<------------------| | | |(2) 200 | | | |------------------>| | | | | | | | | | |(3) INV no SDP | | | |<------------------| | | |(4) 200 offer2 | | | |------------------>| | | | |(5) INV offer2 | | | |-------------------------------------->| | |(6) 200 answer2 | | | |<--------------------------------------| |(7) ACK answer2 | | | |<------------------| | | | |(8) ACK | | | |-------------------------------------->| |(9) RTP | | | | (Connected to media server, user A dials digits) | |...........................................................| | |(10) BYE | | | |-------------------------------------->| | |(11) 200 OK | | | |<--------------------------------------| | |(12) INV no SDP | User C | | |-------------------|-------->| | | | (13) 180 Ringing | | | | (14)180 Ringing?? |<------------------|---------| | |<------------------| | | | | |(15) 200 offer3 | | | | |<------------------|---------| | |(16) INV offer3' | | | | |<------------------| | | | |(17) 200 answer3' | | | | |------------------>| | | | | |(18) ACK answer3' | | | | |-------------------|-------->| | |(19) ACK | | | | |<------------------| | | | |(20) RTP | | | | |.......................................|.........| | My question is what will happend for message F14. Use agent A invite and reinvite transactions are already completed and the dialog is in cofirmed state. However as per application, the behaviour should be like calling party A is now initiating the call to user C and A should hear the ringback. So if it receives provisional response, what should be the behaviour, is it mentioned somewhere in RFC? -Udit Wayne.Davies@mmv.vic.gov.au 04/20/2005 02:23 AM To Udit Goyal/C/US/3Com@3Com cc sip-implementors@cs.columbia.edu, sip-implementors-bounces@cs.columbia.edu Subject Re: [Sip-implementors] UAC behaviour Udit, Please excuse my ignorance but can you explain / point me to the draft RFC that covers how this works ?. If you finish the initial A to B call, either party hanging up sends a BYE - the session and dialog will end OR did the initial call setup with pre-paid verification created a dialog that exists beyond the A to B call | session (3PCC server is B2BUA or something ?). Assuming the scenario is valid a UAS can respond with a 180 and I would expect that it could be used to quench INVITE retransmissions and trigger local ringback. BUT.. In the scenario you describe below using 3PCC A is being INVITEd to setup up the new call leg between A and C, so it is the UAS for this request. So, it will be be doing the responses - 1xx, 200 OK and therefore it wont receive a 180 ringing at all for the effect you were looking for. Regards - Wayne. Udit asked: ********************************* >I want to know what should be the behaviour of UAC after receiving 180 >response when dialog is already in confirmed state. >I think it should process it, is this behaviour mentioned anywhere in RFC? > > >This scenario can occur in prepaid calling card application where user A >first calls B, and after finsihing talking, he calls another user C on the >same call. >To connect user C, we can send Re-invite to user A agent resulting in call >connected between A and C as per thirdparty call control. > >But before the call is answered by user C, if 180 Ringing is send to user >agent A, it should play ringback as user need to hear the ringback to know >the status of the second call. > >-Udit _______________________________________________ Sip-implementors mailing list Sip-implementors@cs.columbia.edu http://lists.cs.columbia.edu/mailman/listinfo/sip-implementors ********************************************************************** Any personal or sensitive information contained in this email and attachments must be handled in accordance with the Victorian Information Privacy Act 2000, the Health Records Act 2001 or the Privacy Act 1988 (Commonwealth), as applicable. This email, including all attachments, is confidential. If you are not the intended recipient, you must not disclose, distribute, copy or use the information contained in this email or attachments. Any confidentiality or privilege is not waived or lost because this email has been sent to you in error. If you have received it in error, please let us know by reply email, delete it from your system and destroy any copies. ********************************************************************** --=_alternative 005509A485256FE9_= Content-Type: text/html; charset="US-ASCII"
Consider the following prepaid card application scenario::

Assuming party A and B are talking and following steps occur:
i)   Party B hung up.
ii)  B2BUA end the dialog with user B and connect user A to media server using REINVITE asking for another number.
iii) After A presses the digits, B2BUA initiates a new dialog for user C
iv) When party C is ringing,  B2BUA sends 180 Ringing to agent A.


    User A              B2BUA               User B         Media Server
      |                   |(1) BYE            |                   |
      |                   |<------------------|                   |
      |                   |(2) 200            |                   |
      |                   |------------------>|                   |
      |                   |                   |                   |
      |                   |                   |                   |
      |(3) INV no SDP     |                   |                   |
      |<------------------|                   |                   |
      |(4) 200 offer2     |                   |                   |
      |------------------>|                   |                   |
      |                   |(5) INV offer2     |                   |
      |                   |-------------------------------------->|
      |                   |(6) 200 answer2    |                   |
      |                   |<--------------------------------------|
      |(7) ACK answer2    |                   |                   |
      |<------------------|                   |                   |
      |                   |(8) ACK            |                   |
      |                   |-------------------------------------->|
      |(9) RTP            |                   |                   |
      | (Connected to media server, user A dials digits)          |
      |...........................................................|
      |                   |(10) BYE           |                   |
      |                   |-------------------------------------->|
      |                   |(11) 200 OK        |                   |
      |                   |<--------------------------------------|
      |                   |(12) INV no SDP    |       User C      |
      |                   |-------------------|-------->|         |
      |                   | (13) 180 Ringing  |         |         |
      | (14)180 Ringing?? |<------------------|---------|         |
      |<------------------|                   |         |         |
      |                   |(15) 200 offer3    |         |         |
      |                   |<------------------|---------|         |
      |(16) INV offer3'   |                   |         |         |
      |<------------------|                   |         |         |
      |(17) 200 answer3'  |                   |         |         |
      |------------------>|                   |         |         |
      |                   |(18) ACK answer3'  |         |         |
      |                   |-------------------|-------->|         |
      |(19) ACK           |                   |         |         |
      |<------------------|                   |         |         |
      |(20) RTP           |                   |         |         |
      |.......................................|.........|         |


My question is what will happend for message F14.
Use agent A invite and reinvite transactions are already completed and the dialog is in cofirmed state. However as per application, the behaviour should be like calling party A is now initiating the call to user C and A should hear the ringback.

So if it receives provisional response, what should be the behaviour, is it mentioned somewhere in RFC?

-Udit



Wayne.Davies@mmv.vic.gov.au

04/20/2005 02:23 AM

To
Udit Goyal/C/US/3Com@3Com
cc
sip-implementors@cs.columbia.edu, sip-implementors-bounces@cs.columbia.edu
Subject
Re: [Sip-implementors] UAC behaviour









Udit,
Please excuse my ignorance but can you explain / point me to the

draft RFC that covers how this works ?. If you finish the initial A to B
call, either party hanging up sends a BYE - the session and dialog will end
OR did the initial call setup with pre-paid verification created a dialog
that exists beyond the A to B call | session (3PCC server is B2BUA or
something ?).

Assuming the scenario is valid a UAS can respond with a 180 and I
would expect that it could be used to quench INVITE retransmissions and
trigger local ringback.

BUT..

In the scenario you describe below using 3PCC A is being INVITEd to
setup up the new call leg between A and C, so it is the UAS for this
request. So, it will be be doing the responses - 1xx, 200 OK and therefore
it wont receive a 180 ringing at all for the effect you were looking for.

Regards - Wayne.

Udit asked:
*********************************

>I want to know what should be the behaviour of UAC after receiving 180
>response when dialog is already in confirmed state.
>I think it should process it, is this behaviour mentioned anywhere in RFC?
>
>
>This scenario can occur in prepaid calling card application where user A
>first calls B, and after finsihing talking, he calls another user C on the

>same call.
>To connect user C, we can send Re-invite to user A agent resulting in call

>connected between A and C as per thirdparty call control.
>
>But before the call is answered by user C, if 180 Ringing is send to user
>agent A, it should play ringback as user need to hear the ringback to know

>the status of the second call.
>
>-Udit
_______________________________________________
Sip-implementors mailing list
Sip-implementors@cs.columbia.edu
http://lists.cs.columbia.edu/mailman/listinfo/sip-implementors



**********************************************************************
Any personal or sensitive information contained in this email and
attachments must be handled in accordance with the Victorian Information
Privacy Act 2000, the Health Records Act 2001 or the Privacy Act 1988
(Commonwealth), as applicable.

This email, including all attachments, is confidential.  If you are not the
intended recipient, you must not disclose, distribute, copy or use the
information contained in this email or attachments.  Any confidentiality or
privilege is not waived or lost because this email has been sent to you in
error.  If you have received it in error, please let us know by reply
email, delete it from your system and destroy any copies.
**********************************************************************


--=_alternative 005509A485256FE9_=-- --===============0098025208== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip --===============0098025208==-- From sip-bounces@ietf.org Wed Apr 20 12:07:34 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DOHjh-00049V-Vj; Wed, 20 Apr 2005 12:07:34 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DOHje-00049N-H1 for sip@megatron.ietf.org; Wed, 20 Apr 2005 12:07:31 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA22988 for ; Wed, 20 Apr 2005 12:07:28 -0400 (EDT) From: Udit_Goyal@3com.com Received: from plmler2.mail.eds.com ([199.228.142.72]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DOHus-0007dd-JI for sip@ietf.org; Wed, 20 Apr 2005 12:19:08 -0400 Received: from plmlir3.mail.eds.com (plmlir3-2.mail.eds.com [199.228.142.133]) by plmler2.mail.eds.com (8.13.2/8.12.10) with ESMTP id j3KG76j2019107; Wed, 20 Apr 2005 11:07:07 -0500 Received: from plmlir3.mail.eds.com (localhost [127.0.0.1]) by plmlir3.mail.eds.com (8.13.2/8.12.10) with ESMTP id j3KG6RHU007579; Wed, 20 Apr 2005 11:06:27 -0500 Received: from usut001.3com.com ([205.142.126.149]) by plmlir3.mail.eds.com (8.13.2/8.12.10) with ESMTP id j3KG6Ql3007553; Wed, 20 Apr 2005 11:06:26 -0500 To: "SIP Implementors" , "SIP IETF" MIME-Version: 1.0 X-Mailer: Lotus Notes Release 6.5.2 June 01, 2004 Message-ID: Date: Wed, 20 Apr 2005 12:12:16 -0400 X-MIMETrack: Serialize by Router on USUT001/US/3Com(Release 6.0.3|September 26, 2003) at 04/20/2005 09:07:22 AM, Serialize complete at 04/20/2005 09:07:22 AM X-Spam-Score: 0.8 (/) X-Scan-Signature: 93b4f10b2112e1468b61e19ea6180478 Cc: Subject: [Sip] Multiple 2xx responses X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============0011712976==" Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org This is a multipart message in MIME format. --===============0011712976== Content-Type: multipart/alternative; boundary="=_alternative 00586DE685256FE9_=" This is a multipart message in MIME format. --=_alternative 00586DE685256FE9_= Content-Type: text/plain; charset="US-ASCII" I have a question in the below sceanrio in Service-examples draft, What will be the behaviour of Alice user agent on receiving messages F5, F10 and F13. These responses have same Via branch parameter but different To tag hence it will result in different dialog creation. How will UA deal with these dialogs? And if multiple dialogs are created, then will the first dialog created by F5 terminate after timeout? 2.8 Call Forwarding - No Answer Alice Proxy User B1 User B2 | | | | | INVITE F1 | | | |--------------->| INVITE F2 | | |(100 Trying) F3 |------------->| | |<---------------|180 Ringing F4| | | 180 Ringing F5 |<-------------| | |<---------------| | | | Request Timeout | | | | | | | CANCEL F6 | | | |------------->| | | | 200 OK F7 | | | |<-------------| | | | 487 F8 | | | |<-------------| | | | ACK F9 | | | |------------->| | |(181 Call is Being Forwarded) F10 | |<---------------| | INVITE F11 | | |--------------------------------->| | | | 180 Ringing F12 | | 180 Ringing F13|<---------------------------------| |<---------------| | 200 OK F14 | | |<---------------------------------| | 200 OK F15 | | | |<---------------| | | | ACK F16 | | | |--------------->| | ACK F17 | | |--------------------------------->| | Both way RTP Established | |<=================================================>| | BYE F18 | | | |--------------->| | BYE F19 | | |--------------------------------->| | | | 200 OK F20 | | 200 OK F21 |<---------------------------------| |<---------------| | | | | | | F5 180 Ringing Proxy -> Alice SIP/2.0 180 Ringing Via: SIP/2.0/TLS client.atlanta.example.com:5061;branch=z9hG4bK74bf9 ;received=192.0.2.103 Record-Route: From: Alice ;tag=1234567 To: Bob ;tag=3145678 Call-ID: 12345600@atlanta.example.com CSeq: 1 INVITE Contact: Content-Length: 0 F10 (181 Call is Being Forwarded) Proxy -> Alice SIP/2.0 181 Call is Being Forwarded Via: SIP/2.0/TLS client.atlanta.example.com:5061;branch=z9hG4bK74bf9 ;received=192.0.2.103 From: Alice ;tag=1234567 To: Bob Call-ID: 12345600@atlanta.example.com CSeq: 1 INVITE Content-Length: 0 F13 180 Proxy -> Alice SIP/2.0 180 Ringing Via: SIP/2.0/TLS client.atlanta.example.com:5061;branch=z9hG4bK74bf9 ;received=192.0.2.103 Record-Route: From: Alice ;tag=1234567 To: Bob ;tag=765432 Call-ID: 12345600@atlanta.example.com CSeq: 1 INVITE Contact: Content-Length: 0 Regards, Udit --=_alternative 00586DE685256FE9_= Content-Type: text/html; charset="US-ASCII"
I have a question in the below sceanrio in Service-examples draft,
What will be the behaviour of Alice user agent on receiving messages F5, F10 and F13.

These responses have same Via branch parameter but different To tag hence it will result in different dialog creation. How will UA deal with these dialogs? And if multiple dialogs are created, then will the first dialog created by F5 terminate after timeout?

2.8  Call Forwarding - No Answer

           Alice            Proxy         User B1             User B2
             |                |              |                   |
             |    INVITE F1   |              |                   |
             |--------------->|   INVITE F2  |                   |
             |(100 Trying) F3 |------------->|                   |
             |<---------------|180 Ringing F4|                   |
             | 180 Ringing F5 |<-------------|                   |
             |<---------------|              |                   |
             |                 Request Timeout                   |
             |                |              |                   |
             |                |   CANCEL F6  |                   |
             |                |------------->|                   |
             |                |   200 OK F7  |                   |
             |                |<-------------|                   |
             |                |     487 F8   |                   |
             |                |<-------------|                   |
             |                |     ACK F9   |                   |
             |                |------------->|                   |
             |(181 Call is Being Forwarded) F10                  |
             |<---------------|              |    INVITE F11     |
             |                |--------------------------------->|
             |                |              | 180 Ringing F12   |
             | 180 Ringing F13|<---------------------------------|
             |<---------------|              |      200 OK F14   |
             |                |<---------------------------------|
             |   200 OK F15   |              |                   |
             |<---------------|              |                   |
             |     ACK F16    |              |                   |
             |--------------->|              |     ACK F17       |
             |                |--------------------------------->|
             |               Both way RTP Established            |
             |<=================================================>|
             |    BYE F18     |              |                   |
             |--------------->|              |      BYE F19      |
             |                |--------------------------------->|
             |                |              |    200 OK F20     |
             |  200 OK F21    |<---------------------------------|
             |<---------------|              |                   |
             |                |              |                   |


 F5 180 Ringing Proxy -> Alice

      SIP/2.0 180 Ringing
      Via: SIP/2.0/TLS client.atlanta.example.com:5061;branch=z9hG4bK74bf9
       ;received=192.0.2.103
      Record-Route: <sips:ss1.example.com;lr>
      From: Alice <sips:alice@atlanta.example.com>;tag=1234567
      To: Bob <sips:bob@biloxi.example.com>;tag=3145678
      Call-ID: 12345600@atlanta.example.com
      CSeq: 1 INVITE
      Contact: <sips:bob@client.biloxi.example.com>
      Content-Length: 0

F10 (181 Call is Being Forwarded) Proxy -> Alice  
      SIP/2.0 181 Call is Being Forwarded
      Via: SIP/2.0/TLS client.atlanta.example.com:5061;branch=z9hG4bK74bf9
      ;received=192.0.2.103
      From: Alice <sips:alice@atlanta.example.com>;tag=1234567
      To: Bob <sips:bob@biloxi.example.com>
      Call-ID: 12345600@atlanta.example.com
      CSeq: 1 INVITE
      Content-Length: 0

F13 180 Proxy -> Alice
      SIP/2.0 180 Ringing
      Via: SIP/2.0/TLS client.atlanta.example.com:5061;branch=z9hG4bK74bf9
       ;received=192.0.2.103
      Record-Route: <sips:ss1.example.com;lr>
      From: Alice <sips:alice@atlanta.example.com>;tag=1234567
      To: Bob <sips:bob@biloxi.example.com>;tag=765432
      Call-ID: 12345600@atlanta.example.com
      CSeq: 1 INVITE
      Contact: <sips:bob@client2.biloxi.example.com>
      Content-Length: 0


Regards,
Udit --=_alternative 00586DE685256FE9_=-- --===============0011712976== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip --===============0011712976==-- From sip-bounces@ietf.org Wed Apr 20 13:27:08 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DOIyi-0000Ad-P7; Wed, 20 Apr 2005 13:27:08 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DOIyd-0000AU-Hk for sip@megatron.ietf.org; Wed, 20 Apr 2005 13:27:06 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA29801 for ; Wed, 20 Apr 2005 13:27:00 -0400 (EDT) Received: from oak.neustar.com ([209.173.53.70]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DOJ9s-00021Q-Rs for sip@ietf.org; Wed, 20 Apr 2005 13:38:42 -0400 Received: from stntsmtp1.cis.neustar.com (smartexch.neustar.com [10.31.13.79]) by oak.neustar.com (8.12.8/8.11.0) with ESMTP id j3KHQpKD008953; Wed, 20 Apr 2005 17:26:52 GMT Received: from stntexch03.cis.neustar.com ([10.31.13.45]) by stntsmtp1.cis.neustar.com with Microsoft SMTPSVC(6.0.3790.211); Wed, 20 Apr 2005 13:26:51 -0400 X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Subject: RE: [Sip] sip-identity-05: display-name woes Date: Wed, 20 Apr 2005 13:26:50 -0400 Message-ID: <24EAE5D4448B9D4592C6D234CBEBD59701502E4B@stntexch03.cis.neustar.com> Thread-Topic: [Sip] sip-identity-05: display-name woes Thread-Index: AcVFLksuzbIU0vPNQe+L2A/6tUrm8QACXdCgABEmSzAAFBaXkA== From: "Peterson, Jon" To: "Stastny Richard" , "Paul Kyzivat" , "Jonathan Rosenberg" X-OriginalArrivalTime: 20 Apr 2005 17:26:51.0383 (UTC) FILETIME=[23A9B070:01C545CE] X-Spam-Score: 0.0 (/) X-Scan-Signature: 0bc60ec82efc80c84b8d02f4b0e4de22 Content-Transfer-Encoding: quoted-printable Cc: sip@ietf.org X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org > I did not quite understand your proposal using ENUM for verification > of name for OUTGOING calls. The only way I could imagine is that a GW > to the PSTN before he inserts a E.164 CLI contained in the INVITE into = > the SS7 signaling to check if a corresponding NAPTR pointing to the > SIP URI contained in the From: Header exists. I have no idea how > truthworthy this is. > > Of course one could enter a pointer to or directly a name in the ENUM > Domain (we did this for fun with a TXT record), but then you would = have the > privacy people again all over the place. I was thinking something along these lines, with a pointer to, say, an = LDAP service rather than just a TXT record. All just speculation, of = course; not suggesting that we propose this for ENUM, just saying that = ENUM could conceivably be leveraged for something like this. If the = gateway needs to do an ENUM lookup on the calling number anyway (to = learn who is authoritative for the calling number, and consequently, who = should be signing the SIP message), it might not even be that much extra = work for the gateway. Jon Peterson NeuStar, Inc. > Regards > Richard _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Wed Apr 20 13:38:02 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DOJ9G-0001fo-BZ; Wed, 20 Apr 2005 13:38:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DOJ9E-0001fD-TO for sip@megatron.ietf.org; Wed, 20 Apr 2005 13:38:01 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA00762 for ; Wed, 20 Apr 2005 13:37:58 -0400 (EDT) Received: from sj-iport-5.cisco.com ([171.68.10.87]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DOJKU-0002Mm-VI for sip@ietf.org; Wed, 20 Apr 2005 13:49:39 -0400 Received: from sj-core-4.cisco.com (171.68.223.138) by sj-iport-5.cisco.com with ESMTP; 20 Apr 2005 10:37:51 -0700 Received: from vtg-um-e2k4.sj21ad.cisco.com (vtg-um-e2k4.cisco.com [171.70.93.57]) by sj-core-4.cisco.com (8.12.10/8.12.6) with ESMTP id j3KHbmpR005563; Wed, 20 Apr 2005 10:37:49 -0700 (PDT) Received: from [127.0.0.1] ([171.68.225.134]) by vtg-um-e2k4.sj21ad.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Wed, 20 Apr 2005 10:38:44 -0700 User-Agent: Microsoft-Entourage/11.1.0.040913 Date: Wed, 20 Apr 2005 10:37:48 -0700 Subject: Re: [Sip] RE: Question to Identity draft From: Cullen Jennings To: Fries Steffen , Jon Peterson Message-ID: In-Reply-To: Mime-version: 1.0 Content-type: text/plain; charset="US-ASCII" Content-transfer-encoding: 7bit X-OriginalArrivalTime: 20 Apr 2005 17:38:44.0383 (UTC) FILETIME=[CCA4DAF0:01C545CF] X-Spam-Score: 1.9 (+) X-Scan-Signature: 249cd1efd3d5e0d09114abe826a41235 Content-Transfer-Encoding: 7bit Cc: "sip@ietf.org" X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org I'm lost on why and how you would use a device certificate to be a user certificate. When a user logged off the phone would you revoke the device certificate? It just all sounds very convoluted. I more or less view a user certificate as something that binds a user to a private key. What it sounds like you are doing here is binding a private key that is specific to the device to the user. On 4/20/05 1:05 AM, "Fries Steffen" wrote: > Agreed. > What I had in mind was more that Alice from example.com uses a cert issued > for > 00342506@mysip.example.com, which may be a self-signed certificate or come > from > a corporate CA, which has not public available root certificate. In this > case the > authentication service asserts the FROM field and the cert (in the body) may > be > used within the dialog. > > @Jon, I dont think this approach obviates the authentication service at all. > On > the contrary, the authentication service MUST assert the identity at the > beginning > of the session, and the receiver is able to keep this assertion together > with the > certificate received in the asserted message. The authentication service may > be > then left out of the path for the rest of the session, when not needed or > may be > invoked for further assertions. From my point of view this would be worth > mentioning it as an example in the identity ID. > > Regarding the cert service, this service is extermely useful, especially for > the > approach of storing credentials. But there may be scenarios, were the usage > may be > simplyfied by using just the authentication service. For instance in cases > were the > user has no certificate at all but the used device has one assigned (I used > that > example at the beginning of this discussion too). The certificate may have > no meaning > outside an enterprise but using the authentication service provides the > meaning for the > receiver, at least for the duration of the session. The worst case here > would be that > the caller uses a different phone for each call. Well, it might not be very > likely, > but it may be the worst case. Using a cert service here would mean, that I > would > have to propagate my certificate information each time I change the device. > The > certificate server would use the authentication server to assert the FROM > field > and provide integrity protection for the body when sending a NOTIFY. In > those scenarios, > the user may also sent the certificate information inline via an > authentication service > and thus save additional communication with the cert server. Another > scenario may be > the case were the cert server is not reachable by every receiver of a call. > > Regards > Steffen > > > >> -----Original Message----- >> From: Cullen Jennings [mailto:fluffy@cisco.com] >> Sent: Tuesday, April 19, 2005 10:30 PM >> To: Fries Steffen >> Cc: sip@ietf.org; Jon Peterson >> Subject: Re: [Sip] RE: Question to Identity draft >> Importance: High >> >> >> Agreeing with Jon here and want to point out a critical thing >> about the certificates. For the AOR alice@example.com, the >> certificate in a body would most likely be for the user >> alice@example.com while the certificate used for identity is >> for the domain example.com. You can't use a certificate for a >> user, like alice@example.com to assert identity using the >> identity draft mechanism. >> >> Cullen >> >> >> On 4/19/05 11:55 AM, "Peterson, Jon" wrote: >> >>> >>> I do agree that sip-identity provides body integrity, and as such, >>> that it could be used to provide integrity protection for a >>> self-signed certificate in the body of a SIP message, and >> furthermore, >>> that such a self-signed certificate could be used in subsequently >>> messages to provide confidentiality services for SIP >> message bodies in >>> order to encrypt symmetric keys used for SRTP. >>> >>> I have reservations when we start describing the use of that >>> self-signed certificate to provide integrity services for >> subsequent >>> requests, thereby obviating the need to use an authentication >>> services. I furthermore think that sipping-certs provides a >> better way >>> to discover certificates for confidentiality than this >> method of tunneling certificates in SIP requests. >>> >>> That much said, I would not rule out tunneling self-signed >>> certificates in this fashion, no. >>> >>> Jon Peterson >>> NeuStar, Inc. >>> >>>> -----Original Message----- >>>> From: Fries Steffen [mailto:steffen.fries@siemens.com] >>>> Sent: Thursday, April 14, 2005 7:48 AM >>>> To: Peterson, Jon; fluffy@cisco.com >>>> Cc: IETF SIP List >>>> Subject: RE: [Sip] RE: Question to Identity draft >>>> >>>> >>>> Hi Jon, >>>> >>>> I'm still not sure what the answer to the scenarios is. >>>> >>>> Do you see the option with the identity draft to assert a >> FROM field >>>> of a SIP message and also an embedded certificate in the body and >>>> thus have a security context for that dialog. The >> security context >>>> may be used on subsequent messages (e.g., to negotiate media >>>> encryption), which do not need to be sent via the >> authentication service? >>>> >>>> Regards >>>> Steffen >>>> >>>> >>>>> -----Original Message----- >>>>> From: sip-bounces@ietf.org [mailto:sip-bounces@ietf.org] >> On Behalf >>>>> Of Fries Steffen >>>>> Sent: Thursday, April 07, 2005 4:56 PM >>>>> To: Peterson, Jon; fluffy@cisco.com >>>>> Cc: IETF SIP List >>>>> Subject: [Sip] RE: Question to Identity draft >>>>> Importance: High >>>>> >>>>> Hi Jon, >>>>> >>>>>>> [stf] yes, RFC3261 talks about certificate exchhange. But >>>>>> here it is >>>>>>> only possible to take certificates, which are (more or >>>>>> less) bound to a person. >>>>>>> Assume that you use certificates, which are bound to the >>>>>> host used for >>>>>>> phone calls. Then you would need some instance assuring, >>>>> that this >>>>>>> certificate is connected with the registration under some AOR. >>>>>>> >>>>>>> What I had in mind is an inband certificate exchange from, >>>>>> e.g., self >>>>>>> signed certificates, were the authentication services basically >>>>>>> assures that the message (and thus the certificate) came >>>>>> from a person >>>>>>> registered under a certain AOR. >>>>>> >>>>>> RFC3261 does in fact describe the self-signed certificate case. >>>>> [stf] Okay, I put it in a wrong way, I meant the certificate must >>>>> follow some dedicated syntax, connected with the domain you are >>>>> registering in. >>>>> When you have something like device certificates, which >> are issued >>>>> by a corporate CA on the base of machine names, these >> certificates >>>>> may be used in SIP scenarios. After successful registering, the >>>>> Proxy knows, that a user, who authenticated himself using digest >>>>> authentication over a TLS link that he uses the dedicated device >>>>> certificate for the duration of his registration for security >>>>> purposes. That means next time he registers, his identity may be >>>>> connected with a different certificate, as he may use a different >>>>> phone. Sure, the user could publish the certificate to a cert >>>>> server, as described in the certs draft, but I was >> thinking of some >>>>> kind of "inband provisioning" for such a scenario. >>>>> >>>>>> >>>>>>> The certificate itself may then be used for end-to-end >>>> integrity >>>>>>> services. >>>>>> >>>>>> In what respect would using this certificates for an end-to-end >>>>>> integrity service be superior to just using >>>>>> sip-identity-04 for integrity? Note that that strength of a >>>>>> self-signed credential is necessarily equivalent to the >>>> strength of >>>>>> the security mechanism used to deliver that self-signed >>>>> credential to >>>>>> potential users. So, if >>>>>> sip-identity-04 is used to secure the cert, it isn't >>>> clear how the >>>>>> cert provides a stronger or more attractive assurance than >>>>>> sip-identity-04 itself would provide. >>>>> [stf]Using the certificate would require to send just one message >>>>> over the authentication service and use the supplied >> certificate for >>>>> the rest of the communication. >>>>> >>>>> >>>>>>> A usage example would be the key management for SRTP using >>>>>> MIKEY, were >>>>>>> one option is the usage of certificates. When here a >>>>> certificate is >>>>>>> used, which is completely unknown to the receiver, then >>>>> there is no >>>>>>> real value. But when a trusted component (the >>>>>> authentication service) >>>>>>> assures, that a person registered with a dedicated AOR is >>>>> connected >>>>>>> with this certificate, then it gets a meaning. It would >>>> basically >>>>>>> provide the assurance, that for the time I am in the call, >>>>>> I am using >>>>>>> this certificate, which may be sufficient. >>>>>> >>>>>> No question that using sip-identity-04 would guarantee the >>>>> integrity >>>>>> of the certificate contained in a SIP message body. >>>>>> But why not have sip-identity-04 secure the SDP body >>>> containing the >>>>>> keymgmt attribute for MIKEY, rather than going through a >>>>> certificate >>>>>> exchange phase in order to subsequently use the a cert >>>>> (whose strength >>>>>> is equivalent to >>>>>> sip-identity-04) to secure the SDP body containing the >>>> keymgmt? In >>>>>> what respect is this not a redundant step? >>>>> [stf] as stated above, the authentication server would only be >>>>> needed for one message, to support the establishment of a session >>>>> security context. The other thing is that for the key >> management for >>>>> SRTP the client itself needs to include the appropriate >> message body >>>>> for MIKEY, as the MIKEY container is protected. The same would be >>>>> true in scenarios were S/MIME would be required to protect >>>>> sdescriptions. >>>>> >>>>> >>>>> Regards >>>>> Steffen >>>>> >>>>>> >>>>>> Jon Peterson >>>>>> NeuStar, Inc. >>>>>> >>>>>>> Regards >>>>>>> Steffen >>>>>>> >>>>>>> >>>>>> >>>>> >>>>> _______________________________________________ >>>>> Sip mailing list https://www1.ietf.org/mailman/listinfo/sip >>>>> This list is for NEW development of the core SIP Protocol Use >>>>> sip-implementors@cs.columbia.edu for questions on current sip Use >>>>> sipping@ietf.org for new developments on the application of sip >>>>> >>>> >> _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Wed Apr 20 14:56:52 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DOKNY-0004Y1-Nj; Wed, 20 Apr 2005 14:56:52 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DOKNX-0004Xw-Ph for sip@megatron.ietf.org; Wed, 20 Apr 2005 14:56:52 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA07640 for ; Wed, 20 Apr 2005 14:56:50 -0400 (EDT) Received: from sj-iport-3-in.cisco.com ([171.71.176.72] helo=sj-iport-3.cisco.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DOKYn-00054n-Qm for sip@ietf.org; Wed, 20 Apr 2005 15:08:31 -0400 Received: from sj-core-5.cisco.com (171.71.177.238) by sj-iport-3.cisco.com with ESMTP; 20 Apr 2005 11:53:05 -0700 X-IronPort-AV: i="3.92,117,1112598000"; d="asc'?scan'208"; a="252373127:sNHT1616110318" Received: from imail.cisco.com (imail.cisco.com [128.107.200.91]) by sj-core-5.cisco.com (8.12.10/8.12.6) with ESMTP id j3KIr2hu024268; Wed, 20 Apr 2005 11:53:03 -0700 (PDT) Received: from thomasm-lnx.cisco.com (thomasm-lnx.cisco.com [171.71.96.50]) by imail.cisco.com (8.12.11/8.12.10) with ESMTP id j3KIi42x001917; Wed, 20 Apr 2005 11:44:04 -0700 Subject: Re: [Sip] RE: Question to Identity draft From: Michael Thomas To: Cullen Jennings In-Reply-To: References: Organization: Cisco Systems Message-Id: <1114023181.5648.6.camel@thomasm-lnx.cisco.com> Mime-Version: 1.0 X-Mailer: Ximian Evolution 1.4.6 Date: Wed, 20 Apr 2005 11:53:02 -0700 IIM-SIG: v:"1.1"; h:"imail.cisco.com"; d:"cisco.com"; z:"home"; m:"krs"; t:"1114022644.337966"; x:"432200"; a:"rsa-sha1"; b:"nofws:1118"; e:"Iw=="; n:"sQYarK2E51MdcTiUqeif3F7cWdxIfoCiXhdfb9vD5ee/j0jXL15gbFxF2p" "XIweAblu0N6XAgK7k+wrbr7bQDJaCDqOmzqpRUBjIRQAXQ7NzadpmR3pUL6wxaRUtW+c43sl9jC" "50Qg1sXHpPjt8Y+Y16ioyQAQAdSunM4YhevURc="; s:"URIGjcpVHVLuTSoR9y/Ej1gAHicXULkHBwSa9htEsuTkiwqvolYlWfQ+MOWIX0LRggGRGFt7" "Lw39ATzEt9TjGxLAluukiSDn/FKxwu0p+T8IMpr6b2ufrpQz/VBj59sdN1+VJn1GsZ0S1F/p0It" "zFWILsJrOVwKJ9gON2qJAjR0="; c:"Subject: Re: [Sip] RE: Question to Identity draft"; c:"From: Michael Thomas "; c:"Date: Wed, 20 Apr 2005 11:53:02 -0700" IIM-VERIFY: s:"y"; v:"y"; r:"60"; h:"imail.cisco.com"; c:"message from imail.cisco.com verified; " X-Spam-Score: 0.0 (/) X-Scan-Signature: 69a74e02bbee44ab4f8eafdbcedd94a1 Cc: "sip@ietf.org" , Jon Peterson , Fries Steffen X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============0695033898==" Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org --===============0695033898== Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="=-NUTQHGaPBRsZN0ai6IcX" --=-NUTQHGaPBRsZN0ai6IcX Content-Type: text/plain Content-Transfer-Encoding: quoted-printable On Tue, 2005-04-19 at 13:30, Cullen Jennings wrote: > You can't use a certificate for a > user, like alice@example.com to assert identity using the identity draft > mechanism.=20 That strikes me as a bug rather than a feature. What if I have outsourced functions where I only want to delegate a certain subset of sip URI's to them? Oh say, like=20 outsource@example.com that's really some other company? That is, I want them to be able to assert outsource@example.com, but nothing else. Or suppose that alice@example.com is the CEO and she wants to be able to call from her device on the road when she's not behind the example.com corporate=20 proxies? Why can't she just sign the identity herself... she's the CEO, right? Mike --=-NUTQHGaPBRsZN0ai6IcX Content-Type: application/pgp-signature; name=signature.asc Content-Description: This is a digitally signed message part -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.3 (GNU/Linux) iQCVAwUAQmalDbMsDAj/Eq++AQIsqAQAqho/M7042Gpl1kXUfo8xlLx9F9V2YAW7 DeeZRr8HM83jVwCP26VRdQ5AGPOfbEi/LvqJ4D4eKui2vbg9S+V1s1c7MEKG9aey 3Pdso1Kpl3QSLMudkOcPkKgW2rOR/2zhzTJBPLqZlKTndVMR1pPkRFwU+iKGlSav 21NfRpxs9uM= =jCWi -----END PGP SIGNATURE----- --=-NUTQHGaPBRsZN0ai6IcX-- --===============0695033898== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip --===============0695033898==-- From sip-bounces@ietf.org Wed Apr 20 15:40:15 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DOL3X-0000oF-PH; Wed, 20 Apr 2005 15:40:15 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DOL3V-0000oA-RQ for sip@megatron.ietf.org; Wed, 20 Apr 2005 15:40:13 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA11772 for ; Wed, 20 Apr 2005 15:40:12 -0400 (EDT) Received: from ind-iport-1.cisco.com ([64.104.129.195]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DOLEm-00063O-6S for sip@ietf.org; Wed, 20 Apr 2005 15:51:53 -0400 Received: from india-core-1.cisco.com (64.104.129.221) by ind-iport-1.cisco.com with ESMTP; 21 Apr 2005 01:18:45 +0530 X-BrightmailFiltered: true X-Brightmail-Tracker: AAAAAA== X-IronPort-AV: i="3.92,117,1112553000"; d="asc'?scan'208"; a="30596804:sNHT38974220" Received: from imail.cisco.com (imail.cisco.com [128.107.200.91]) by india-core-1.cisco.com (8.12.10/8.12.6) with ESMTP id j3L18jlx011582; Thu, 21 Apr 2005 01:08:47 GMT Received: from thomasm-lnx.cisco.com (thomasm-lnx.cisco.com [171.71.96.50]) by imail.cisco.com (8.12.11/8.12.10) with ESMTP id j3KJUqmZ002447; Wed, 20 Apr 2005 12:30:52 -0700 Subject: Re: [Sip] sip-identity-05: display-name woes From: Michael Thomas To: Jonathan Rosenberg In-Reply-To: <42651601.4010201@cisco.com> References: <200504071336.JAA22655@ietf.org> <3efd5821d4f6d32e012641d801877321@telio.no> <1113862167.32605.20.camel@thomasm-lnx.cisco.com> <426439CC.2000704@cisco.com> <42651601.4010201@cisco.com> Organization: Cisco Systems Message-Id: <1114025990.5648.16.camel@thomasm-lnx.cisco.com> Mime-Version: 1.0 X-Mailer: Ximian Evolution 1.4.6 Date: Wed, 20 Apr 2005 12:39:50 -0700 IIM-SIG: v:"1.1"; h:"imail.cisco.com"; d:"cisco.com"; z:"home"; m:"krs"; t:"1114025452.900210"; x:"432200"; a:"rsa-sha1"; b:"nofws:641"; e:"Iw=="; n:"sQYarK2E51MdcTiUqeif3F7cWdxIfoCiXhdfb9vD5ee/j0jXL15gbFxF2p" "XIweAblu0N6XAgK7k+wrbr7bQDJaCDqOmzqpRUBjIRQAXQ7NzadpmR3pUL6wxaRUtW+c43sl9jC" "50Qg1sXHpPjt8Y+Y16ioyQAQAdSunM4YhevURc="; s:"c2GXQjXQxuWxTHKQAKBkGR+PhpxYVuCf0UmpD19s/SveopVTW63OxFyAFLdANBULuzEL/U8C" "CEOC9JTIPj6XemrTwy42jWoyfhCo09UwACjgTgfyj06r0NVWgC7tlQJe4arQXcEyRjRHGl67tOu" "6Qg+dE+9F1pMqRclNlxqUV7s="; c:"Subject: Re: [Sip] sip-identity-05: display-name woes"; c:"From: Michael Thomas "; c:"Date: Wed, 20 Apr 2005 12:39:50 -0700" IIM-VERIFY: s:"y"; v:"y"; r:"60"; h:"imail.cisco.com"; c:"message from imail.cisco.com verified; " X-Spam-Score: 0.0 (/) X-Scan-Signature: 0bc60ec82efc80c84b8d02f4b0e4de22 Cc: sip@ietf.org, Paul Kyzivat , "'Peterson, Jon'" X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============0096434124==" Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org --===============0096434124== Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="=-QEzFDjkLFbj+atb3o/rF" --=-QEzFDjkLFbj+atb3o/rF Content-Type: text/plain Content-Transfer-Encoding: quoted-printable On Tue, 2005-04-19 at 07:30, Jonathan Rosenberg wrote: > The entity that DOES need to know the [signing] policy is the=20 > caller [UA]. =20 Why?=20 Mike --=-QEzFDjkLFbj+atb3o/rF Content-Type: application/pgp-signature; name=signature.asc Content-Description: This is a digitally signed message part -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.3 (GNU/Linux) iQCVAwUAQmawBrMsDAj/Eq++AQLKYQQAgg8QCpLH/eNQrSKp5ZPz9RaYXwphB3XQ tS/Ce2UMKHN8xtCrmzQF5EUkQsShrXCpQ6LkvXJg6ZVwBh1geBJndROTdjiK19aG TcvWeBj/7vBl9CYd32N52zopAMUN59c2FK+7G5ezgmwTXaqEkRk8mvqGyuToV6Kz /cXn8Eqp7nk= =xInm -----END PGP SIGNATURE----- --=-QEzFDjkLFbj+atb3o/rF-- --===============0096434124== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip --===============0096434124==-- From sip-bounces@ietf.org Wed Apr 20 16:13:17 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DOLZV-0004dk-16; Wed, 20 Apr 2005 16:13:17 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DOLZU-0004df-14 for sip@megatron.ietf.org; Wed, 20 Apr 2005 16:13:16 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA14475 for ; Wed, 20 Apr 2005 16:13:14 -0400 (EDT) Received: from sj-iport-4.cisco.com ([171.68.10.86]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DOLkl-0006wJ-KS for sip@ietf.org; Wed, 20 Apr 2005 16:24:56 -0400 Received: from sj-core-5.cisco.com (171.71.177.238) by sj-iport-4.cisco.com with ESMTP; 20 Apr 2005 13:13:07 -0700 Received: from edison.cisco.com (edison.cisco.com [171.71.180.109]) by sj-core-5.cisco.com (8.12.10/8.12.6) with ESMTP id j3KKD3hu012368; Wed, 20 Apr 2005 13:13:04 -0700 (PDT) Received: from dwingwxp (sjc-vpn7-301.cisco.com [10.21.145.45]) by edison.cisco.com (8.8.6 (PHNE_14041)/CISCO.SERVER.1.2) with ESMTP id NAA09258; Wed, 20 Apr 2005 13:12:58 -0700 (PDT) Message-Id: <200504202012.NAA09258@edison.cisco.com> From: "Dan Wing" To: "'Peterson, Jon'" Subject: RE: [Sip] sip-identity-05: display-name woes Date: Wed, 20 Apr 2005 13:12:36 -0700 MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Office Outlook, Build 11.0.5510 In-Reply-To: <24EAE5D4448B9D4592C6D234CBEBD59701502E48@stntexch03.cis.neustar.com> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1441 Thread-Index: AcVFIiY0w6IWT5RMSNKofMQSvhX3kQAEr30wACSMxkA= X-Spam-Score: 0.0 (/) X-Scan-Signature: b1c41982e167b872076d0018e4e1dc3c Content-Transfer-Encoding: 7bit Cc: sip@ietf.org, 'Paul Kyzivat' , 'Michael Thomas' X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org > > In terms of what to concretely do here, I had Paul's (F) in mind: > > > > (F) If the display name is present but unauthorized, > > decline to sign the > > message. If the display-name is present and authorized, include it. > > Regardless of whether or not the display-name is validated by > the authentication service, I don't think that including the > display-name in the signature actually has any perceptible > effect on the security of the mechanism. What threat does > this protect against? Let's assume for the sake of argument > that an authentication service can and does validate the > display-name, and produces the Identity header per the > current guidelines of sip-identity-04 (thus not including the > display-name). What can an impersonator then do? There's no > question that a man-in-the-middle might change the > display-name after a message is signed by the auth service, > but that isn't an impersonator, that's a man-in-the-middle; > said man-in-the-middle could also change, say, the > Organization, User Agent, Subject, and so on of the request, > since none of those are included in the Identity header. An > impersonator could of course capture the signaling and try to > replay it with a changed display-name; however, there are > other mechanisms provided in sip-identity-04 mechanism that > would detect this replay - it wouldn't work. sip-identity-04 says the replay window is 3600 seconds, so the impersonator need only act within an hour of the original message. As to Call-ID duplication, mentioned in the draft as the other primary replay detection mechanism, an on-path impersonator could ensure his Call-ID is processed first (by starving the network of bandwidth for the original message) which would cause the legitimate message to be deemd the duplicate. This reminds me of RST floods to get access to r-services authenticated systems. I don't see the replay protection as being adequate protection for this threat; the display-name should also be signed. > As such, I don't > think including it in the signed hash actually has any > practical effect. > > If you agree that the "include it" part is actually inert > from a security perspective, then I might propose as a refinement: > > (F') If the display name is present but unauthorized, decline > to sign the message. If the display-name is present and > authorized, sign the message normally (without display-name). > > The difference between this and the mechanism in > sip-identity-04 is that sip-identity-04 says "reject the > message" instead of "decline to sign it". Ultimately, if a > user agent provides a bogus addr-spec, I would expect the > auth service to reject the message, not forward it along. I > can't see why this should be any different for the > display-name, if the domain has a policy about it. That refinement is fine. I do still see a need to sign the display name. -d > > I think there is no need to convey the policies of the > signing domain. > > When I receive a message, its really simple. Whatever is > there in the > > From field, display name or not, is what the domain is > willing to vouch > > for, period. If the display name is absent, a recipient has > no way to > > know whether the caller simply didnt provide one, or > whether the domain > > policy prohibits signing of the display name. I don't think > it really > > matters much. > > I agree with you, but I thought this is where we previously > disagreed, so I am a bit surprised. A domain's policy could > be that any user can register under any AoR without providing > credentials and furthermore claim any From header field value > for outbound requests. If that is their policy, I think it is > reasonable for a domain to generate an Identity header for > any request claiming any AoR in the From header field, since > the request meets the domain's policy. I look at the absence > of a display-name policy as being roughly the same - treat > the absence of policy as if the request meets policy. > > I had thought the issue was that you wanted the verifier to > use the presence of the display-name in the signature as a > hint that the domain actually has a policy. That's what I > found problematic. > > > The entity that DOES need to know the policy is the caller. I would > > propose that the spec require that there is a means for > configuring the > > caller's UA with an indicator of whether the display name > can be signed > > or not, and if so, what the display name for that user is that the > > domain is willing to sign. > > I think that in order for sip-identity-05 to make this > REQUIRED, we would need to have some specification of what > that "indicator" of the appropriate display-name would be > which we could normatively reference. In the absence of > that... I suppose this seems to me like a matter for future work. > > Jon Peterson > NeuStar, Inc. > > > This can then be included verbatim by the > > calling UA in its INVITE. This avoids the case where the > domain won't > > sign display names at all, but the calling UA doesnt know > it, and so > > inserts one only to have its message completely unsigned, > both display > > name and URI. > > > > Thanks, > > Jonathan R. > > > > _______________________________________________ > Sip mailing list https://www1.ietf.org/mailman/listinfo/sip > This list is for NEW development of the core SIP Protocol > Use sip-implementors@cs.columbia.edu for questions on current sip > Use sipping@ietf.org for new developments on the application of sip _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Wed Apr 20 16:29:56 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DOLpb-00074u-WE; Wed, 20 Apr 2005 16:29:56 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DOLpa-000732-JI for sip@megatron.ietf.org; Wed, 20 Apr 2005 16:29:54 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA16441 for ; Wed, 20 Apr 2005 16:29:52 -0400 (EDT) Received: from oak.neustar.com ([209.173.53.70]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DOM0s-0007TK-CP for sip@ietf.org; Wed, 20 Apr 2005 16:41:34 -0400 Received: from stntsmtp1.cis.neustar.com (smartexch.neustar.com [10.31.13.79]) by oak.neustar.com (8.12.8/8.11.0) with ESMTP id j3KKTiKD018664; Wed, 20 Apr 2005 20:29:44 GMT Received: from stntexch03.cis.neustar.com ([10.31.13.45]) by stntsmtp1.cis.neustar.com with Microsoft SMTPSVC(6.0.3790.211); Wed, 20 Apr 2005 16:29:43 -0400 X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Subject: RE: authority for a domain (was RE: [Sip] sip-identity-05:display-name woes) Date: Wed, 20 Apr 2005 16:29:43 -0400 Message-ID: <24EAE5D4448B9D4592C6D234CBEBD59701502E4D@stntexch03.cis.neustar.com> Thread-Topic: authority for a domain (was RE: [Sip] sip-identity-05:display-name woes) Thread-Index: AcVFuD2CXg60oyBXTpyxVXgbSF9uxAAFeqYw From: "Peterson, Jon" To: "Michael Thomas" X-OriginalArrivalTime: 20 Apr 2005 20:29:43.0961 (UTC) FILETIME=[AFD43890:01C545E7] X-Spam-Score: 0.0 (/) X-Scan-Signature: df9edf1223802dd4cf213867a3af6121 Content-Transfer-Encoding: quoted-printable Cc: sip@ietf.org, Francois Audet , Paul Kyzivat X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org I fear that we're talking way past one another, Mike, but I'll try to go = a little farther with this to see if we can find any common ground... =20 > > The draft does assume that if you hold a cert for=20 > example.com (i.e., a CA-signed cert with the subjectAltName=20 > 'example.com'), then you are the legitimate authority for=20 > example.com.=20 >=20 > Authority for _what_? SIP? Prize Rooster trading? All of the > above? If not all of the above, what if I want to use the > same technique for the Prize Rooster Trading Protocol... but > it seems that I can't because SIP got there first[*]. If it is > all of the above, then that's a real problem in the delegation > arena since I don't want my telephony guys having any authority > over who's allowed to trade my Prize Roosters. To answer the question "Authority for what?", let's go back to first = principles, here. If I own a name in the DNS, I am empowered to create = subordinate names. There are four administrative procedures relating to = subordinate names which are salient to this discussion: 1) If I own the name 'example.com', I can create a subordinate name = called 'mail.example.com'.=20 2) I can also run services on the host 'example.com' which have = different accounts, users, or whatever, and for the purposes of those = services, names like 'jon@example.com' might be created.=20 3) I can furthermore run services on a host with a subordinate name, and = the users of that service might be issued names like = 'jon@mail.example.com' 4) Finally, I can mark up the DNS to link services associated with the = name 'example.com' to particular services running on subordinate hosts; = e.g., the MX record linking mail services for 'example.com' to = 'mail.example.com', or the comparable procedures for SIP using NAPTR and = SRV. If I am the owner of 'example.com', I can go get a cert from a CA for = 'example.com'. What that cert signifies, ultimately, is that I am the = administrator of the name 'example.com', and consequently that I am = empowered to create subordinate names per (1) and (2) above. In more = detail, this means that I have administrative authority over the domain. = I may of course delegate authority over subordinate names to someone = else within my organization, or a subcontractor, or what have you. But I = administratively choose the host that 'example.com' points to. If the = people operating that host issue subordinate names (per (2)) in ways = that I don't like, I am empowered to change the host for 'example.com' = to one that behaves as I like, as a matter of last recourse. When I get = a certificate for 'example.com', the enrollment process establishes that = I have administrative authority for 'example.com'. I may then give the = cert and the associated private keying material to someone else to use = in an application, and if they use it in ways I don't like, I have = administrative recourse to give it to someone more responsible. This is = what it means to have administrative control over a domain - you control = how names are allocated, and you have administrative control over the = certficate of that domain. This authority is not specific to any = application - it is authority over the name. However, authority over the = name entails administrative authority over applications; if you don't = like the way hosts are running, you can change the DNS for your name = such that it no longer points to misbehaving hosts. Consequently, when a = certificate is used to secure communications, it signifies to you (the = recipient) that you are receiving this information from the = administrator of the namespace (or their delegate). This is significant = for sip-identity because the assurance sip-identity provides is about = the administration of names within a domain - it must come from someone = with authority over how subordinate names are delegated for the domain = in question. That is the authority that matters here. Your point above seems to be that a certificate for 'example.com' is too = broad a tool for a SIP authentication service to use, because SIP is = just one service, and domain administrators would not want to empower a = SIP auth service to speak for any and all services of 'example.com'. = After all, if the private key for 'example.com' is resident on a host = running a SIP auth service, that host could create signatures over = messages or documents for all kinds of non-SIP applications. = Accordingly, using a cert with a subject(AltName) of 'example.com' to = sign SIP requests is not feasible. But of course, any domain that doesn't trust its "telephony guys" could = have a subordinate name for telephony; e.g., 'sip.example.com' and = 'prtp.example.com' could be run on separate hosts. Separate certificates = could be acquired for those hostnames. Subordinate usernames under those = hosts like 'jon@sip.example.com' and 'auctioneer@prtp.example.com' could = be created. So... > [*] no you cannot use a different root to separate them out because > the receiver doesn't know which roots represent which service. ... in that case, I think it would be very clear to the receiver that a = request from 'jon@sip.example.com' needs to be signed by = 'sip.example.com', nor 'prst.example.com' or what have you. If that's = what you mean by a 'different root', it seems totally feasible to me. But isn't it, well, lame to use names of the form 'jon@sip.example.com' = rather than 'jon@example.com'? Yes, it is somewhat lame. But it is = neither broken from a security perspective nor infeasible from an = administrative perspective. Moreover, I believe that there will be = administrative domains in which people do trust the "telephony guys" = with the private key for their domain, and/or there will be domains = created specifically for SIP as a service where this lameness will not = arise. Thinking to the future, MX records were created to palliate this sort of = lameness in mail deployments. SRV and NAPTR records for SIP serve a = similar purpose. Is it possible these records, or some similar tool in = the DNS, could be checked by verifiers to identify the canonical auth = service for a particular domain? Definitely. Then a verifier could fetch = the DNS record and say, "Ah, for all users in 'example.com', SIP = requests should be signed by a cert from 'sip.example.com', not = 'prst.example.com' or any other host." This could make the lameness go = away - provided you trust the DNS, of course. sip-identity has hinted at = this as a direction for future work for a long time (at least since the = -02 version).=20 However, I have not felt it is worth articulating that proposal further = until we get the fundamentals of sip-identity down pat. I think = sip-identity is useful enough without this capability that we can put = the specification forward and worry that (and a few other matters) = later.=20 > > It does not assume that if you hold the cert=20 > sip.example.com. or sip:matt@example.com, that you are the=20 > authority for example.com. How does one get a cert for=20 > example.com? That is matter of CA policy, to a large extent,=20 > but there is typically a validation process. The validation=20 > process consists of the CA determining whether or not the=20 > requestor of a certificate has authority over that particular=20 > name in the DNS >=20 > I don't understand the DNS part, and don't recall seeing > anything about DNS in the draft.=20 I am talking about the procedures of certificate enrollment, here, not = about any sip-identity procedures. [snip] > Right now, there typically exists zero PKI namespaces > (with the lone exception of http server certs) within > most organizations. I don't think that bodes well for > handwaving. =20 True, but, we have gone to some trouble to make sure that the same PKI = used for HTTP server certs can be used for SIP. That doesn't mean that = the same -certs- are used for both, necessarily, but that the same CAs, = and CA enrollment procedures, and so on, are used. A new PKI would be a = fruitless approach to this. > > > Worse is that a naive > > > cross domain receiver has *no* way to know which of example.com's > > > namespaces ought to be considered valid. So it doesn't even > > > work in this case. > >=20 > > Well, no, I'm not sure that is true. If cisco.com uses a=20 > cert with a subject of 'cisco.com' in their auth service,=20 > then SIP users would have names of the form=20 > 'sip:matt@cisco.com'. If it uses, say, sip.cisco.com in their=20 > auth service, then SIP users would have need to have names of=20 > the form 'sip:matt@sip.cisco.com'. So, saying that it doesn't=20 > work isn't fair. It will be clear to a cross domain user=20 > whether or not the domain in the From header field matches=20 > the domain the subjectAltName of the cert. > >=20 >=20 [snip] > So is the idea to segregate out the name space with the > sip: preceding the subject alt name?=20 No... as it says above, the proposal is that there is a -domain- in the = subjectAltName. I'm not sure how you could have derived that inference = from the text above. The names of SIP users (which have a 'sip:' in = them) have a domain portion, and that domain portion must correspond = with the domain in the subject of a cert. > This is getting=20 > weirder and weirder, because that implies that I'm going > have a pile of different purpose built certs per/user=20 > which is really awful because enrollment is the actual > Really Hard Problem of PKI. If you're going to go down > this cert route at all, you really ought to look into=20 > attribute certs instead of overloading namespace with > authz semantics. =20 Yeah, that would suck. > >=20 > > > NB: this is a common conflation with would-be cert users. > > > What you get with certs is authentication and nothing more. > > > Authorization is necessary to bind identity with role. That's > > > missing in the sip-identity draft. > >=20 > > Yes, the cert authenticates the owner of the namespace. The=20 > act of creating the Identity header makes an authorization=20 > assertion about the use of the From header field in a=20 > particular message.=20 >=20 > It can assert all it likes. If I can't verify the authority > of that assertion it's worthless. That's the problem here.=20 The manner in which you (the recipient) verify the authority of the = assertion is by comparing the domain in the URI in the From header field = to the domain in the subject of the cert. If they match, there is = authority; if they don't match, there is no authority. What's the big = deal? Jon Peterson NeuStar, Inc. > Mike _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Wed Apr 20 16:34:33 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DOLu5-0007a1-Pq; Wed, 20 Apr 2005 16:34:33 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DOLu4-0007Zw-0q for sip@megatron.ietf.org; Wed, 20 Apr 2005 16:34:32 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA16941 for ; Wed, 20 Apr 2005 16:34:30 -0400 (EDT) Received: from willow.neustar.com ([209.173.53.84]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DOM5L-0007cg-4e for sip@ietf.org; Wed, 20 Apr 2005 16:46:12 -0400 Received: from stntsmtp1.cis.neustar.com (smartexch.neustar.com [10.31.13.79]) by willow.neustar.com (8.12.8/8.11.6) with ESMTP id j3KKYLs3022080; Wed, 20 Apr 2005 20:34:21 GMT Received: from stntexch03.cis.neustar.com ([10.31.13.45]) by stntsmtp1.cis.neustar.com with Microsoft SMTPSVC(6.0.3790.211); Wed, 20 Apr 2005 16:34:21 -0400 X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Subject: RE: [Sip] RE: Question to Identity draft Date: Wed, 20 Apr 2005 16:34:20 -0400 Message-ID: <24EAE5D4448B9D4592C6D234CBEBD59701502E4E@stntexch03.cis.neustar.com> Thread-Topic: [Sip] RE: Question to Identity draft Thread-Index: AcVF2rPOJMsWGnPxRTmXk8hVA5cH9gADRtMg From: "Peterson, Jon" To: "Michael Thomas" , "Cullen Jennings" X-OriginalArrivalTime: 20 Apr 2005 20:34:21.0220 (UTC) FILETIME=[55169640:01C545E8] X-Spam-Score: 0.0 (/) X-Scan-Signature: 9466e0365fc95844abaf7c3f15a05c7d Content-Transfer-Encoding: quoted-printable Cc: sip@ietf.org, Fries Steffen X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org > On Tue, 2005-04-19 at 13:30, Cullen Jennings wrote: > > You can't use a certificate for a > > user, like alice@example.com to assert identity using the identity = draft > > mechanism.=20 >=20 > That strikes me as a bug rather than a feature. What if I > have outsourced functions where I only want to delegate > a certain subset of sip URI's to them? Oh say, like=20 > outsource@example.com that's really some other company? > That is, I want them to be able to assert outsource@example.com, > but nothing else. Or suppose that alice@example.com is the > CEO and she wants to be able to call from her device on the > road when she's not behind the example.com corporate=20 > proxies? Why can't she just sign the identity herself... > she's the CEO, right? =20 If you had a certificate for sip:outsource@example.com, you could use = the existing RFC3261 procedures to leverage that cert for integrity, = confidentiality, and what have you. sip-identity is largely a workaround = for the non-existence of such certs, which in turn is a result of the = huge problems with enrollment in and administration of a PKI for such = certs. Jon Peterson NeuStar, Inc. > Mike _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Wed Apr 20 17:39:53 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DOMvJ-0007Mj-Ke; Wed, 20 Apr 2005 17:39:53 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DOMvH-0007Mb-Cz for sip@megatron.ietf.org; Wed, 20 Apr 2005 17:39:51 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA23968 for ; Wed, 20 Apr 2005 17:39:49 -0400 (EDT) Received: from magus.nostrum.com ([69.5.195.2] helo=nostrum.com ident=root) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DON6Y-00013W-GB for sip@ietf.org; Wed, 20 Apr 2005 17:51:32 -0400 Received: from [192.168.0.102] (c-24-1-68-89.hsd1.tx.comcast.net [24.1.68.89]) (authenticated bits=0) by nostrum.com (8.12.11/8.12.11) with ESMTP id j3KLcZQY015171 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NO); Wed, 20 Apr 2005 16:38:35 -0500 (CDT) (envelope-from rjsparks@nostrum.com) Mime-Version: 1.0 (Apple Message framework v619.2) To: "sip@ietf.org WG" Message-Id: From: Robert Sparks Date: Wed, 20 Apr 2005 16:38:54 -0500 X-Mailer: Apple Mail (2.619.2) Received-SPF: pass (nostrum.com: 24.1.68.89 is authenticated by a trusted mechanism) X-Spam-Score: 0.1 (/) X-Scan-Signature: 057ebe9b96adec30a7efb2aeda4c26a4 Cc: Subject: [Sip] Consequence of destroying INVITE server transaction on 200 X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============1902883155==" Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org --===============1902883155== Content-Type: multipart/signed; micalg=sha1; boundary=Apple-Mail-26-434464649; protocol="application/pkcs7-signature" --Apple-Mail-26-434464649 Content-Type: text/plain; charset=US-ASCII; format=flowed Content-Transfer-Encoding: 7bit This is one of the bigger questions that arose at SIPIT 16. According to 3261 section 13.3.1.4 and the end of 17.1.1.2, endpoints destroy their INVITE transaction the instant they send a 200. For UDP, the application above is left responsible for retransmitting that 200 by interacting with the transport directly until an ACK arrives. Similarly 17.1.1.2 affects proxies as well (it states this destruction is essential for proper proxy operation, choosing this path to define how subsequent 200s from other branches are handled). The problem that arose is that it is not clear from the specification what to do with a retransmission of the INVITE request that arrives after that transaction state has been deleted (consider that the first 200 over UDP is lost for instance). Unless we missed something, a literal read of the spec says this retransmission will get processed as a new request, possibly forking again to different places at a proxy (it deleted the thing that would have dealt with that retransmission), or likely generating a different final response (with a different To tag) from an endpoint. I believe the intent was that the application on top of the original transaction (the endpoint, or the response context in the proxy) remember enough to absorb that retransmission. The spec needs more description around this so that it is obvious that this retransmission should make it to the part of the application that handled the original request. It needs to talk about. how long this part of the application needs to hang around to drain these retransmissions. Can anyone see text that we may have missed when discussing this problem that adds clarity to it. If not, does anyone disagree with the approach for clarification proposed above. If the answer to both of those questions is no, I'll enter a bug and propose text. RjS --Apple-Mail-26-434464649 Content-Type: application/pkcs7-signature; name=smime.p7s Content-Disposition: attachment; filename=smime.p7s Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIGHDCCAtUw ggI+oAMCAQICAw1F7jANBgkqhkiG9w0BAQQFADBiMQswCQYDVQQGEwJaQTElMCMGA1UEChMcVGhh d3RlIENvbnN1bHRpbmcgKFB0eSkgTHRkLjEsMCoGA1UEAxMjVGhhd3RlIFBlcnNvbmFsIEZyZWVt YWlsIElzc3VpbmcgQ0EwHhcNMDQxMDIxMTQwNjIxWhcNMDUxMDIxMTQwNjIxWjBGMR8wHQYDVQQD ExZUaGF3dGUgRnJlZW1haWwgTWVtYmVyMSMwIQYJKoZIhvcNAQkBFhRyanNwYXJrc0Bub3N0cnVt LmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMjqlA5TN+Vdj5RphuzqAiHDB0zZ 9Oi9WJXz6ViFehCpDYiT/eunO0rur7F+aEb0MnrnLbGm9XJbADwxdKkkvIZ6T5nGJkoALlqCgivE Ln4jV3pagvgbLB3QEHJkdc0FPfdltOEWBy5bTZdx1QaUuMwA5J0TiBaKtEuYezzmMd+/T6G0tNix 7o2e2EgcO1MvymeJ76oxbSEvut5O+mRBbKF3qe3rwyEyTZcYiKFKZga/a3t4rfjhmnzV2AtWn6DG 4Xl8A/kwnucG3tRfx5NNmLECRAwXem32xMUi7ub6cuwtT0gq1C6StGHkQJrnpjsEEs5bKz75bkZd VFr+GpM9Xa0CAwEAAaMxMC8wHwYDVR0RBBgwFoEUcmpzcGFya3NAbm9zdHJ1bS5jb20wDAYDVR0T AQH/BAIwADANBgkqhkiG9w0BAQQFAAOBgQCvd7akpvkndBIF5pJFS8+2FLGAvELO2VyO8m2dZ9IP xsu+dpi1UeAvDyx0WnuGwOmGHdqYueVaiRhr6zGljRW2R3i5NNe3svPHDDiIGTHzwaEGVd37aT+e UH7EuTz97/L+A93b0lMvpheB8WsKItqmjqDVCwMlMZS4gFtG3iwl0zCCAz8wggKooAMCAQICAQ0w DQYJKoZIhvcNAQEFBQAwgdExCzAJBgNVBAYTAlpBMRUwEwYDVQQIEwxXZXN0ZXJuIENhcGUxEjAQ BgNVBAcTCUNhcGUgVG93bjEaMBgGA1UEChMRVGhhd3RlIENvbnN1bHRpbmcxKDAmBgNVBAsTH0Nl cnRpZmljYXRpb24gU2VydmljZXMgRGl2aXNpb24xJDAiBgNVBAMTG1RoYXd0ZSBQZXJzb25hbCBG cmVlbWFpbCBDQTErMCkGCSqGSIb3DQEJARYccGVyc29uYWwtZnJlZW1haWxAdGhhd3RlLmNvbTAe Fw0wMzA3MTcwMDAwMDBaFw0xMzA3MTYyMzU5NTlaMGIxCzAJBgNVBAYTAlpBMSUwIwYDVQQKExxU aGF3dGUgQ29uc3VsdGluZyAoUHR5KSBMdGQuMSwwKgYDVQQDEyNUaGF3dGUgUGVyc29uYWwgRnJl ZW1haWwgSXNzdWluZyBDQTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAxKY8VXNV+065ypla HmjAdQRwnd/p/6Me7L3N9VvyGna9fww6YfK/Uc4B1OVQCjDXAmNaLIkVcI7dyfArhVqqP3FWy688 Cwfn8R+RNiQqE88r1fOCdz0Dviv+uxg+B79AgAJk16emu59l0cUqVIUPSAR/p7bRPGEEQB5kGXJg t/sCAwEAAaOBlDCBkTASBgNVHRMBAf8ECDAGAQH/AgEAMEMGA1UdHwQ8MDowOKA2oDSGMmh0dHA6 Ly9jcmwudGhhd3RlLmNvbS9UaGF3dGVQZXJzb25hbEZyZWVtYWlsQ0EuY3JsMAsGA1UdDwQEAwIB BjApBgNVHREEIjAgpB4wHDEaMBgGA1UEAxMRUHJpdmF0ZUxhYmVsMi0xMzgwDQYJKoZIhvcNAQEF BQADgYEASIzRUIPqCy7MDaNmrGcPf6+svsIXoUOWlJ1/TCG4+DYfqi2fNi/A9BxQIJNwPP2t4WFi w9k6GX6EsZkbAMUaC4J0niVQlGLH2ydxVyWN3amcOY6MIE9lX5Xa9/eH1sYITq726jTlEBpbNU13 41YheILcIRk13iSx0x1G/11fZU8xggLnMIIC4wIBATBpMGIxCzAJBgNVBAYTAlpBMSUwIwYDVQQK ExxUaGF3dGUgQ29uc3VsdGluZyAoUHR5KSBMdGQuMSwwKgYDVQQDEyNUaGF3dGUgUGVyc29uYWwg RnJlZW1haWwgSXNzdWluZyBDQQIDDUXuMAkGBSsOAwIaBQCgggFTMBgGCSqGSIb3DQEJAzELBgkq hkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTA1MDQyMDIxMzg1NFowIwYJKoZIhvcNAQkEMRYEFFzR ECi4GOJbRgPzSxRPrxY5BKvaMHgGCSsGAQQBgjcQBDFrMGkwYjELMAkGA1UEBhMCWkExJTAjBgNV BAoTHFRoYXd0ZSBDb25zdWx0aW5nIChQdHkpIEx0ZC4xLDAqBgNVBAMTI1RoYXd0ZSBQZXJzb25h bCBGcmVlbWFpbCBJc3N1aW5nIENBAgMNRe4wegYLKoZIhvcNAQkQAgsxa6BpMGIxCzAJBgNVBAYT AlpBMSUwIwYDVQQKExxUaGF3dGUgQ29uc3VsdGluZyAoUHR5KSBMdGQuMSwwKgYDVQQDEyNUaGF3 dGUgUGVyc29uYWwgRnJlZW1haWwgSXNzdWluZyBDQQIDDUXuMA0GCSqGSIb3DQEBAQUABIIBADx1 DgIpaCDFrw0HI+Uc4JS3ZCg0qcF9ZymlVKpmjIIvQr1AbWDRL0nm0wdZRc2Wyv1+6BLyV7Jdfq04 pp83jjwRUmWanaWwxUqUgx2hLo2X6tjroR8t3Cp57qqtsAHovasiCdJcEUpaXU9is/L575ZZBNqC gJN79ttrPe3BCaVeJDzO1puZZz67Y1C19r6Wz8on47UfSQRw+uztay7CQhntcpcE0s1Lo+gEH8g/ ozXBjRuTQzfwk/KIIvGTqj7NmOt7bJ0IVGNhsptt3MPLTOMImuQwQhWdTOlEvT6iTVg3tSwjjmI4 aAfZeFBzn/WEhIzuyXkmCQOxx4ELGdT0BnQAAAAAAAA= --Apple-Mail-26-434464649-- --===============1902883155== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip --===============1902883155==-- From sip-bounces@ietf.org Wed Apr 20 17:47:33 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DON2j-00006w-2q; Wed, 20 Apr 2005 17:47:33 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DON2h-00006b-Ej for sip@megatron.ietf.org; Wed, 20 Apr 2005 17:47:31 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA25193 for ; Wed, 20 Apr 2005 17:47:29 -0400 (EDT) Received: from magus.nostrum.com ([69.5.195.2] helo=nostrum.com ident=root) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DONDy-0001Qf-Rw for sip@ietf.org; Wed, 20 Apr 2005 17:59:12 -0400 Received: from [192.168.0.102] (c-24-1-68-89.hsd1.tx.comcast.net [24.1.68.89]) (authenticated bits=0) by nostrum.com (8.12.11/8.12.11) with ESMTP id j3KLlNTi015823 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NO); Wed, 20 Apr 2005 16:47:24 -0500 (CDT) (envelope-from rjsparks@nostrum.com) Mime-Version: 1.0 (Apple Message framework v619.2) To: "sip@ietf.org WG" Message-Id: From: Robert Sparks Date: Wed, 20 Apr 2005 16:47:42 -0500 X-Mailer: Apple Mail (2.619.2) Received-SPF: pass (nostrum.com: 24.1.68.89 is authenticated by a trusted mechanism) X-Spam-Score: 0.1 (/) X-Scan-Signature: b280b4db656c3ca28dd62e5e0b03daa8 Cc: Jon Peterson Subject: [Sip] lack of clarity around handling mixed sip:/sips: registrations X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============0186350775==" Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org --===============0186350775== Content-Type: multipart/signed; micalg=sha1; boundary=Apple-Mail-27-434992596; protocol="application/pkcs7-signature" --Apple-Mail-27-434992596 Content-Type: text/plain; charset=US-ASCII; format=flowed Content-Transfer-Encoding: 7bit A question arose at SIPIT 16 around whether a registrar was required to reject a sips: contact registered against a sip: URI, and whether it was required to reject a sip: contact registered against a sips: URI. The spec is silent on this. I propose that we capture a bug to discuss these situations, note that they are allowed (my strawman suggestion), and point to the constraints on how those registered contacts might get _used_. (The answer there is probably different for issuing a 3xx or choosing to proxy). Similarly, questions arose to what a proxy server should do with such things discovered from a location service. The spec is fairly clear about not using a sip: contact when processing a sips: URI at a proxy. It does not discuss the bad things that happen if you use a sips: contact when processing a sip: URI. I propose we have another bug that introduces such a discussion. Is this captured somewhere already that we missed? RjS --Apple-Mail-27-434992596 Content-Type: application/pkcs7-signature; name=smime.p7s Content-Disposition: attachment; filename=smime.p7s Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIGHDCCAtUw ggI+oAMCAQICAw1F7jANBgkqhkiG9w0BAQQFADBiMQswCQYDVQQGEwJaQTElMCMGA1UEChMcVGhh d3RlIENvbnN1bHRpbmcgKFB0eSkgTHRkLjEsMCoGA1UEAxMjVGhhd3RlIFBlcnNvbmFsIEZyZWVt YWlsIElzc3VpbmcgQ0EwHhcNMDQxMDIxMTQwNjIxWhcNMDUxMDIxMTQwNjIxWjBGMR8wHQYDVQQD ExZUaGF3dGUgRnJlZW1haWwgTWVtYmVyMSMwIQYJKoZIhvcNAQkBFhRyanNwYXJrc0Bub3N0cnVt LmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMjqlA5TN+Vdj5RphuzqAiHDB0zZ 9Oi9WJXz6ViFehCpDYiT/eunO0rur7F+aEb0MnrnLbGm9XJbADwxdKkkvIZ6T5nGJkoALlqCgivE Ln4jV3pagvgbLB3QEHJkdc0FPfdltOEWBy5bTZdx1QaUuMwA5J0TiBaKtEuYezzmMd+/T6G0tNix 7o2e2EgcO1MvymeJ76oxbSEvut5O+mRBbKF3qe3rwyEyTZcYiKFKZga/a3t4rfjhmnzV2AtWn6DG 4Xl8A/kwnucG3tRfx5NNmLECRAwXem32xMUi7ub6cuwtT0gq1C6StGHkQJrnpjsEEs5bKz75bkZd VFr+GpM9Xa0CAwEAAaMxMC8wHwYDVR0RBBgwFoEUcmpzcGFya3NAbm9zdHJ1bS5jb20wDAYDVR0T AQH/BAIwADANBgkqhkiG9w0BAQQFAAOBgQCvd7akpvkndBIF5pJFS8+2FLGAvELO2VyO8m2dZ9IP xsu+dpi1UeAvDyx0WnuGwOmGHdqYueVaiRhr6zGljRW2R3i5NNe3svPHDDiIGTHzwaEGVd37aT+e UH7EuTz97/L+A93b0lMvpheB8WsKItqmjqDVCwMlMZS4gFtG3iwl0zCCAz8wggKooAMCAQICAQ0w DQYJKoZIhvcNAQEFBQAwgdExCzAJBgNVBAYTAlpBMRUwEwYDVQQIEwxXZXN0ZXJuIENhcGUxEjAQ BgNVBAcTCUNhcGUgVG93bjEaMBgGA1UEChMRVGhhd3RlIENvbnN1bHRpbmcxKDAmBgNVBAsTH0Nl cnRpZmljYXRpb24gU2VydmljZXMgRGl2aXNpb24xJDAiBgNVBAMTG1RoYXd0ZSBQZXJzb25hbCBG cmVlbWFpbCBDQTErMCkGCSqGSIb3DQEJARYccGVyc29uYWwtZnJlZW1haWxAdGhhd3RlLmNvbTAe Fw0wMzA3MTcwMDAwMDBaFw0xMzA3MTYyMzU5NTlaMGIxCzAJBgNVBAYTAlpBMSUwIwYDVQQKExxU aGF3dGUgQ29uc3VsdGluZyAoUHR5KSBMdGQuMSwwKgYDVQQDEyNUaGF3dGUgUGVyc29uYWwgRnJl ZW1haWwgSXNzdWluZyBDQTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAxKY8VXNV+065ypla HmjAdQRwnd/p/6Me7L3N9VvyGna9fww6YfK/Uc4B1OVQCjDXAmNaLIkVcI7dyfArhVqqP3FWy688 Cwfn8R+RNiQqE88r1fOCdz0Dviv+uxg+B79AgAJk16emu59l0cUqVIUPSAR/p7bRPGEEQB5kGXJg t/sCAwEAAaOBlDCBkTASBgNVHRMBAf8ECDAGAQH/AgEAMEMGA1UdHwQ8MDowOKA2oDSGMmh0dHA6 Ly9jcmwudGhhd3RlLmNvbS9UaGF3dGVQZXJzb25hbEZyZWVtYWlsQ0EuY3JsMAsGA1UdDwQEAwIB BjApBgNVHREEIjAgpB4wHDEaMBgGA1UEAxMRUHJpdmF0ZUxhYmVsMi0xMzgwDQYJKoZIhvcNAQEF BQADgYEASIzRUIPqCy7MDaNmrGcPf6+svsIXoUOWlJ1/TCG4+DYfqi2fNi/A9BxQIJNwPP2t4WFi w9k6GX6EsZkbAMUaC4J0niVQlGLH2ydxVyWN3amcOY6MIE9lX5Xa9/eH1sYITq726jTlEBpbNU13 41YheILcIRk13iSx0x1G/11fZU8xggLnMIIC4wIBATBpMGIxCzAJBgNVBAYTAlpBMSUwIwYDVQQK ExxUaGF3dGUgQ29uc3VsdGluZyAoUHR5KSBMdGQuMSwwKgYDVQQDEyNUaGF3dGUgUGVyc29uYWwg RnJlZW1haWwgSXNzdWluZyBDQQIDDUXuMAkGBSsOAwIaBQCgggFTMBgGCSqGSIb3DQEJAzELBgkq hkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTA1MDQyMDIxNDc0MlowIwYJKoZIhvcNAQkEMRYEFIgi +8Jc2Son46U1pHoGk/COtkhbMHgGCSsGAQQBgjcQBDFrMGkwYjELMAkGA1UEBhMCWkExJTAjBgNV BAoTHFRoYXd0ZSBDb25zdWx0aW5nIChQdHkpIEx0ZC4xLDAqBgNVBAMTI1RoYXd0ZSBQZXJzb25h bCBGcmVlbWFpbCBJc3N1aW5nIENBAgMNRe4wegYLKoZIhvcNAQkQAgsxa6BpMGIxCzAJBgNVBAYT AlpBMSUwIwYDVQQKExxUaGF3dGUgQ29uc3VsdGluZyAoUHR5KSBMdGQuMSwwKgYDVQQDEyNUaGF3 dGUgUGVyc29uYWwgRnJlZW1haWwgSXNzdWluZyBDQQIDDUXuMA0GCSqGSIb3DQEBAQUABIIBAHv3 4hAadGYw+hkmwz32gGbG/cCFrwKVLp7gr5HUw/vsvLhFBmvQKuUCHWj+7kH7CINMS3gr+JGxk/wB UARw58T+Eq3NX0tuDvl1stKVNITSweOsd3OpxpHRP8TNSU6wAXikgbE1I6HndcMBqxBxCTSmzA0F c84GPUih9CQEQNZHydfvIN990Ibph2EVLQTIMTUJ1MGCPDDKvIxMdv08HOP6NXKKsmqapJuQ+R31 DGCKLLQXC+m7W0CaLJ1hqAZXKD2ekssIqF7AB9YI6nBabUVm7bMm6w65Ib6386nsxgPCXghlx6Qo cR8iYkhZZloxL5YsLetxZd5Sbb6biWSaPpYAAAAAAAA= --Apple-Mail-27-434992596-- --===============0186350775== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip --===============0186350775==-- From sip-bounces@ietf.org Wed Apr 20 18:16:14 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DONUU-00046n-DU; Wed, 20 Apr 2005 18:16:14 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DONUS-00046e-5Z for sip@megatron.ietf.org; Wed, 20 Apr 2005 18:16:12 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA28685 for ; Wed, 20 Apr 2005 18:16:09 -0400 (EDT) Received: from sj-iport-2-in.cisco.com ([171.71.176.71] helo=sj-iport-2.cisco.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DONfj-0002Bl-PG for sip@ietf.org; Wed, 20 Apr 2005 18:27:53 -0400 Received: from sj-core-5.cisco.com (171.71.177.238) by sj-iport-2.cisco.com with ESMTP; 20 Apr 2005 15:16:01 -0700 Received: from imail.cisco.com (imail.cisco.com [128.107.200.91]) by sj-core-5.cisco.com (8.12.10/8.12.6) with ESMTP id j3KMFvhu028811; Wed, 20 Apr 2005 15:15:58 -0700 (PDT) Received: from thomasm-lnx.cisco.com (thomasm-lnx.cisco.com [171.71.96.50]) by imail.cisco.com (8.12.11/8.12.10) with ESMTP id j3KM6wsF004064; Wed, 20 Apr 2005 15:06:58 -0700 Subject: RE: [Sip] RE: Question to Identity draft From: Michael Thomas To: "Peterson, Jon" In-Reply-To: <24EAE5D4448B9D4592C6D234CBEBD59701502E4E@stntexch03.cis.neustar.com> References: <24EAE5D4448B9D4592C6D234CBEBD59701502E4E@stntexch03.cis.neustar.com> Organization: Cisco Systems Message-Id: <1114035356.5648.40.camel@thomasm-lnx.cisco.com> Mime-Version: 1.0 X-Mailer: Ximian Evolution 1.4.6 Date: Wed, 20 Apr 2005 15:15:57 -0700 IIM-SIG: v:"1.1"; h:"imail.cisco.com"; d:"cisco.com"; z:"home"; m:"krs"; t:"1114034818.828835"; x:"432200"; a:"rsa-sha1"; b:"nofws:1803"; e:"Iw=="; n:"sQYarK2E51MdcTiUqeif3F7cWdxIfoCiXhdfb9vD5ee/j0jXL15gbFxF2p" "XIweAblu0N6XAgK7k+wrbr7bQDJaCDqOmzqpRUBjIRQAXQ7NzadpmR3pUL6wxaRUtW+c43sl9jC" "50Qg1sXHpPjt8Y+Y16ioyQAQAdSunM4YhevURc="; s:"mt4SxEHWoofP4ZktqaJ1H0IpVpIl+9C4gzxkqHAcWuDbj9OaboO2i9Wmb8sRD0kwPzbz/FwH" "yy0B+EMjuX4I2WfyXznDrVRPuo7cZi7ARHBtxKe8N7/0FZTqrWj78uBxHlmhleTz5T9F4EOcxf4" "IePiUqugKHq0Pnf5AvnX3ys4="; c:"Subject: RE: [Sip] RE: Question to Identity draft"; c:"From: Michael Thomas "; c:"Date: Wed, 20 Apr 2005 15:15:57 -0700" IIM-VERIFY: s:"y"; v:"y"; r:"60"; h:"imail.cisco.com"; c:"message from imail.cisco.com verified; " X-Spam-Score: 0.0 (/) X-Scan-Signature: 3e15cc4fdc61d7bce84032741d11c8e5 Cc: Cullen Jennings , sip@ietf.org, Fries Steffen X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============0103850895==" Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org --===============0103850895== Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="=-Pj9jU3aYFk3JcchVYS4w" --=-Pj9jU3aYFk3JcchVYS4w Content-Type: text/plain Content-Transfer-Encoding: quoted-printable On Wed, 2005-04-20 at 13:34, Peterson, Jon wrote: > > On Tue, 2005-04-19 at 13:30, Cullen Jennings wrote: > > > You can't use a certificate for a > > > user, like alice@example.com to assert identity using the identity dr= aft > > > mechanism.=20 > >=20 > > That strikes me as a bug rather than a feature. What if I > > have outsourced functions where I only want to delegate > > a certain subset of sip URI's to them? Oh say, like=20 > > outsource@example.com that's really some other company? > > That is, I want them to be able to assert outsource@example.com, > > but nothing else. Or suppose that alice@example.com is the > > CEO and she wants to be able to call from her device on the > > road when she's not behind the example.com corporate=20 > > proxies? Why can't she just sign the identity herself... > > she's the CEO, right? > =20 > If you had a certificate for sip:outsource@example.com, you could use the= existing RFC3261 procedures to leverage that cert for integrity, confident= iality, and what have you. sip-identity is largely a workaround for the non= -existence of such certs, which in turn is a result of the huge problems wi= th enrollment in and administration of a PKI for such certs. These really aren't the same problem spaces. SMIME is trying to deal with end-end identity, integrity and confidentiality. That is a much larger -- and different --=20 problem set than "domain" level identity, integrity and *authorization*.=20 So no, I don't think it's reasonable to partition the problems this way; they both have their distinct uses. Mike --=-Pj9jU3aYFk3JcchVYS4w Content-Type: application/pgp-signature; name=signature.asc Content-Description: This is a digitally signed message part -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.3 (GNU/Linux) iQCVAwUAQmbUnLMsDAj/Eq++AQJMqQP/et7ZTtkEFcUFMFTvSBEh/suXoPH4364T 3ZEHOZx7CCwFmgBaoTLlqvDTXqGFmO5Z40CeVjwhwMIkGJbJsHHHC/jxnD5g9w4k 47dRM563JxO4zZz1jtjoRpuokUMjDdh4eUxr+/vMyxV3HHultSz8TN5ZMIJwR4Pa MkUEjFAtXF0= =uP3D -----END PGP SIGNATURE----- --=-Pj9jU3aYFk3JcchVYS4w-- --===============0103850895== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip --===============0103850895==-- From sip-bounces@ietf.org Wed Apr 20 18:30:07 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DONhv-0006Zv-5X; Wed, 20 Apr 2005 18:30:07 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DONhs-0006ZZ-QK for sip@megatron.ietf.org; Wed, 20 Apr 2005 18:30:05 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA00604 for ; Wed, 20 Apr 2005 18:30:02 -0400 (EDT) Received: from rtp-iport-1.cisco.com ([64.102.122.148]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DONtB-0002hq-Mu for sip@ietf.org; Wed, 20 Apr 2005 18:41:46 -0400 Received: from rtp-core-1.cisco.com (64.102.124.12) by rtp-iport-1.cisco.com with ESMTP; 20 Apr 2005 18:41:02 -0400 X-IronPort-AV: i="3.92,118,1112587200"; d="scan'208"; a="45456850:sNHT28018336" Received: from xbh-rtp-201.amer.cisco.com (xbh-rtp-201.cisco.com [64.102.31.12]) by rtp-core-1.cisco.com (8.12.10/8.12.6) with ESMTP id j3KMThRU003898; Wed, 20 Apr 2005 18:29:48 -0400 (EDT) Received: from xfe-rtp-202.amer.cisco.com ([64.102.31.21]) by xbh-rtp-201.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Wed, 20 Apr 2005 18:29:43 -0400 Received: from cisco.com ([161.44.79.173]) by xfe-rtp-202.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Wed, 20 Apr 2005 18:29:43 -0400 Message-ID: <4266D7D7.1080908@cisco.com> Date: Wed, 20 Apr 2005 18:29:43 -0400 From: Paul Kyzivat User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.1) Gecko/20020826 X-Accept-Language: en-us, en MIME-Version: 1.0 To: Robert Sparks Subject: Re: [Sip] lack of clarity around handling mixed sip:/sips: registrations References: Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-OriginalArrivalTime: 20 Apr 2005 22:29:43.0512 (UTC) FILETIME=[73188580:01C545F8] X-Spam-Score: 0.0 (/) X-Scan-Signature: 7baded97d9887f7a0c7e8a33c2e3ea1b Content-Transfer-Encoding: 7bit Cc: "sip@ietf.org WG" , Jon Peterson X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org Robert, Jonathan and I have been informally discussing this off and on for a couple of meetings. Remember that Jonathan mentioned this at the last meeting as it relates to GRUU. He finessed it there - just leaving the real definition as being whatever ultimately gets decided in general. I'm not aware of it being formally tracked anywhere. Paul Robert Sparks wrote: > A question arose at SIPIT 16 around whether a registrar was required > to reject a sips: contact registered against a sip: URI, and whether > it was required to reject a sip: contact registered against a sips: URI. > The spec is silent on this. I propose that we capture a bug to discuss > these > situations, note that they are allowed (my strawman suggestion), and point > to the constraints on how those registered contacts might get _used_. (The > answer there is probably different for issuing a 3xx or choosing to proxy). > > Similarly, questions arose to what a proxy server should do with such > things discovered from a location service. The spec is fairly clear about > not using a sip: contact when processing a sips: URI at a proxy. It does > not discuss the bad things that happen if you use a sips: contact when > processing a sip: URI. I propose we have another bug that introduces > such a discussion. > > Is this captured somewhere already that we missed? > > RjS > > > ------------------------------------------------------------------------ > > _______________________________________________ > Sip mailing list https://www1.ietf.org/mailman/listinfo/sip > This list is for NEW development of the core SIP Protocol > Use sip-implementors@cs.columbia.edu for questions on current sip > Use sipping@ietf.org for new developments on the application of sip _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Wed Apr 20 19:08:18 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DOOIs-0001mD-2P; Wed, 20 Apr 2005 19:08:18 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DOOIp-0001m7-VX for sip@megatron.ietf.org; Wed, 20 Apr 2005 19:08:16 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA03430 for ; Wed, 20 Apr 2005 19:08:12 -0400 (EDT) From: Udit_Goyal@3com.com Received: from plmler6.mail.eds.com ([199.228.142.66]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DOOU8-0003TU-BF for sip@ietf.org; Wed, 20 Apr 2005 19:19:57 -0400 Received: from plmlir1.mail.eds.com (plmlir1-2.mail.eds.com [199.228.142.131]) by plmler6.mail.eds.com (8.13.2/8.12.10) with ESMTP id j3KN828P008347; Wed, 20 Apr 2005 18:08:02 -0500 Received: from plmlir1.mail.eds.com (localhost [127.0.0.1]) by plmlir1.mail.eds.com (8.13.2/8.12.10) with ESMTP id j3KN7nsE013894; Wed, 20 Apr 2005 18:07:49 -0500 Received: from usut001.3com.com ([205.142.126.149]) by plmlir1.mail.eds.com (8.13.2/8.12.10) with ESMTP id j3KN7nZe013889; Wed, 20 Apr 2005 18:07:49 -0500 To: "SIP Implementors" , "SIP IETF" MIME-Version: 1.0 X-Mailer: Lotus Notes Release 6.5.2 June 01, 2004 Message-ID: Date: Wed, 20 Apr 2005 19:13:38 -0400 X-MIMETrack: Serialize by Router on USUT001/US/3Com(Release 6.0.3|September 26, 2003) at 04/20/2005 04:07:41 PM, Serialize complete at 04/20/2005 04:07:41 PM X-Spam-Score: 0.8 (/) X-Scan-Signature: 7c1a129dc3801d79d40c5ca8dee767eb Cc: Subject: [Sip] Busy condition X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============1904384989==" Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org This is a multipart message in MIME format. --===============1904384989== Content-Type: multipart/alternative; boundary="=_alternative 007F01D385256FE9_=" This is a multipart message in MIME format. --=_alternative 007F01D385256FE9_= Content-Type: text/plain; charset="US-ASCII" Hi, Just want to make sure if it is possible to add more warning codes for Warning header or is it limited to 3xx values as defined in RFC 3261. Otherwise, we can define some standard reason phrase for the common erro scenarios responses. -Udit ----- Forwarded by Udit Goyal/C/US/3Com on 04/20/2005 07:01 PM ----- Udit Goyal/C/US/3Com 04/19/2005 02:33 PM To Wayne.Davies@mmv.vic.gov.au cc sip-implementors@cs.columbia.edu, sip@ietf.org Subject Re: [Sip-implementors] Busy condition Hi Wayne, I agree that for Warning header field, the scope is limited because of the codes already defined in 3261 Moreover, they mainy defines the failures induced by the SDP Giving more error status information in the reason phrase is also ok but it is more like implementation dependent as per RFC 3261. It does not define any standard error phrases for this purpose. Even we cant use "Reason" header (RFC 3326) for this purpose because it defines cause to be the SIP status code so it will also not serve any purpose. What I think is providing more error warning codes for failure cases will be better as error codes are always better than reason phrases because of ease of automatic action. Cant we have something like 4xx warning codes too.. or is it like 3xx is only available for SIP. -Udit Wayne.Davies@mmv.vic.gov.au Sent by: sip-implementors-bounces@cs.columbia.edu 04/19/2005 01:43 AM To Udit Goyal/C/US/3Com@3Com cc sip-implementors-bounces@cs.columbia.edu, sip-implementors@cs.columbia.edu Subject Re: [Sip-implementors] Busy condition Udit, Both methods of communicating more detail for the error condition seem valid / ok to me. It appears the main difference in their use is that the Warning header entries are mandated in 3261 and furthered by IANA registered ones. The warning codes range for SIP is stated as being the 3xx block which are already divided up into categories, currently there seems limited scope in using this range (390 - 399 for miscellaneous). 3261 supports extending the default reason phrase for responses and gives some specific examples of this is advocated 261 gives examples of doing this for specific responses (182, 400, 480). Advocating a standard for the wording for common conditions like your examples below might be a good idea. Regards - Wayne. Udit asked: ************************************************************* Hi, I was just wondering that are there any ways to give different indications when user is not able to take the call. There are error responses like 480, 486 used to indicate the busy condition but still they are not able to indicate the exact failure status. However, there can be scenarios like: i) User rejects the call. ii) All lines are busy and user cant take the call. iii) Ringing timeout occur: No Answer and more.... I feel there are possibilities of indicating to the end user by using error response status text, "Warning" header, or "Reason" header. Please let me know which is more standard approach followed. Thanks, Udit _______________________________________________ Sip-implementors mailing list Sip-implementors@cs.columbia.edu http://lists.cs.columbia.edu/mailman/listinfo/sip-implementors --=_alternative 007F01D385256FE9_= Content-Type: text/html; charset="US-ASCII"
Hi,

Just want to make sure if it is possible to add more warning codes for Warning header
or is it limited to 3xx values as defined in RFC 3261.

Otherwise, we can define some standard reason phrase for the common erro scenarios responses.

-Udit

----- Forwarded by Udit Goyal/C/US/3Com on 04/20/2005 07:01 PM -----
Udit Goyal/C/US/3Com

04/19/2005 02:33 PM

To
Wayne.Davies@mmv.vic.gov.au
cc
sip-implementors@cs.columbia.edu, sip@ietf.org
Subject
Re: [Sip-implementors] Busy conditionLink




Hi Wayne,

I agree that for Warning header field, the scope is limited because of the codes already defined in 3261
Moreover, they mainy defines the failures induced by the SDP

Giving more error status information in the reason phrase is also ok but it is more like implementation dependent as per RFC 3261.
It does not define any standard error phrases for this purpose.

Even we cant use "Reason" header (RFC 3326) for this purpose because it defines cause to be the SIP status code so it will also not serve any purpose.

What I think is providing more error warning codes for failure cases will be better as error codes are always better than reason phrases because of ease of automatic action.
Cant we have something like 4xx warning codes too.. or is it like 3xx is only available for SIP.

-Udit



Wayne.Davies@mmv.vic.gov.au
Sent by: sip-implementors-bounces@cs.columbia.edu

04/19/2005 01:43 AM

To
Udit Goyal/C/US/3Com@3Com
cc
sip-implementors-bounces@cs.columbia.edu, sip-implementors@cs.columbia.edu
Subject
Re: [Sip-implementors] Busy condition









Udit,
Both methods of communicating more detail for the error condition

seem valid / ok to me.

It appears the main difference in their use is that the Warning
header entries are mandated in 3261 and furthered by IANA registered ones.
The warning codes range for SIP is stated as being the 3xx block which are
already divided up into categories, currently there seems limited scope in
using this range (390 - 399 for miscellaneous).

3261 supports extending the default reason phrase for responses and
gives some specific examples of this is advocated 261 gives examples of
doing this for specific responses (182, 400, 480). Advocating a standard
for the wording for common conditions like your examples below might be a
good idea.

Regards - Wayne.


Udit asked:
*************************************************************
Hi,

I was just wondering that are there any ways to give different indications
when user is not able to take the call.
There are error responses like 480, 486 used to indicate the busy
condition but still they are not able to indicate the exact failure
status.
However, there can be scenarios like:
i)   User rejects the call.
ii)  All lines are busy and user cant take the call.
iii) Ringing timeout occur: No Answer and more....

I feel there are possibilities of indicating to the end user by using
error response status text, "Warning" header, or "Reason" header.
Please let me know which is more standard approach followed.

Thanks,
Udit



_______________________________________________
Sip-implementors mailing list
Sip-implementors@cs.columbia.edu

http://lists.cs.columbia.edu/mailman/listinfo/sip-implementors
--=_alternative 007F01D385256FE9_=-- --===============1904384989== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip --===============1904384989==-- From sip-bounces@ietf.org Wed Apr 20 19:33:26 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DOOhC-0000c0-17; Wed, 20 Apr 2005 19:33:26 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DOOh9-0000bv-NH for sip@megatron.ietf.org; Wed, 20 Apr 2005 19:33:23 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA08339 for ; Wed, 20 Apr 2005 19:33:20 -0400 (EDT) Received: from sj-iport-1-in.cisco.com ([171.71.176.70] helo=sj-iport-1.cisco.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DOOsT-0004qo-98 for sip@ietf.org; Wed, 20 Apr 2005 19:45:05 -0400 Received: from sj-core-1.cisco.com (171.71.177.237) by sj-iport-1.cisco.com with ESMTP; 20 Apr 2005 16:33:14 -0700 X-IronPort-AV: i="3.92,118,1112598000"; d="scan'208"; a="630907331:sNHT30535312" Received: from mira-sjc5-d.cisco.com (IDENT:mirapoint@mira-sjc5-d.cisco.com [171.71.163.28]) by sj-core-1.cisco.com (8.12.10/8.12.6) with ESMTP id j3KNXB2w028123; Wed, 20 Apr 2005 16:33:12 -0700 (PDT) Received: from [192.168.1.5] (sjc-vpn2-455.cisco.com [10.21.113.199]) by mira-sjc5-d.cisco.com (MOS 3.4.6-GR) with ESMTP id AJM43896; Wed, 20 Apr 2005 16:33:10 -0700 (PDT) Message-ID: <4266E6B6.4060408@cisco.com> Date: Wed, 20 Apr 2005 19:33:10 -0400 From: Jonathan Rosenberg User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7.3) Gecko/20040910 X-Accept-Language: en-us, en MIME-Version: 1.0 To: Paul Kyzivat Subject: Re: [Sip] lack of clarity around handling mixed sip:/sips: registrations References: <4266D7D7.1080908@cisco.com> In-Reply-To: <4266D7D7.1080908@cisco.com> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Score: 0.0 (/) X-Scan-Signature: a87a9cdae4ac5d3fbeee75cd0026d632 Content-Transfer-Encoding: 7bit Cc: "sip@ietf.org WG" , Jon Peterson X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org Right. I think we probably need a separate document that acts as an update to rfc3261 whose role is to specify the necessary level of depth on sips. Some of the questions that it needs to answer are: Identity relationship of a sip and sips URI from an identity perspective REGISTER handling do you need to register to both sip and sips AOR? can you have a sip contact against a sips AOR and vice a versa? what does it mean for the r-uri to be a sips URI? Dialog Initiating Requests/responses if you send a request to a SIPS URI, does the contact need to contain a sips URI? From? if you receive a request send to a sips URI, what do you put in the 200 OK contact? Proxy Processing DNS SRV/NAPTR interactions interactions with location services and URI translation interactions with loose routing - what route URIs can you put in or not redirection - can you redirect to a non-sips URI? I'd also like to revisit the decision that you can use things besides TLS so long as they are secure. At this point I think we should mandate tls for sips. Some of this is described in rfc3261 but much is not. I don't think its exceptionally hard to figure this out, but it needs some thought and most importantly needs to be documented. -Jonathan R. Paul Kyzivat wrote: > Robert, > > Jonathan and I have been informally discussing this off and on for a > couple of meetings. Remember that Jonathan mentioned this at the last > meeting as it relates to GRUU. He finessed it there - just leaving the > real definition as being whatever ultimately gets decided in general. > > I'm not aware of it being formally tracked anywhere. > > Paul > > Robert Sparks wrote: > >> A question arose at SIPIT 16 around whether a registrar was required >> to reject a sips: contact registered against a sip: URI, and whether >> it was required to reject a sip: contact registered against a sips: URI. >> The spec is silent on this. I propose that we capture a bug to discuss >> these >> situations, note that they are allowed (my strawman suggestion), and >> point >> to the constraints on how those registered contacts might get _used_. >> (The >> answer there is probably different for issuing a 3xx or choosing to >> proxy). >> >> Similarly, questions arose to what a proxy server should do with such >> things discovered from a location service. The spec is fairly clear about >> not using a sip: contact when processing a sips: URI at a proxy. It does >> not discuss the bad things that happen if you use a sips: contact when >> processing a sip: URI. I propose we have another bug that introduces >> such a discussion. >> >> Is this captured somewhere already that we missed? >> >> RjS >> >> >> ------------------------------------------------------------------------ >> >> _______________________________________________ >> Sip mailing list https://www1.ietf.org/mailman/listinfo/sip >> This list is for NEW development of the core SIP Protocol >> Use sip-implementors@cs.columbia.edu for questions on current sip >> Use sipping@ietf.org for new developments on the application of sip > > > _______________________________________________ > Sip mailing list https://www1.ietf.org/mailman/listinfo/sip > This list is for NEW development of the core SIP Protocol > Use sip-implementors@cs.columbia.edu for questions on current sip > Use sipping@ietf.org for new developments on the application of sip > -- Jonathan D. Rosenberg, Ph.D. 600 Lanidex Plaza Director, Service Provider VoIP Architecture Parsippany, NJ 07054-2711 Cisco Systems jdrosen@cisco.com FAX: (973) 952-5050 http://www.jdrosen.net PHONE: (973) 952-5000 http://www.cisco.com _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Wed Apr 20 19:38:48 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DOOmO-0001fX-3Q; Wed, 20 Apr 2005 19:38:48 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DOOmM-0001fS-Hc for sip@megatron.ietf.org; Wed, 20 Apr 2005 19:38:46 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA08759 for ; Wed, 20 Apr 2005 19:38:43 -0400 (EDT) Received: from sj-iport-5.cisco.com ([171.68.10.87]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DOOxg-00051J-4z for sip@ietf.org; Wed, 20 Apr 2005 19:50:28 -0400 Received: from sj-core-3.cisco.com (171.68.223.137) by sj-iport-5.cisco.com with ESMTP; 20 Apr 2005 16:38:37 -0700 Received: from mira-sjc5-d.cisco.com (IDENT:mirapoint@mira-sjc5-d.cisco.com [171.71.163.28]) by sj-core-3.cisco.com (8.12.10/8.12.6) with ESMTP id j3KNcYb4027388; Wed, 20 Apr 2005 16:38:35 -0700 (PDT) Received: from [192.168.1.5] (sjc-vpn2-455.cisco.com [10.21.113.199]) by mira-sjc5-d.cisco.com (MOS 3.4.6-GR) with ESMTP id AJM44132; Wed, 20 Apr 2005 16:38:34 -0700 (PDT) Message-ID: <4266E7F9.4030508@cisco.com> Date: Wed, 20 Apr 2005 19:38:33 -0400 From: Jonathan Rosenberg User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7.3) Gecko/20040910 X-Accept-Language: en-us, en MIME-Version: 1.0 To: Robert Sparks References: In-Reply-To: Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Score: 0.0 (/) X-Scan-Signature: c0bedb65cce30976f0bf60a0a39edea4 Content-Transfer-Encoding: 7bit Cc: "sip@ietf.org WG" Subject: [Sip] Re: Consequence of destroying INVITE server transaction on 200 X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org inline. Robert Sparks wrote: > This is one of the bigger questions that arose at SIPIT 16. > > According to 3261 section 13.3.1.4 and the end of 17.1.1.2, > endpoints destroy their INVITE transaction the instant they send a 200. > For UDP, the application above is left responsible for retransmitting > that 200 by interacting with the transport directly until an ACK > arrives. > > Similarly 17.1.1.2 affects proxies as well (it states this destruction is > essential for proper proxy operation, choosing this path to define how > subsequent 200s from other branches are handled). > > The problem that arose is that it is not clear from the specification > what to do with a retransmission of the INVITE request that arrives > after that transaction state has been deleted (consider that the first > 200 over UDP is lost for instance). > > Unless we missed something, a literal read of the spec says this > retransmission will get processed as a new request, possibly > forking again to different places at a proxy (it deleted the thing that > would have dealt with that retransmission), or likely generating a > different final response (with a different To tag) from an endpoint. I agree that this is a bug in the spec. I don't recall discussing this problem during rfc3261 development and I couldn't find any text in the spec about it either. > > I believe the intent was that the application on top of the original > transaction (the endpoint, or the response context in the proxy) remember > enough to absorb that retransmission. The spec needs more description > around this so that it is obvious that this retransmission should make > it to > the part of the application that handled the original request. It needs > to talk > about. how long this part of the application needs to hang around to drain > these retransmissions. Right. A slightly different way to think about this is that the server transaction doesnt actually disappear on a 2xx; but rather, it remains in a wait state only to suppress INVITE retransmits. It would still transparently pass 2xx from the TU out on the network. > > Can anyone see text that we may have missed when discussing > this problem that adds clarity to it. If not, does anyone disagree with > the approach for clarification proposed above. > > If the answer to both of those questions is no, I'll enter a bug and > propose text. Please do. Thanks, Jonathan R. -- Jonathan D. Rosenberg, Ph.D. 600 Lanidex Plaza Director, Service Provider VoIP Architecture Parsippany, NJ 07054-2711 Cisco Systems jdrosen@cisco.com FAX: (973) 952-5050 http://www.jdrosen.net PHONE: (973) 952-5000 http://www.cisco.com _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Wed Apr 20 19:52:03 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DOOzC-0003XN-Uu; Wed, 20 Apr 2005 19:52:02 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DOOzA-0003XF-4R for sip@megatron.ietf.org; Wed, 20 Apr 2005 19:52:00 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA09871 for ; Wed, 20 Apr 2005 19:51:57 -0400 (EDT) Received: from ams-iport-1.cisco.com ([144.254.224.140]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DOPAS-0005MH-0C for sip@ietf.org; Wed, 20 Apr 2005 20:03:42 -0400 Received: from ams-core-1.cisco.com (144.254.224.150) by ams-iport-1.cisco.com with ESMTP; 21 Apr 2005 01:51:48 +0200 Received: from imail.cisco.com (imail.cisco.com [128.107.200.91]) by ams-core-1.cisco.com (8.12.10/8.12.6) with ESMTP id j3KNpi54019786; Thu, 21 Apr 2005 01:51:44 +0200 (MEST) Received: from thomasm-lnx.cisco.com (thomasm-lnx.cisco.com [171.71.96.50]) by imail.cisco.com (8.12.11/8.12.10) with ESMTP id j3KNgiIj004733; Wed, 20 Apr 2005 16:42:44 -0700 Subject: RE: authority for a domain (was RE: [Sip] sip-identity-05:display-name woes) From: Michael Thomas To: "Peterson, Jon" In-Reply-To: <24EAE5D4448B9D4592C6D234CBEBD59701502E4D@stntexch03.cis.neustar.com> References: <24EAE5D4448B9D4592C6D234CBEBD59701502E4D@stntexch03.cis.neustar.com> Organization: Cisco Systems Message-Id: <1114041102.5650.126.camel@thomasm-lnx.cisco.com> Mime-Version: 1.0 X-Mailer: Ximian Evolution 1.4.6 Date: Wed, 20 Apr 2005 16:51:42 -0700 IIM-SIG: v:"1.1"; h:"imail.cisco.com"; d:"cisco.com"; z:"home"; m:"krs"; t:"1114040564.263867"; x:"432200"; a:"rsa-sha1"; b:"nofws:6654"; e:"Iw=="; n:"sQYarK2E51MdcTiUqeif3F7cWdxIfoCiXhdfb9vD5ee/j0jXL15gbFxF2p" "XIweAblu0N6XAgK7k+wrbr7bQDJaCDqOmzqpRUBjIRQAXQ7NzadpmR3pUL6wxaRUtW+c43sl9jC" "50Qg1sXHpPjt8Y+Y16ioyQAQAdSunM4YhevURc="; s:"VdV8091f1GPV8cs7suAtMITO9wvxffXfISmfN3REa0c6Ir/xOmYx7ZC8PJeZEiH3pxOgGdiB" "zrbxXDqxEP94tA9q+vlOUAHbjJ2Gxnhn5L2UFcTCgGlvFlDBpzS95mrAj3Oc0RTvn6lIwxfGRqV" "LM44FG8I/zRoFaFd2nVg8OF0="; c:"Subject: RE: authority for a domain (was RE: [Sip]=0A sip-identity-0" "5:display-name woes)"; c:"From: Michael Thomas "; c:"Date: Wed, 20 Apr 2005 16:51:42 -0700" IIM-VERIFY: s:"y"; v:"y"; r:"60"; h:"imail.cisco.com"; c:"message from imail.cisco.com verified; " X-Spam-Score: 0.0 (/) X-Scan-Signature: e472ca43d56132790a46d9eefd95f0a5 Cc: sip@ietf.org, Francois Audet , Paul Kyzivat X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============1763705333==" Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org --===============1763705333== Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="=-XB6QBAwDsY4G0nWvQYY4" --=-XB6QBAwDsY4G0nWvQYY4 Content-Type: text/plain Content-Transfer-Encoding: quoted-printable On Wed, 2005-04-20 at 13:29, Peterson, Jon wrote: > I fear that we're talking way past one another, Mike, but I'll try to go = a little farther with this to see if we can find any common ground... > =20 > > > The draft does assume that if you hold a cert for=20 > > example.com (i.e., a CA-signed cert with the subjectAltName=20 > > 'example.com'), then you are the legitimate authority for=20 > > example.com.=20 > >=20 > > Authority for _what_? SIP? Prize Rooster trading? All of the > > above? If not all of the above, what if I want to use the > > same technique for the Prize Rooster Trading Protocol... but > > it seems that I can't because SIP got there first[*]. If it is > > all of the above, then that's a real problem in the delegation > > arena since I don't want my telephony guys having any authority > > over who's allowed to trade my Prize Roosters. >=20 > To answer the question "Authority for what?", let's go back to first prin= ciples, here.=20 Going back to first principles is fine -- in fact that's what I've been trying to accomplish. The problem I see is that you have a solution in mind already and are arguing backward from there. That is, you're taking PKI namespaces and DNS as being primaries. They are not. It would help a lot if you understood what we've done with IIM for email (as well as Yahoo's Domain Keys), because they approach a very similar problem space making different tradeoffs. It also helps greatly because there are existence proofs of both of these protocols which are deployed today which as far as I can tell is not the case for sip-identity (in the case of DK, dozens of large ISP signing 100's of millions of email a day). Also: as one of the implementors of IIM, I have a very good feel for what is implementable; sip-identity is no where close to ready for=20 prime time. Harsh yes, but I just wanted to set straight that I'm not here just to be argumentative. > If I own a name in the DNS, I am empowered to create subordinate names. T= here are four administrative procedures relating to subordinate names which= are salient to this discussion: >=20 > 1) If I own the name 'example.com', I can create a subordinate name calle= d 'mail.example.com'.=20 This is not a first principle. The first principle is that I have names that I'd like to assert as being legitimately from my domain for particular services. A second principle is that I'd like to be able to delegate namespace/service pairs to entities within my organization to whom I authorize to use my namespace for a particular purpose. DNS delegation may or may not be an ends to those principles. > 2) I can also run services on the host 'example.com' which have different= accounts, users, or whatever, and for the purposes of those services, name= s like 'jon@example.com' might be created. This is confused: the first principle here is that services want to use nodes within a namespace. It's not helping here because example.com can be a host, but I sense that you mean example.com the domain. > =20 > 3) I can furthermore run services on a host with a subordinate name, and = the users of that service might be issued names like 'jon@mail.example.com' Or I can run service SIP on host1.example.com and SMTP on host2.example.com for the name mat@example.com. The first principle here is that I'd like to be able to authorize host1 to assert names in SIP messages for some or all of=20 example.com's namespace. DNS delegation isn't the primary=20 property here: it seems to be an artifact of a particular=20 model you are using to achieve the this authorization. > 4) Finally, I can mark up the DNS to link services associated with the na= me 'example.com' to particular services running on subordinate hosts; e.g.,= the MX record linking mail services for 'example.com' to 'mail.example.com= ', or the comparable procedures for SIP using NAPTR and SRV. Again, this isn't the first principle: I'd say that it is: domains would like to send messages to domains with which there can be no assumption of prior knowledge. Further, we want the receiving domain to be able to detect authorized from unauthorized use of a purported sending domain's namespace/service pair. This doesn't *necessarily* entail the use of DNS though it may. > If I am the owner of 'example.com', I can go get a cert from a CA for 'ex= ample.com'.=20 > What that cert signifies, ultimately, is that I am the administrator of t= he name 'example.com',=20 No. Not at all. It means only that the operator of the CA delegated=20 you the name example.com for whatever reason they wanted to delegate you that name. It most certainly doesn't imply any sort of role. A protocol might want to define such roles, but it is *not* inherent in the=20 credential itself. > and consequently that I am empowered to create subordinate names per (1) = and (2) above.=20 A CA or DNS administrator is empowered do this, but that doesn't directly address my version of (4). Again, you have a particular model in mind here which is what I'm questioning. > Consequently, when a certificate is used to secure communications, it sig= nifies to you (the recipient) that you are receiving this information from = the administrator of the namespace=20 No it doesn't. Sorry this is just fundamentally wrong. There is nothing=20 inherent in a subjectAltName that says that. You might devise a=20 protocol which forces a receiver to make that assumption, but that's the protocol's doing, not the credential itself. Again, you've got a particular design in mind here, and the problems that I'm having is with the implications of your assumptions. > Your point above seems to be that a certificate for 'example.com' is too = broad a tool for a SIP authentication service to use, because SIP is just o= ne service, and domain administrators would not want to empower a SIP auth = service to speak for any and all services of 'example.com'. Yes. > After all, if the private key for 'example.com' is resident on a host ru= nning a SIP auth service, that host could create signatures over messages o= r documents for all kinds of non-SIP applications. Accordingly, using a cer= t with a subject(AltName) of 'example.com' to sign SIP requests is not feas= ible. >=20 > But of course, any domain that doesn't trust its "telephony guys" could h= ave a subordinate name for telephony; e.g., 'sip.example.com' and 'prtp.exa= mple.com' could be run on separate hosts. Separate certificates could be ac= quired for those hostnames. Subordinate usernames under those hosts like 'j= on@sip.example.com' and 'auctioneer@prtp.example.com' could be created. So.= .. The point here is that you're forcing a particular shape of the namespace to accommodate the ability to delegate authorization. What disturbs me is that you're not doing this by shunting the authorization information into a backwater of the namespace (which is what both IIM and DK do), but instead forcing the real life *users* of the=20 namespace to be shunted over there too. That is, I'd have to be known as mat@sip.example.com and mat@prtp.example.com, and so forth. That strikes me as really, really ugly and mostly likely administratively infeasible for large existing domains. Preserving a single name for=20 end identities across different services seems like it should be a *requirement* to me. As in, a first principle. I'm afraid that the rest of your argument falls apart if that requirement is accepted. Mike --=-XB6QBAwDsY4G0nWvQYY4 Content-Type: application/pgp-signature; name=signature.asc Content-Description: This is a digitally signed message part -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.3 (GNU/Linux) iQCVAwUAQmbrDrMsDAj/Eq++AQKPowP9Ftp5NNhdw1mT63qKXkC+JnJhvyaZHAEp OHIDpqZAq7P2RDMcGa53Bq4fSUM/iA+spoZW8WmXP1BLFORSUj151F+XJvG9t3PY UjyHRFT2FCVIPaj2ZnrDwZ6Oh9+CV1qGFyH17C3HP4WhavjgGyXuGVGkREU+9xLz LSwnIhpPi9M= =R/+2 -----END PGP SIGNATURE----- --=-XB6QBAwDsY4G0nWvQYY4-- --===============1763705333== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip --===============1763705333==-- From sip-bounces@ietf.org Wed Apr 20 20:12:56 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DOPIm-0006Db-3l; Wed, 20 Apr 2005 20:12:16 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DOPIi-0006DL-JH for sip@megatron.ietf.org; Wed, 20 Apr 2005 20:12:12 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA11707 for ; Wed, 20 Apr 2005 20:12:09 -0400 (EDT) Received: from oak.neustar.com ([209.173.53.70]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DOPU1-0005su-Kt for sip@ietf.org; Wed, 20 Apr 2005 20:23:54 -0400 Received: from stntsmtp1.cis.neustar.com (smartexch.neustar.com [10.31.13.79]) by oak.neustar.com (8.12.8/8.11.0) with ESMTP id j3L0C0KD027426; Thu, 21 Apr 2005 00:12:00 GMT Received: from stntexch03.cis.neustar.com ([10.31.13.45]) by stntsmtp1.cis.neustar.com with Microsoft SMTPSVC(6.0.3790.211); Wed, 20 Apr 2005 20:12:00 -0400 X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0 Content-class: urn:content-classes:message MIME-Version: 1.0 Subject: RE: sipping-retarget (was RE: [Sip] RE: Question to Identity draft) Date: Wed, 20 Apr 2005 20:11:59 -0400 Message-ID: <24EAE5D4448B9D4592C6D234CBEBD59701502E50@stntexch03.cis.neustar.com> Thread-Topic: sipping-retarget (was RE: [Sip] RE: Question to Identity draft) Thread-Index: AcVFQfiuPr7vm7WhRmGoN9Lb6uNXhQAplgwQ From: "Peterson, Jon" To: "Francois Audet" , "Fries Steffen" , X-OriginalArrivalTime: 21 Apr 2005 00:12:00.0534 (UTC) FILETIME=[BD0BC360:01C54606] X-Spam-Score: 1.9 (+) X-Scan-Signature: 570a5b81f8c75fea8dcc4c9f6a8a6e54 Cc: IETF SIP List X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============1483212622==" Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org This is a multi-part message in MIME format. --===============1483212622== Content-class: urn:content-classes:message Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C54606.BCAE8360" This is a multi-part message in MIME format. ------_=_NextPart_001_01C54606.BCAE8360 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable =20 The idea of providing a 'Connected' header and signing it is the subject = of 2.2.1 of sipping-retarget. It was in fact the strawman against which = the unanticipated respondent problem was defined. Namely, 2.2.1 is = concerned with the fact that impersonation is difficult to even define = when it comes to response identity, because there is no concept of a = unique impersonatable respondent, and consequently it is impossible for = the UAC to know who is actually authorized to respond - it must assume = that virtually anyone could legitimately be answering. It is possible to = detect an impersonation of a particular someone; very difficult, and = most likely self-defeating, to try to detect the impersonation of = virtually anyone. I'm not sure how your points below (in the first part) = provide us with any traction on this issue. =20 Regarding your flow for sipping-certs, a few comments. First of all, = yes, Alice could include her certificate in an INVITE, thereby obviating = 4 and 5 (and 11 and 12). I don't think sipping-certs meant to rule that = out; the point is, before one sends a request, it is useful to be able = to look up the cert in a repository rather than just sending an INVITE = without SDP or something - the same principle clearly does not apply to = receiving a request, wherein the request itself can always provide the = caller's cert.=20 =20 More importantly, I think the promise of a certs-like approach lies in = what happens in step 2. If the cert store has access to Bob's location = service, the cert store may be able to anticipate that Alice needs to = talk to Carol right now, not Bob. If that's the case, maybe sending back = a NOTIFY with Bob's cert isn't the right thing to do in this instance. =20 The whole point of having things like SUBSCRIBE/NOTIFY in the SIP = protocol is to allow the network to adapt to changing conditions in real = time. If Bob is no longer the person that you're going to reach when you = call Bob, and your request will only work for Bob (e.g., you're going to = encrypt it with Bob's public key), the cert store should be able to tell = you that this isn't going to work, and potentially give you some idea of = who you will reach. To be clear, I'm not suggesting that sipping-certs = provides a mechanism for this today - but I am arguing that the = fundamental -approach- of sipping-certs allows for this sort of = functionality, and that this could potentially eliminate surprise 493 = responses. =20 Of course, even if a cert store has access to a location service, it may = be in no position to tell you who is going to pick up the call. It may = be that Bob has populated his location service with 5 different URIs, = targeting any one of which might result in a completed call or not. In = these cases we are in a genuine quandry. Encrypting an SDP body five = different times, and including all five in a message, is no fun, let = alone discovering the certificates of the five targets. This is a = generic forking problem, though, and it taps into the heart of the = question of whether or not redirection or retargeting is preferable = architecturally. Encrypting to multiple targets has always been one of = forking's known drawbacks. =20 Jon Peterson NeuStar, Inc. -----Original Message----- From: Francois Audet [mailto:audet@nortel.com] Sent: Tuesday, April 19, 2005 5:43 PM To: Peterson, Jon; 'Fries Steffen'; 'fluffy@cisco.com' Cc: 'IETF SIP List' Subject: RE: sipping-retarget (was RE: [Sip] RE: Question to Identity = draft) OK, forget about the idea I was proposing, and instead let's=20 try to achieve it using the something along the lines of the=20 identity draft.=20 What about the connected number information being essentially=20 the same mechanism as what you have for the Calling identity,=20 but provided in the response?=20 Something like a new "Connected header" (or perhaps Contact=20 would be sufficient, I'm not sure), followed by the=20 Identity and Identity-Info? The Identity-Info header could=20 have something like https://biloxy.example.com.=20 The unanticipated respondent problem would be easier to deal=20 with because:=20 - In a lot of case, Bob and Carol (the retargetter and retargettee)=20 could have the same certification authority, so Alice's decision to=20 proceed or not with the call may not require going fetching the=20 yet another certificate.=20 - Maybe we have "Require: connected-identity" header if we need the=20 identity.=20 - Yes, if the SDP was encrypted (because of sRTP or whatever), it would=20 cause another session to be re-established because of the 493 (or=20 other appropriate rejection code).=20 Would that be a good way to solve the Connected number problem?=20 Now, moving to the next problem, the encrypted SDP.=20 Alice wants to call Bob and have secure media (because she is afraid of = hackers=20 tapping in). In fact, she essentially wants all her media encrypted, = regardless of=20 who she talks too, even strangers. She does not have Bob in her contact = list, as she=20 is calling him for the first time. She also doesn't know Carol, his = assistant to whom the=20 call will be retargetted.=20 In the example above, the sequence would be this:=20 1 - Alice sends SUBSCRIBE to Bob to fetch his certificate because she = doesn't have it.=20 2 - Bob sends NOTIFY to Alice with his certificate.=20 3 - Alice sends INVITE to Bob, with SDP encrypted using Bob's key, along = with her Identity=20 4 - Bob doesnt' have Alice's certificate, so he sends SUBSCRIBE to Alice = to fetch her cert.=20 5 - Alice sends NOTIFY to Bob with her certificate.=20 6 - Bob retargets to Carol (forwards the INVITE to Carol).=20 7 - Carol responds with 493, since she can't decode the SDP, and = includes her Contact=20 and her Identity.=20 8 - Alice sends SUBSCRIBE to Carol to get her cert.=20 9 - Carol sends NOTIFY to Alice with her cert.=20 10 - Alice sends INVITE to Alice with her Identity, encrypted with = Carol's key.=20 11 - Carol sends Alice a SUBSCRIBE to get her certificate.=20 12 - Alice sends NOTIFY to Carol with her certificate.=20 13 - Carol sends 200 OK to Alice, with SDP encrypted using Alice's key.=20 This is way too complicated and will take forever to complete a call. = And in my mind,=20 lots (if not the majority) of calls would look like this in environments = where=20 unanticipated respondents are typical (which is the case for a lot of=20 businesses).=20 Couldn't this be avoided if not only was Identity used in both = directions=20 (solving the unanticipated respondent problem), and if Alice and Carol = also=20 included their user certificate (for the purposed of sRTP) in the INVITE = and=20 493? Instead of a 10 roundtrip session setup, it would be a 2 roundtrip=20 session setup.=20 Of course, in the case of people who know each other, Alice would have = subscribed to=20 Bob and Carol's certificate, so none of this would happen: it would be a = 1 round-trip=20 session setup. In other words, I DO like the Certs draft, and it should = be used=20 whenever possible.=20 > -----Original Message-----=20 > From: Peterson, Jon [ mailto:jon.peterson@neustar.biz]=20 > Sent: Monday, April 11, 2005 16:09=20 > To: Audet, Francois [SC100:9T51:EXCH]; Fries Steffen; fluffy@cisco.com = > Cc: IETF SIP List=20 > Subject: sipping-retarget (was RE: [Sip] RE: Question to=20 > Identity draft)=20 >=20 >=20 >=20 > (maybe this should move to SIPPING, as this is properly about=20 > sipping-retarget, but I'll leave it here for now)=20 >=20 > Francois,=20 >=20 > sipping-retarget-00 is not intended to provide a solution=20 > space, if any, for retargeting problems; that is why it may=20 > seem to lack anything by way of a conclusion or concrete=20 > proposal. When the draft gets revised, I may try to insert=20 > some more speculation about the plausible parameters for some=20 > limited-scope fixes, but as it stands, the draft really just=20 > shows why a lot of things won't work.=20 >=20 > I guess I am not convinced that the rough proposal you=20 > outline below really escapes the problems detailed in 2.2.1=20 > and 2.3 of sipping-retarget. The whole issue of using a=20 > certificate to provide connected-party is problematic=20 > because, in order for someone to rely on a cert to identify=20 > the connected-party, it cannot be a self-signed cert. Issuing=20 > publicly-verifiable certs to end users (with subjects of form=20 > sip:jon@example.com or what have you) is known to be=20 > extremely difficult from an operational perspective. Indeed,=20 > if it were plausible to enroll end-users in PKIs, much of the=20 > security work in email, SIP and most other Internet=20 > applications would be taking a radically different form. The=20 > current level of S/MIME support in SIP deployments is a good=20 > indication of how well the implementation community is likely=20 > to react to this appraoch. While the problems in 2.3 are=20 > specific to S/MIME implementations, and thus could=20 > conceivably be addressed with a solution that is predicated=20 > on S/MIME, the problems in 2.2 and 2.2.1 are really generic=20 > ones that need to be addressed for clients that don't support=20 > S/MIME (since S/MIME is, as we all know, only a MAY in RFC3261).=20 >=20 > Even if there were a CA-signed certificate passed in the=20 > backwards direction which could tell a UAC whom is responding=20 > to their request, that doesn't make the remote side any less=20 > unanticipated, nor tell the UAC whether or not it should=20 > encrypt future calls to the original Request-URI with this=20 > certificate, nor tell the UAC how to deal with multiple=20 > responses that contain different certificates, and so on.=20 >=20 > Regarding your suggestion to encrypt or withhold SDP, how=20 > would you ever decide it is safe to provide SDP in an INVITE,=20 > if essentially it is possible for any INVITE to be=20 > retargeted? That is tantamount to always requiring a=20 > two-phase INVITE. When you encrypt the SDP body initially, at=20 > least that only results in a two-phase handshake for SIP when=20 > retargeting has occurred, but in either case this is a=20 > definite liability. Whenever there is a possibility of a=20 > two-phase handshake, there is a possibility that the=20 > certificate you acquire in the first phase will not work for=20 > the second phase, unless you change the target URI for the=20 > request (like you suggest below, using a GRUU or something).=20 > However, changing the target URI for the request may be=20 > self-defeating. If I am trying to call you, and I get=20 > retargeted to Steffen, and Steffen provides me his=20 > certificate... and then you become available before I send=20 > the second phase INVITE... what is the desired effect? Am I=20 > actually trying to contact you or Steffen? If I'm trying to=20 > talk to you, why am I encrypting my message with Steffen's=20 > certificate? But of course I may not even know the=20 > difference, if any, between "you" and the URI to which I have=20 > been retargeted. If I'm trying to send an INVITE to you, and=20 > I get back a 493 with a certificate for something really=20 > opaque, like 'sip:user51@example.com', how am I supposed to=20 > understand that? Is that URI a pseudonym for you, or does it=20 > represent someone else? Do I want to encrypt my message with=20 > that certificate or not? Do I want to use that certificate in=20 > the future when I try to contact you?=20 ------_=_NextPart_001_01C54606.BCAE8360 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable RE: sipping-retarget (was RE: [Sip] RE: Question to Identity = draft)
 
The=20 idea of providing a 'Connected' header and signing it is the subject of = 2.2.1 of=20 sipping-retarget. It was in fact the strawman against which the = unanticipated=20 respondent problem was defined. Namely, 2.2.1 is concerned with the fact = that=20 impersonation is difficult to even define when it comes to response = identity,=20 because there is no concept of a unique impersonatable respondent, and=20 consequently it is impossible for the UAC to know who is actually = authorized to=20 respond - it must assume that virtually anyone could legitimately be = answering.=20 It is possible to detect an impersonation of a particular someone; very=20 difficult, and most likely self-defeating, to try to detect the = impersonation of=20 virtually anyone. I'm not sure how your points below (in the first part) = provide=20 us with any traction on this issue.
 
Regarding your flow for sipping-certs, a few = comments.=20 First of all, yes, Alice could include her certificate in an INVITE, = thereby=20 obviating 4 and 5 (and 11 and 12). I don't think sipping-certs meant to = rule=20 that out; the point is, before one sends a request, it is useful to be = able to=20 look up the cert in a repository rather than just sending an INVITE = without SDP=20 or something - the same principle clearly does not apply to = receiving=20 a request, wherein the request itself can always provide the caller's = cert.=20
 
More=20 importantly, I think the promise of a certs-like approach lies in what = happens=20 in step 2. If the cert store has access to Bob's location service, the = cert=20 store may be able to anticipate that Alice needs to talk to Carol right = now, not=20 Bob. If that's the case, maybe sending back a NOTIFY with Bob's cert = isn't the=20 right thing to do in this instance.
 
The=20 whole point of having things like SUBSCRIBE/NOTIFY in the SIP protocol = is to=20 allow the network to adapt to changing conditions in real time. If Bob = is no=20 longer the person that you're going to reach when you call Bob, and your = request=20 will only work for Bob (e.g., you're going to encrypt it with Bob's = public=20 key), the cert store should be able to tell you that this isn't going to = work,=20 and potentially give you some idea of who you will reach. To be clear, = I'm not=20 suggesting that sipping-certs provides a mechanism for this today - but = I am=20 arguing that the fundamental -approach- of sipping-certs allows for this = sort of=20 functionality, and that this could potentially eliminate surprise 493=20 responses.
 
Of=20 course, even if a cert store has access to a location service, it = may be in=20 no position to tell you who is going to pick up the call. It may be that = Bob has=20 populated his location service with 5 different URIs, targeting any one = of=20 which might result in a completed call or not. In these cases = we are=20 in a genuine quandry. Encrypting an SDP body five different times, and = including=20 all five in a message, is no fun, let alone discovering the certificates = of the=20 five targets. This is a generic forking problem, though, and it taps = into the=20 heart of the question of whether or not redirection or retargeting is = preferable=20 architecturally. Encrypting to multiple targets has always been one of = forking's=20 known drawbacks.
 
Jon=20 Peterson
NeuStar, Inc.
-----Original Message-----
From: Francois Audet=20 [mailto:audet@nortel.com]
Sent: Tuesday, April 19, 2005 5:43 = PM
To: Peterson, Jon; 'Fries Steffen';=20 'fluffy@cisco.com'
Cc: 'IETF SIP List'
Subject: = RE:=20 sipping-retarget (was RE: [Sip] RE: Question to Identity=20 draft)


OK, forget about the idea I was proposing, and = instead=20 let's
try to achieve it using the something = along the=20 lines of the
identity draft.

What about the connected number information being=20 essentially
the same mechanism as what you = have for=20 the Calling identity,
but provided in the=20 response?

Something like a new "Connected header" (or perhaps=20 Contact
would be sufficient, I'm not sure), = followed=20 by the
Identity and Identity-Info? The = Identity-Info=20 header could
have something like https://biloxy.example.com.

The unanticipated respondent problem would be easier = to=20 deal
with because:
- In a lot=20 of case, Bob and Carol (the retargetter and retargettee) =
  could have the same certification authority, so = Alice's decision=20 to
  proceed or not with the call may = not require=20 going fetching the
  yet another=20 certificate.
- Maybe we have "Require:=20 connected-identity" header if we need the
 =20 identity.
- Yes, if the SDP was encrypted = (because of=20 sRTP or whatever), it would
  cause = another=20 session to be re-established because of the 493 (or
  other appropriate rejection code).

Would that be a good way to solve the Connected = number=20 problem?

Now, moving to the next problem, the encrypted SDP.=20

Alice wants to call Bob and have secure media = (because she is=20 afraid of hackers
tapping in).  In = fact, she=20 essentially wants all her media encrypted, regardless of =
who she talks too, even strangers. She does not have Bob in = her contact=20 list, as she
is calling him for the first = time. She=20 also doesn't know Carol, his assistant to whom the
call will be retargetted.

In the example above, the sequence would be = this:

1 - Alice sends SUBSCRIBE to Bob to fetch his = certificate=20 because she doesn't have it.
2 - Bob sends = NOTIFY to=20 Alice with his certificate.
3 - Alice sends = INVITE to=20 Bob, with SDP encrypted using Bob's key, along with her = Identity=20
4 - Bob doesnt' have Alice's certificate, so he = sends=20 SUBSCRIBE to Alice to fetch her cert.
5 - = Alice sends=20 NOTIFY to Bob with her certificate.
6 - Bob = retargets=20 to Carol (forwards the INVITE to Carol).
7 - = Carol=20 responds with 493, since she can't decode the SDP, and includes her=20 Contact
    and her = Identity.=20
8 - Alice sends SUBSCRIBE to Carol to get her = cert.=20
9 - Carol sends NOTIFY to Alice with her = cert.=20
10 - Alice sends INVITE to Alice with her Identity, = encrypted=20 with Carol's key.
11 - Carol sends Alice a = SUBSCRIBE=20 to get her certificate.
12 - Alice sends = NOTIFY to=20 Carol with her certificate.
13 - Carol sends = 200 OK to=20 Alice, with SDP encrypted using Alice's key.

This is way too complicated and will take forever to = complete=20 a call. And in my mind,
lots (if not the = majority) of=20 calls would look like this in environments where
unanticipated respondents are typical (which is the case for = a lot=20 of
businesses).

Couldn't this be avoided if not only was Identity = used in both=20 directions
(solving the unanticipated = respondent=20 problem), and if Alice and Carol also
included their=20 user certificate (for the purposed of sRTP) in the INVITE and =
493? Instead of a 10 roundtrip session setup, it would be a 2 = roundtrip
session setup.

Of course, in the case of people who know each = other, Alice=20 would have subscribed to
Bob and Carol's = certificate,=20 so none of this would happen: it would be a 1 round-trip =
session setup. In other words, I DO like the Certs draft, and = it should=20 be used
whenever possible.


> -----Original Message-----
>=20 From: Peterson, Jon [mailto:jon.peterson@neustar.biz<= /A>]=20
> Sent: Monday, April 11, 2005 = 16:09=20
> To: Audet, Francois [SC100:9T51:EXCH]; Fries = Steffen;=20 fluffy@cisco.com
> Cc: IETF SIP = List=20
> Subject: sipping-retarget (was RE: [Sip] RE: = Question to=20
> Identity draft)
>=20
>
> =
> (maybe this should move to SIPPING, as this is properly = about=20
> sipping-retarget, but I'll leave it = here for=20 now)
>
>=20 Francois,
>
>=20 sipping-retarget-00 is not intended to provide a solution =
> space, if any, for retargeting problems; that is why it = may=20
> seem to lack anything by way of a = conclusion or=20 concrete
> proposal. When the draft gets = revised, I=20 may try to insert
> some more speculation = about the=20 plausible parameters for some
> = limited-scope=20 fixes, but as it stands, the draft really just
>=20 shows why a lot of things won't work.
>=20
> I guess I am not convinced that the = rough=20 proposal you
> outline below really = escapes the=20 problems detailed in 2.2.1
> and 2.3 of=20 sipping-retarget. The whole issue of using a
>=20 certificate to provide connected-party is problematic
> because, in order for someone to rely on a cert to = identify=20
> the connected-party, it cannot be a = self-signed=20 cert. Issuing
> publicly-verifiable certs = to end=20 users (with subjects of form
> = sip:jon@example.com=20 or what have you) is known to be
> = extremely=20 difficult from an operational perspective. Indeed,
> if it were plausible to enroll end-users in PKIs, much = of the=20
> security work in email, SIP and most = other=20 Internet
> applications would be taking a = radically=20 different form. The
> current level of = S/MIME=20 support in SIP deployments is a good
> = indication=20 of how well the implementation community is likely
> to react to this appraoch. While the problems in 2.3 are =
> specific to S/MIME implementations, and = thus=20 could
> conceivably be addressed with a = solution=20 that is predicated
> on S/MIME, the = problems in 2.2=20 and 2.2.1 are really generic
> ones that = need to be=20 addressed for clients that don't support
> S/MIME=20 (since S/MIME is, as we all know, only a MAY in RFC3261). =
>
> Even if there were a = CA-signed=20 certificate passed in the
> backwards = direction=20 which could tell a UAC whom is responding
> to=20 their request, that doesn't make the remote side any less =
> unanticipated, nor tell the UAC whether or not it should =
> encrypt future calls to the original = Request-URI=20 with this
> certificate, nor tell the UAC = how to=20 deal with multiple
> responses that = contain=20 different certificates, and so on.
>=20
> Regarding your suggestion to encrypt or = withhold=20 SDP, how
> would you ever decide it is = safe to=20 provide SDP in an INVITE,
> if = essentially it is=20 possible for any INVITE to be
> = retargeted? That is=20 tantamount to always requiring a
> = two-phase=20 INVITE. When you encrypt the SDP body initially, at
> least that only results in a two-phase handshake for SIP = when=20
> retargeting has occurred, but in either = case this=20 is a
> definite liability. Whenever there = is a=20 possibility of a
> two-phase handshake, = there is a=20 possibility that the
> certificate you = acquire in=20 the first phase will not work for
> the = second=20 phase, unless you change the target URI for the
>=20 request (like you suggest below, using a GRUU or something). =
> However, changing the target URI for the request may be=20
> self-defeating. If I am trying to call = you, and I=20 get
> retargeted to Steffen, and Steffen = provides=20 me his
> certificate... and then you = become=20 available before I send
> the second = phase=20 INVITE... what is the desired effect? Am I
>=20 actually trying to contact you or Steffen? If I'm trying to =
> talk to you, why am I encrypting my message with = Steffen's=20
> certificate? But of course I may not = even know=20 the
> difference, if any, between "you" = and the URI=20 to which I have
> been retargeted. If I'm = trying to=20 send an INVITE to you, and
> I get back a = 493 with=20 a certificate for something really
> = opaque, like=20 'sip:user51@example.com', how am I supposed to
>=20 understand that? Is that URI a pseudonym for you, or does it =
> represent someone else? Do I want to encrypt my message = with=20
> that certificate or not? Do I want to = use that=20 certificate in
> the future when I try to = contact=20 you?

------_=_NextPart_001_01C54606.BCAE8360-- --===============1483212622== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip --===============1483212622==-- From sip-bounces@ietf.org Wed Apr 20 20:38:24 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DOPi4-000136-CQ; Wed, 20 Apr 2005 20:38:24 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DOPi0-00012y-W0 for sip@megatron.ietf.org; Wed, 20 Apr 2005 20:38:21 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA14196 for ; Wed, 20 Apr 2005 20:38:19 -0400 (EDT) Received: from sj-iport-4.cisco.com ([171.68.10.86]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DOPtK-0006U1-W2 for sip@ietf.org; Wed, 20 Apr 2005 20:50:03 -0400 Received: from sj-core-5.cisco.com (171.71.177.238) by sj-iport-4.cisco.com with ESMTP; 20 Apr 2005 17:37:58 -0700 Received: from wells.cisco.com (wells.cisco.com [171.71.177.223]) by sj-core-5.cisco.com (8.12.10/8.12.6) with ESMTP id j3L0buhu026519; Wed, 20 Apr 2005 17:37:56 -0700 (PDT) Received: from jmpolk-w2k01.diablo.cisco.com (ssh-sjc-1.cisco.com [171.68.225.134]) by wells.cisco.com (8.8.6 (PHNE_14041)/CISCO.SERVER.1.2) with ESMTP id RAA07001; Wed, 20 Apr 2005 17:37:55 -0700 (PDT) Message-Id: <4.3.2.7.2.20050420193616.03334cd0@localhost> X-Sender: jmpolk@localhost X-Mailer: QUALCOMM Windows Eudora Version 4.3.2 Date: Wed, 20 Apr 2005 19:37:58 -0500 To: Udit_Goyal@3com.com, "SIP Implementors" , "SIP IETF" From: "James M. Polk" Subject: Re: [Sip] Busy condition In-Reply-To: Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-Spam-Score: 1.1 (+) X-Scan-Signature: b1c41982e167b872076d0018e4e1dc3c Cc: X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org SIP is extensible, write an ID and see if it gains any traction BTW - The busy condition is pretty well spelled out in several RFCs and IDs, isn't it? At 07:13 PM 4/20/2005 -0400, Udit_Goyal@3com.com wrote: >Hi, > >Just want to make sure if it is possible to add more warning codes for >Warning header >or is it limited to 3xx values as defined in RFC 3261. > >Otherwise, we can define some standard reason phrase for the common erro >scenarios responses. > >-Udit > >----- Forwarded by Udit Goyal/C/US/3Com on 04/20/2005 07:01 PM ----- >Udit Goyal/C/US/3Com > >04/19/2005 02:33 PM >To >Wayne.Davies@mmv.vic.gov.au >cc >sip-implementors@cs.columbia.edu, sip@ietf.org >Subject >Re: [Sip-implementors] Busy >conditionLink > > > > >Hi Wayne, > >I agree that for Warning header field, the scope is limited because of the >codes already defined in 3261 >Moreover, they mainy defines the failures induced by the SDP > >Giving more error status information in the reason phrase is also ok but >it is more like implementation dependent as per RFC 3261. >It does not define any standard error phrases for this purpose. > >Even we cant use "Reason" header (RFC 3326) for this purpose because it >defines cause to be the SIP status code so it will also not serve any purpose. > >What I think is providing more error warning codes for failure cases will >be better as error codes are always better than reason phrases because of >ease of automatic action. >Cant we have something like 4xx warning codes too.. or is it like 3xx is >only available for SIP. > >-Udit > > > >Wayne.Davies@mmv.vic.gov.au >Sent by: sip-implementors-bounces@cs.columbia.edu > >04/19/2005 01:43 AM >To >Udit Goyal/C/US/3Com@3Com >cc >sip-implementors-bounces@cs.columbia.edu, sip-implementors@cs.columbia.edu >Subject >Re: [Sip-implementors] Busy condition > > > > > > > > >Udit, >Both methods of communicating more detail for the error condition >seem valid / ok to me. > >It appears the main difference in their use is that the Warning >header entries are mandated in 3261 and furthered by IANA registered ones. >The warning codes range for SIP is stated as being the 3xx block which are >already divided up into categories, currently there seems limited scope in >using this range (390 - 399 for miscellaneous). > >3261 supports extending the default reason phrase for responses and >gives some specific examples of this is advocated 261 gives examples of >doing this for specific responses (182, 400, 480). Advocating a standard >for the wording for common conditions like your examples below might be a >good idea. > >Regards - Wayne. > > >Udit asked: >************************************************************* >Hi, > >I was just wondering that are there any ways to give different indications >when user is not able to take the call. >There are error responses like 480, 486 used to indicate the busy >condition but still they are not able to indicate the exact failure >status. >However, there can be scenarios like: >i) User rejects the call. >ii) All lines are busy and user cant take the call. >iii) Ringing timeout occur: No Answer and more.... > >I feel there are possibilities of indicating to the end user by using >error response status text, "Warning" header, or "Reason" header. >Please let me know which is more standard approach followed. > >Thanks, >Udit > > > >_______________________________________________ >Sip-implementors mailing list >Sip-implementors@cs.columbia.edu >http://lists.cs.columbia.edu/mailman/listinfo/sip-implementors >_______________________________________________ >Sip mailing list https://www1.ietf.org/mailman/listinfo/sip >This list is for NEW development of the core SIP Protocol >Use sip-implementors@cs.columbia.edu for questions on current sip >Use sipping@ietf.org for new developments on the application of sip cheers, James ******************* Truth is not to be argued... it is to be presented _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Wed Apr 20 21:37:25 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DOQdB-0008Jw-TQ; Wed, 20 Apr 2005 21:37:25 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DOQd9-0008Jd-3p for sip@megatron.ietf.org; Wed, 20 Apr 2005 21:37:24 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA18514 for ; Wed, 20 Apr 2005 21:37:21 -0400 (EDT) Received: from oak.neustar.com ([209.173.53.70]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DOQoR-0007jt-EM for sip@ietf.org; Wed, 20 Apr 2005 21:49:06 -0400 Received: from stntsmtp1.cis.neustar.com (smartexch.neustar.com [10.31.13.79]) by oak.neustar.com (8.12.8/8.11.0) with ESMTP id j3L1aAKD029623; Thu, 21 Apr 2005 01:36:10 GMT Received: from stntexch03.cis.neustar.com ([10.31.13.45]) by stntsmtp1.cis.neustar.com with Microsoft SMTPSVC(6.0.3790.211); Wed, 20 Apr 2005 21:36:10 -0400 X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Subject: RE: authority for a domain (was RE: [Sip]sip-identity-05:display-name woes) Date: Wed, 20 Apr 2005 21:36:10 -0400 Message-ID: <24EAE5D4448B9D4592C6D234CBEBD59701502E51@stntexch03.cis.neustar.com> Thread-Topic: authority for a domain (was RE: [Sip]sip-identity-05:display-name woes) Thread-Index: AcVGA+vECNG0L0hOQgW4Pl8nIgvpIgAAyfnw From: "Peterson, Jon" To: "Michael Thomas" X-OriginalArrivalTime: 21 Apr 2005 01:36:10.0483 (UTC) FILETIME=[7F0CD430:01C54612] X-Spam-Score: 0.0 (/) X-Scan-Signature: 5fb88b8381f3896aeacc5a021513237b Content-Transfer-Encoding: quoted-printable Cc: sip@ietf.org, Francois Audet , Paul Kyzivat X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org Mike, This is likely to continue to be a conversation in which we talk past = one another. Below, you've taken my attempt to establish some common = ground about name subordination and submitted that instead, each bullet = should be about the requirements of an identity system. I'm talking = about one thing, you're talking about something else entirely. As an = aside, I don't disagree substantially with any of the requirements you = outlined, and I think they are largely met by sip-identity. Clearly, if you disagree so vehemently with the fundamental assumptions = underlying sip-identity, then no solutions in this space will make you = happy. It is true that I believe the DNS and its associated hierarchical = structure and concepts of authority are integral to how we understand = authority over SIP identities, because SIP identities are names rooted = in the DNS. I think that disregarding the delegation of authority in the = DNS would result in a design for SIP identities that does not correspond = to the way SIP users are enrolled nor the manner in which SIP requests = are routed. That much said, aside from concerns about the assumptions = and how the problem has been cast, you seem to have three concrete = points of discomfiture below: - You don't believe that existing CAs which issue certificates for web = sites (i.e., for domain names) have enrollment policies that restrict = the issuance of certificates to the owners of the domain names in = question; instead, you believe these CAs issue you a certificate "for = whatever reason they wanted to", - You don't believe that a signature generated with the private key = corresponding to a certificate serves to authenticate the entity to = which the certificate was issued ("Sorry this is just fundamentally = wrong", you say), - You assert that sip-identity is not useful unless it has a mechanism = that will prevent any need for namespace "shunting"; that is, being = forced to take users with AoRs of form 'sip:jon@example.com' and move = them to the namespace 'sip:jon@sip.example.com', in order to accommodate = the architecture of sip-identity ("the rest of your argument falls apart = if that requirement is accepted", you say, apparently neglecting that = the "argument" of the paragraphs after the one you are commenting on = accept and discuss the solution for this requirement). To which I will reply, in order: - I believe that existing CAs which offer certs to web sites have an = enrollment process which verifies ownership of the requested domain = name. If you disagree, please go to Verisign, GoDaddy or GeoTrust and = procure a certificate for 'www.amazon.com' and post it to this list. = I'll pay you back for the certificate later. - I believe that when I form a TLS connection to www.amazon.com, I = download a certificate which allows me to verify that = integrity-protected content sent over the TLS connection actually comes = from the organization authoritative for the name 'www.amazon.com'. I = believe that if we don't understand certificates this way, e-commerce = security is nonsensical. - In my previous mail, and in the draft, I acknowledged that this is a = limitation of sip-identity, though I don't share your apocalyptic = feelings about it. I agree it is a requirement, and it is, as I said, a = subject for future work. I outlined the form I believed that future work = would take, and I think it is a reasonable approach to the problem. = Perhaps the reason why I don't feel so apocalyptic about this one is = that I can envision reasonable deployment environments in which SIP = identity could be deployed without shunting. Shunting happens when = administrations have pre-existing SIP namespaces and in which they are = unwilling to allow a SIP auth service to have access to the private key = of a cert corresponding to the domain portion of that namespace. There = are no doubt administrations that meet that description and those that = do not. We could, of course, block sip-identity from a standardization = perspective until we complete work on an MX-like way for verifiers to = determine what auth service is authoritative for a domain... but I = continue to believe it is worth publishing sip-identity without this = capability and defining it after the fact. Incidentally, I have been aware of the various MASS drafts for some = time, and I continue to believe that there are far more similarities = than differences between sip-identity and the MASS efforts. However, SIP = and email are slightly different problem spaces for identity , and I = don't think that there is a lot to be gained from importing from IIM or = DK into sip-identity. I did make the check, at one point, though, to see = if there was anything we could glean there. One major distinction is = that SIP has not yet enjoyed the universal deployment of email, and = accordingly, we have a bit of wiggle-room still in making surgical = changes to the protocol and deployment environment. Jon Peterson NeuStar, Inc. > -----Original Message----- > From: Michael Thomas [mailto:mat@cisco.com] > Sent: Wednesday, April 20, 2005 4:52 PM > To: Peterson, Jon > Cc: sip@ietf.org; Francois Audet; Paul Kyzivat > Subject: RE: authority for a domain (was RE: > [Sip]sip-identity-05:display-name woes) >=20 >=20 > On Wed, 2005-04-20 at 13:29, Peterson, Jon wrote: > > I fear that we're talking way past one another, Mike, but=20 > I'll try to go a little farther with this to see if we can=20 > find any common ground... > > =20 > > > > The draft does assume that if you hold a cert for=20 > > > example.com (i.e., a CA-signed cert with the subjectAltName=20 > > > 'example.com'), then you are the legitimate authority for=20 > > > example.com.=20 > > >=20 > > > Authority for _what_? SIP? Prize Rooster trading? All of the > > > above? If not all of the above, what if I want to use the > > > same technique for the Prize Rooster Trading Protocol... but > > > it seems that I can't because SIP got there first[*]. If it is > > > all of the above, then that's a real problem in the delegation > > > arena since I don't want my telephony guys having any authority > > > over who's allowed to trade my Prize Roosters. > >=20 > > To answer the question "Authority for what?", let's go back=20 > to first principles, here.=20 >=20 > Going back to first principles is fine -- in fact that's what=20 > I've been > trying to accomplish. The problem I see is that you have a solution in > mind already and are arguing backward from there. That is,=20 > you're taking > PKI namespaces and DNS as being primaries. They are not. It would help > a lot if you understood what we've done with IIM for email (as well as > Yahoo's Domain Keys), because they approach a very similar=20 > problem space > making different tradeoffs. It also helps greatly because there > are existence proofs of both of these protocols which are=20 > deployed today > which as far as I can tell is not the case for sip-identity=20 > (in the case > of DK, dozens of large ISP signing 100's of millions of email a day). > Also: as one of the implementors of IIM, I have a very good feel for > what is implementable; sip-identity is no where close to ready for=20 > prime time. Harsh yes, but I just wanted to set straight that I'm > not here just to be argumentative. >=20 > > If I own a name in the DNS, I am empowered to create=20 > subordinate names. There are four administrative procedures=20 > relating to subordinate names which are salient to this discussion: > >=20 > > 1) If I own the name 'example.com', I can create a=20 > subordinate name called 'mail.example.com'.=20 >=20 > This is not a first principle. The first principle is that I=20 > have names > that I'd like to assert as being legitimately from my domain for > particular services. A second principle is that I'd like to be able > to delegate namespace/service pairs to entities within my organization > to whom I authorize to use my namespace for a particular purpose. DNS > delegation may or may not be an ends to those principles. >=20 > > 2) I can also run services on the host 'example.com' which=20 > have different accounts, users, or whatever, and for the=20 > purposes of those services, names like 'jon@example.com'=20 > might be created. >=20 > This is confused: the first principle here is that services=20 > want to use > nodes within a namespace. It's not helping here because example.com > can be a host, but I sense that you mean example.com the domain. >=20 > > =20 > > 3) I can furthermore run services on a host with a=20 > subordinate name, and the users of that service might be=20 > issued names like 'jon@mail.example.com' >=20 > Or I can run service SIP on host1.example.com and SMTP on > host2.example.com for the name mat@example.com. The first > principle here is that I'd like to be able to authorize > host1 to assert names in SIP messages for some or all of=20 > example.com's namespace. DNS delegation isn't the primary=20 > property here: it seems to be an artifact of a particular=20 > model you are using to achieve the this authorization. >=20 > > 4) Finally, I can mark up the DNS to link services=20 > associated with the name 'example.com' to particular services=20 > running on subordinate hosts; e.g., the MX record linking=20 > mail services for 'example.com' to 'mail.example.com', or the=20 > comparable procedures for SIP using NAPTR and SRV. >=20 > Again, this isn't the first principle: I'd say that it is:=20 > domains would > like to send messages to domains with which there can be no assumption > of prior knowledge. Further, we want the receiving domain to be able > to detect authorized from unauthorized use of a purported sending > domain's namespace/service pair. This doesn't *necessarily* entail > the use of DNS though it may. >=20 >=20 > > If I am the owner of 'example.com', I can go get a cert=20 > from a CA for 'example.com'.=20 > > What that cert signifies, ultimately, is that I am the=20 > administrator of the name 'example.com',=20 >=20 > No. Not at all. It means only that the operator of the CA delegated=20 > you the name example.com for whatever reason they wanted to=20 > delegate you > that name. It most certainly doesn't imply any sort of role.=20 > A protocol > might want to define such roles, but it is *not* inherent in the=20 > credential itself. >=20 > > and consequently that I am empowered to create subordinate=20 > names per (1) and (2) above.=20 >=20 > A CA or DNS administrator is empowered do this, but that doesn't > directly address my version of (4). Again, you have a particular > model in mind here which is what I'm questioning. >=20 > > Consequently, when a certificate is used to secure=20 > communications, it signifies to you (the recipient) that you=20 > are receiving this information from the administrator of the=20 > namespace=20 >=20 > No it doesn't. Sorry this is just fundamentally wrong. There=20 > is nothing=20 > inherent in a subjectAltName that says that. You might devise a=20 > protocol which forces a receiver to make that assumption, but > that's the protocol's doing, not the credential itself. Again, you've > got a particular design in mind here, and the problems that I'm having > is with the implications of your assumptions. >=20 > > Your point above seems to be that a certificate for=20 > 'example.com' is too broad a tool for a SIP authentication=20 > service to use, because SIP is just one service, and domain=20 > administrators would not want to empower a SIP auth service=20 > to speak for any and all services of 'example.com'. >=20 > Yes. >=20 > > After all, if the private key for 'example.com' is=20 > resident on a host running a SIP auth service, that host=20 > could create signatures over messages or documents for all=20 > kinds of non-SIP applications. Accordingly, using a cert with=20 > a subject(AltName) of 'example.com' to sign SIP requests is=20 > not feasible. > >=20 > > But of course, any domain that doesn't trust its "telephony=20 > guys" could have a subordinate name for telephony; e.g.,=20 > 'sip.example.com' and 'prtp.example.com' could be run on=20 > separate hosts. Separate certificates could be acquired for=20 > those hostnames. Subordinate usernames under those hosts like=20 > 'jon@sip.example.com' and 'auctioneer@prtp.example.com' could=20 > be created. So... >=20 > The point here is that you're forcing a particular shape of the > namespace to accommodate the ability to delegate authorization. What > disturbs me is that you're not doing this by shunting the=20 > authorization > information into a backwater of the namespace (which is what both > IIM and DK do), but instead forcing the real life *users* of the=20 > namespace to be shunted over there too. That is, I'd have to be known > as mat@sip.example.com and mat@prtp.example.com, and so forth. That > strikes me as really, really ugly and mostly likely administratively > infeasible for large existing domains. Preserving a single name for=20 > end identities across different services seems like it should be a > *requirement* to me. As in, a first principle. >=20 > I'm afraid that the rest of your argument falls apart if that > requirement is accepted. >=20 > Mike >=20 _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Thu Apr 21 00:36:36 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DOTQa-0008S4-PF; Thu, 21 Apr 2005 00:36:36 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DOTQY-0008Rz-1c for sip@megatron.ietf.org; Thu, 21 Apr 2005 00:36:34 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA29372 for ; Thu, 21 Apr 2005 00:36:31 -0400 (EDT) Received: from zcars04f.nortelnetworks.com ([47.129.242.57]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DOTbt-0002mi-Do for sip@ietf.org; Thu, 21 Apr 2005 00:48:18 -0400 Received: from zrtpd0jn.us.nortel.com (zrtpd0jn.us.nortel.com [47.140.202.35]) by zcars04f.nortelnetworks.com (Switch-2.2.6/Switch-2.2.0) with ESMTP id j3L4Zv304300; Thu, 21 Apr 2005 00:35:57 -0400 (EDT) Received: by zrtpd0jn.us.nortel.com with Internet Mail Service (5.5.2653.19) id ; Thu, 21 Apr 2005 00:35:58 -0400 Message-ID: <1ECE0EB50388174790F9694F77522CCF01F98045@zrc2hxm0.corp.nortel.com> From: "Francois Audet" To: "'Peterson, Jon'" , "'Fries Steffen'" , "'fluffy@cisco.com'" Subject: RE: sipping-retarget (was RE: [Sip] RE: Question to Identity draf t) Date: Thu, 21 Apr 2005 00:35:45 -0400 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2653.19) X-Spam-Score: 1.5 (+) X-Scan-Signature: 4bbdb236f788407ff689fcae8109fe34 Cc: 'IETF SIP List' X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============0861665912==" Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. --===============0861665912== Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C5462B.967DC006" This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. ------_=_NextPart_001_01C5462B.967DC006 Content-Type: text/plain It looks like this time, we are going somewhere. See below. -----Original Message----- From: Peterson, Jon [mailto:jon.peterson@neustar.biz] Sent: Wednesday, April 20, 2005 17:12 To: Audet, Francois [SC100:9T51:EXCH]; Fries Steffen; fluffy@cisco.com Cc: IETF SIP List Subject: RE: sipping-retarget (was RE: [Sip] RE: Question to Identity draft) The idea of providing a 'Connected' header and signing it is the subject of 2.2.1 of sipping-retarget. It was in fact the strawman against which the unanticipated respondent problem was defined. Namely, 2.2.1 is concerned with the fact that impersonation is difficult to even define when it comes to response identity, because there is no concept of a unique impersonatable respondent, and consequently it is impossible for the UAC to know who is actually authorized to respond - it must assume that virtually anyone could legitimately be answering. It is possible to detect an impersonation of a particular someone; very difficult, and most likely self-defeating, to try to detect the impersonation of virtually anyone. I'm not sure how your points below (in the first part) provide us with any traction on this issue. I think the solution to this is to have a redirection to the ultimate retargeting endpoint. Let me get to that at the end of the email. Regarding your flow for sipping-certs, a few comments. First of all, yes, Alice could include her certificate in an INVITE, thereby obviating 4 and 5 (and 11 and 12). I don't think sipping-certs meant to rule that out; the point is, before one sends a request, it is useful to be able to look up the cert in a repository rather than just sending an INVITE without SDP or something - the same principle clearly does not apply to receiving a request, wherein the request itself can always provide the caller's cert. Good. That's exactly what I wanted to hear. This idea of having SUBSCRIBEs sent at session setup by the responder (before sending a response) was bothering me quite a bit. Of course, having them available already through Certs, because Bob or Carol already know Alice, is even better. More importantly, I think the promise of a certs-like approach lies in what happens in step 2. If the cert store has access to Bob's location service, the cert store may be able to anticipate that Alice needs to talk to Carol right now, not Bob. If that's the case, maybe sending back a NOTIFY with Bob's cert isn't the right thing to do in this instance. In certain cases, perhaps Bob could send his own certificate, plus Carol's and any other's it might forward to in the immediate future. But, this is not applicable to all scenarios. I can see a lot of cases where this is just plain impossible, and we need a solution for those cases too. Imagine that Bob is a service (like a group list) that dispatches to many different individuals, randomly, or to a bunch of agents that do not share the same cert (e.g., a bunch of insurance company agents, a group of geographically dispersed people in a virtual call center for customer support, etc.). These call center applications will happen all the time, in fact, it seems to me to be a prime candidate to moving from PSTN to SIP because of the increase flexibility in customizing their application (and for reducing cost). Their requirement will often be "I need to encrypt media" and "I need to authenticate the originator". Now, I know you will respond that you could try to anticipate who will respond, but this is just not the way these services operate. The routing decision is made real-time (seconds count) based on the status of the agents (when they hang-up). With forking, it is even worst. To add even more complexity, imagine that Carol is a PSTN user. The network may be using a bunch of PSTN gateways. It may even use a bunch of different service providers to terminate PSTN calls. The algorithm for distributing the calls is their own. It will again not be possible to predict who will answer. This the types of scenarios that I want to make sure we support, and why I think we must have some sort of connected identity. The whole point of having things like SUBSCRIBE/NOTIFY in the SIP protocol is to allow the network to adapt to changing conditions in real time. If Bob is no longer the person that you're going to reach when you call Bob, and your request will only work for Bob (e.g., you're going to encrypt it with Bob's public key), the cert store should be able to tell you that this isn't going to work, and potentially give you some idea of who you will reach. To be clear, I'm not suggesting that sipping-certs provides a mechanism for this today - but I am arguing that the fundamental -approach- of sipping-certs allows for this sort of functionality, and that this could potentially eliminate surprise 493 responses. Yes: sometimes it will work. Other times it won't, as you point out below and as I did above. Of course, even if a cert store has access to a location service, it may be in no position to tell you who is going to pick up the call. It may be that Bob has populated his location service with 5 different URIs, targeting any one of which might result in a completed call or not. In these cases we are in a genuine quandry. Encrypting an SDP body five different times, and including all five in a message, is no fun, let alone discovering the certificates of the five targets. This is a generic forking problem, though, and it taps into the heart of the question of whether or not redirection or retargeting is preferable architecturally. Encrypting to multiple targets has always been one of forking's known drawbacks. Sequential forking is also quite problematic. You could imagine doing these certificate fetching many times before finding the right one. I don't understand what is wrong with "forcing" a redirection at the end of many retargetings. It seems to me that retargeting in the network is here to stay. But, we have the power to force a redirection for the unanticipated respondent problem, at least in the context of identity. When the respondent figures out that he wants its identity to be known to the initiator regardless of retargeting, he could force this redirection. Incidently, this is why I tought that a 3XX response code would be more appropriate than a 493: the reason is that he wants to session to be reinitiated/redirected directly to itself, not through a bunch of retargeting entities. Now, of course, the sender also needs to be able to not go through with a call if the unanticipated answerer is not the suitable. If we mandate the use of 3XX/493 (by the responder) for retargeting when identity is required, then we avoid the problem of the unanticipated responder accepting the call (followed by the sender clearing it after answer which is quite ugly). That 3XX would have an identity and the cert. I like the fact that this solution works well with both the connected identity problem and with the sRTP & S/MIME problem. Jon Peterson NeuStar, Inc. -----Original Message----- From: Francois Audet [mailto:audet@nortel.com] Sent: Tuesday, April 19, 2005 5:43 PM To: Peterson, Jon; 'Fries Steffen'; 'fluffy@cisco.com' Cc: 'IETF SIP List' Subject: RE: sipping-retarget (was RE: [Sip] RE: Question to Identity draft) OK, forget about the idea I was proposing, and instead let's try to achieve it using the something along the lines of the identity draft. What about the connected number information being essentially the same mechanism as what you have for the Calling identity, but provided in the response? Something like a new "Connected header" (or perhaps Contact would be sufficient, I'm not sure), followed by the Identity and Identity-Info? The Identity-Info header could have something like https://biloxy.example.com . The unanticipated respondent problem would be easier to deal with because: - In a lot of case, Bob and Carol (the retargetter and retargettee) could have the same certification authority, so Alice's decision to proceed or not with the call may not require going fetching the yet another certificate. - Maybe we have "Require: connected-identity" header if we need the identity. - Yes, if the SDP was encrypted (because of sRTP or whatever), it would cause another session to be re-established because of the 493 (or other appropriate rejection code). Would that be a good way to solve the Connected number problem? Now, moving to the next problem, the encrypted SDP. Alice wants to call Bob and have secure media (because she is afraid of hackers tapping in). In fact, she essentially wants all her media encrypted, regardless of who she talks too, even strangers. She does not have Bob in her contact list, as she is calling him for the first time. She also doesn't know Carol, his assistant to whom the call will be retargetted. In the example above, the sequence would be this: 1 - Alice sends SUBSCRIBE to Bob to fetch his certificate because she doesn't have it. 2 - Bob sends NOTIFY to Alice with his certificate. 3 - Alice sends INVITE to Bob, with SDP encrypted using Bob's key, along with her Identity 4 - Bob doesnt' have Alice's certificate, so he sends SUBSCRIBE to Alice to fetch her cert. 5 - Alice sends NOTIFY to Bob with her certificate. 6 - Bob retargets to Carol (forwards the INVITE to Carol). 7 - Carol responds with 493, since she can't decode the SDP, and includes her Contact and her Identity. 8 - Alice sends SUBSCRIBE to Carol to get her cert. 9 - Carol sends NOTIFY to Alice with her cert. 10 - Alice sends INVITE to Alice with her Identity, encrypted with Carol's key. 11 - Carol sends Alice a SUBSCRIBE to get her certificate. 12 - Alice sends NOTIFY to Carol with her certificate. 13 - Carol sends 200 OK to Alice, with SDP encrypted using Alice's key. This is way too complicated and will take forever to complete a call. And in my mind, lots (if not the majority) of calls would look like this in environments where unanticipated respondents are typical (which is the case for a lot of businesses). Couldn't this be avoided if not only was Identity used in both directions (solving the unanticipated respondent problem), and if Alice and Carol also included their user certificate (for the purposed of sRTP) in the INVITE and 493? Instead of a 10 roundtrip session setup, it would be a 2 roundtrip session setup. Of course, in the case of people who know each other, Alice would have subscribed to Bob and Carol's certificate, so none of this would happen: it would be a 1 round-trip session setup. In other words, I DO like the Certs draft, and it should be used whenever possible. ------_=_NextPart_001_01C5462B.967DC006 Content-Type: text/html Message
It looks like this time, we are going somewhere.

See below.
-----Original Message-----
From: Peterson, Jon [mailto:jon.peterson@neustar.biz]
Sent: Wednesday, April 20, 2005 17:12
To: Audet, Francois [SC100:9T51:EXCH]; Fries Steffen; fluffy@cisco.com
Cc: IETF SIP List
Subject: RE: sipping-retarget (was RE: [Sip] RE: Question to Identity draft)

 
The idea of providing a 'Connected' header and signing it is the subject of 2.2.1 of sipping-retarget. It was in fact the strawman against which the unanticipated respondent problem was defined. Namely, 2.2.1 is concerned with the fact that impersonation is difficult to even define when it comes to response identity, because there is no concept of a unique impersonatable respondent, and consequently it is impossible for the UAC to know who is actually authorized to respond - it must assume that virtually anyone could legitimately be answering. It is possible to detect an impersonation of a particular someone; very difficult, and most likely self-defeating, to try to detect the impersonation of virtually anyone. I'm not sure how your points below (in the first part) provide us with any traction on this issue.
I think the solution to this is to have a redirection to the ultimate retargeting endpoint. Let me get to that at the end of the email.
Regarding your flow for sipping-certs, a few comments. First of all, yes, Alice could include her certificate in an INVITE, thereby obviating 4 and 5 (and 11 and 12). I don't think sipping-certs meant to rule that out; the point is, before one sends a request, it is useful to be able to look up the cert in a repository rather than just sending an INVITE without SDP or something - the same principle clearly does not apply to receiving a request, wherein the request itself can always provide the caller's cert.  
Good. That's exactly what I wanted to hear.  This idea of having SUBSCRIBEs sent at session setup by the responder (before sending a response) was bothering me quite a bit.
 
Of course, having them available already through Certs, because Bob or Carol already know Alice, is even better.
More importantly, I think the promise of a certs-like approach lies in what happens in step 2. If the cert store has access to Bob's location service, the cert store may be able to anticipate that Alice needs to talk to Carol right now, not Bob. If that's the case, maybe sending back a NOTIFY with Bob's cert isn't the right thing to do in this instance.
In certain cases, perhaps Bob could send his own certificate, plus Carol's and any other's it might forward to in the immediate future.
But, this is not applicable to all scenarios. I can see a lot of cases where this is just plain impossible, and we need a solution for those cases too.
 
Imagine that Bob is a service (like a group list) that dispatches to many different individuals, randomly, or to a bunch of agents that do not share the same cert (e.g., a bunch of insurance company agents, a group of geographically dispersed people in a virtual call center for customer support, etc.). These call center applications will happen all the time, in fact, it seems to me to be a prime candidate to moving from PSTN to SIP because of the increase flexibility in customizing their application (and for reducing cost). Their requirement will often be "I need to encrypt media" and "I need to authenticate the originator". Now, I know you will respond that you could try to anticipate who will respond, but this is just not the way these services operate. The routing decision is made real-time (seconds count) based on the status of the agents (when they hang-up). With forking, it is even worst.
 
To add even more complexity, imagine that Carol is a PSTN user. The network may be using a bunch of PSTN gateways. It may even use a bunch of different service providers to terminate PSTN calls. The algorithm for distributing the calls is their own. It will again not be possible to predict who will answer.
 
This the types of scenarios that I want to make sure we support, and why I think we must have some sort of connected identity.
The whole point of having things like SUBSCRIBE/NOTIFY in the SIP protocol is to allow the network to adapt to changing conditions in real time. If Bob is no longer the person that you're going to reach when you call Bob, and your request will only work for Bob (e.g., you're going to encrypt it with Bob's public key), the cert store should be able to tell you that this isn't going to work, and potentially give you some idea of who you will reach. To be clear, I'm not suggesting that sipping-certs provides a mechanism for this today - but I am arguing that the fundamental -approach- of sipping-certs allows for this sort of functionality, and that this could potentially eliminate surprise 493 responses.
Yes: sometimes it will work. Other times it won't, as you point out below and as I did above.
Of course, even if a cert store has access to a location service, it may be in no position to tell you who is going to pick up the call. It may be that Bob has populated his location service with 5 different URIs, targeting any one of which might result in a completed call or not. In these cases we are in a genuine quandry. Encrypting an SDP body five different times, and including all five in a message, is no fun, let alone discovering the certificates of the five targets. This is a generic forking problem, though, and it taps into the heart of the question of whether or not redirection or retargeting is preferable architecturally. Encrypting to multiple targets has always been one of forking's known drawbacks.
Sequential forking is also quite problematic. You could imagine doing these certificate fetching many times before finding the right one.
 
I don't understand what is wrong with "forcing" a redirection at the end of many retargetings. It seems to me that retargeting in the network is here to stay. But, we have the power to force a redirection for the unanticipated respondent problem, at least in the context of identity. When the respondent figures out that he wants its identity to be known to the initiator regardless of retargeting, he could force this redirection. Incidently, this is why I tought that a 3XX response code would be more appropriate than a 493: the reason is that he wants to session to be reinitiated/redirected directly to itself, not through a bunch of retargeting entities.
 
Now, of course, the sender also needs to be able to not go through with a call if the unanticipated answerer is not the suitable.  If we mandate the use of 3XX/493 (by the responder) for retargeting when identity is required, then we avoid the problem of the unanticipated responder accepting the call (followed by the sender clearing it after answer which is quite ugly). That 3XX would have an identity and the cert. I like the fact that this solution works well with both the connected identity problem and with the sRTP & S/MIME problem.
 
 
 
 
Jon Peterson
NeuStar, Inc.
-----Original Message-----
From: Francois Audet [mailto:audet@nortel.com]
Sent: Tuesday, April 19, 2005 5:43 PM
To: Peterson, Jon; 'Fries Steffen'; 'fluffy@cisco.com'
Cc: 'IETF SIP List'
Subject: RE: sipping-retarget (was RE: [Sip] RE: Question to Identity draft)


OK, forget about the idea I was proposing, and instead let's
try to achieve it using the something along the lines of the
identity draft.

What about the connected number information being essentially
the same mechanism as what you have for the Calling identity,
but provided in the response?

Something like a new "Connected header" (or perhaps Contact
would be sufficient, I'm not sure), followed by the
Identity and Identity-Info? The Identity-Info header could
have something like https://biloxy.example.com.

The unanticipated respondent problem would be easier to deal
with because:
- In a lot of case, Bob and Carol (the retargetter and retargettee)
  could have the same certification authority, so Alice's decision to
  proceed or not with the call may not require going fetching the
  yet another certificate.
- Maybe we have "Require: connected-identity" header if we need the
  identity.
- Yes, if the SDP was encrypted (because of sRTP or whatever), it would
  cause another session to be re-established because of the 493 (or
  other appropriate rejection code).

Would that be a good way to solve the Connected number problem?

Now, moving to the next problem, the encrypted SDP.

Alice wants to call Bob and have secure media (because she is afraid of hackers
tapping in).  In fact, she essentially wants all her media encrypted, regardless of
who she talks too, even strangers. She does not have Bob in her contact list, as she
is calling him for the first time. She also doesn't know Carol, his assistant to whom the
call will be retargetted.

In the example above, the sequence would be this:

1 - Alice sends SUBSCRIBE to Bob to fetch his certificate because she doesn't have it.
2 - Bob sends NOTIFY to Alice with his certificate.
3 - Alice sends INVITE to Bob, with SDP encrypted using Bob's key, along with her Identity
4 - Bob doesnt' have Alice's certificate, so he sends SUBSCRIBE to Alice to fetch her cert.
5 - Alice sends NOTIFY to Bob with her certificate.
6 - Bob retargets to Carol (forwards the INVITE to Carol).
7 - Carol responds with 493, since she can't decode the SDP, and includes her Contact
    and her Identity.
8 - Alice sends SUBSCRIBE to Carol to get her cert.
9 - Carol sends NOTIFY to Alice with her cert.
10 - Alice sends INVITE to Alice with her Identity, encrypted with Carol's key.
11 - Carol sends Alice a SUBSCRIBE to get her certificate.
12 - Alice sends NOTIFY to Carol with her certificate.
13 - Carol sends 200 OK to Alice, with SDP encrypted using Alice's key.

This is way too complicated and will take forever to complete a call. And in my mind,
lots (if not the majority) of calls would look like this in environments where
unanticipated respondents are typical (which is the case for a lot of
businesses).

Couldn't this be avoided if not only was Identity used in both directions
(solving the unanticipated respondent problem), and if Alice and Carol also
included their user certificate (for the purposed of sRTP) in the INVITE and
493? Instead of a 10 roundtrip session setup, it would be a 2 roundtrip
session setup.

Of course, in the case of people who know each other, Alice would have subscribed to
Bob and Carol's certificate, so none of this would happen: it would be a 1 round-trip
session setup. In other words, I DO like the Certs draft, and it should be used
whenever possible.

------_=_NextPart_001_01C5462B.967DC006-- --===============0861665912== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip --===============0861665912==-- From sip-bounces@ietf.org Thu Apr 21 01:32:20 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DOUIW-0005Si-7w; Thu, 21 Apr 2005 01:32:20 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DOUIT-0005Sa-Me for sip@megatron.ietf.org; Thu, 21 Apr 2005 01:32:17 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA02639 for ; Thu, 21 Apr 2005 01:32:16 -0400 (EDT) Received: from ussjmh01.bea.com ([63.96.162.5]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DOUTp-0003q0-70 for sip@ietf.org; Thu, 21 Apr 2005 01:44:02 -0400 Received: from ussjfe02.amer.bea.com (ussjfe02.bea.com [172.16.120.52]) by ussjmh01.bea.com (Switch-3.0.5/Switch-3.0.0) with ESMTP id j3L5WE4w006219 for ; Wed, 20 Apr 2005 22:32:14 -0700 Received: from USSFEX01.amer.bea.com ([10.32.0.56]) by ussjfe02.amer.bea.com with Microsoft SMTPSVC(5.0.2195.6713); Wed, 20 Apr 2005 22:32:14 -0700 X-MimeOLE: Produced By Microsoft Exchange V6.0.6603.0 content-class: urn:content-classes:message MIME-Version: 1.0 Date: Wed, 20 Apr 2005 22:32:13 -0700 Message-ID: <9B47F89C6226194D9ED3D4BAB227374902ACF80F@ussfex01.bea.com> Thread-Topic: comments on sipping-dialog-package-06 draft Thread-Index: AcVGM3tFjsLyXRoNQl+361G1jyL/QA== From: "Nasir Khan" To: X-OriginalArrivalTime: 21 Apr 2005 05:32:14.0096 (UTC) FILETIME=[7938A900:01C54633] X-PMX-Version: 4.7.0.111621, Antispam-Engine: 2.0.2.0, Antispam-Data: 2005.4.20.14 X-Spam-Score: 0.5 (/) X-Scan-Signature: 08156cf414e01129f6a937203576bf20 Subject: [Sip] comments on sipping-dialog-package-06 draft X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============0482019498==" Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org This is a multi-part message in MIME format. --===============0482019498== content-class: urn:content-classes:message Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C54633.7911EDA6" This is a multi-part message in MIME format. ------_=_NextPart_001_01C54633.7911EDA6 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Following are some comments on http://www.ietf.org/internet-drafts/draft-ietf-sipping-dialog-package-06 .txt =20 1> Section 4.1=20 "state: This attribute indicates whether the document contains the full dialog information, or whether it contains only information on those dialogs which have changed since the previous document (partial). " =20 >From this it looks that the "state" attribute is partial or full depending upon if "some" or "all" dialogs are reported in the NOTIFY. The semantics of partial or full do not convey any information on the completeness of information within a element (in context of any filter that subscriber may have set).=20 This needs to be clarified in the spec: Should the implementer flush and rewrite the "row" with that dialog ID even when the dialog-info element indicates "partial" (which would imply that information within the element is always complete for subsequent NOTIFY's) or should it do equivalent of SQL update with whatever information is available within the dialog element. (In this latter case is there a need for equivalent of "full" in context of an individual dialog update).=20 =20 2> Section 4.1.4 "4.1.4 Replaces =20 The replaces element is used to correlate a new dialog with one it replaced as a result of an invitation with a Replaces header. This element is present in the replacement dialog only (the newer dialog) and contains attributes with the call-id, local-tag, and remote-tag of the replaced dialog. =20 " =20 IMHO instead of call-id, local-tag and remote-tag the dialogID is necessary and sufficient information in the replaces element. The Subscriber may not be authorized to get this "replaced" dialog information like call-id etc.based upon some authorization policy. By giving away the dialog information of the replaced dialog the subscriber can gain information it was not privy of originally. However, if the subscriber was getting notifications for the replaced dialog also then it can use the dialogID to correlate. (Besides the subscriber table will most likely be keyed on dialogID. and user.) =20 =20 3> Section 4.1.5=20 "Referred-By [11] header and contains the (optional) display name attribute and the Referred-By URI as its value. =20 sip:bob@example.com" =20 There could be identity concerns in sending out the referred-by information. Though not directly concerned with this draft, it could be mentioned about the mechanism to expunge the referer information based on privacy headers. The same applies to other identity elements also.=20 =20 =20 =20 4> Section 4.3=20 Perhaps it could be added that the dialog information table as suggested is referenced by the SUBSCRIBE/NOTIFY dialog (that which subscriber maintains with the notifier) AND the user whose dialog information is retrieved, this will help to associate the incremental status updates that each NOTIFY entails. In the absence of any such association there could be a problem: Let us say that there were two dialogs that were being reported about, one dialog gets terminated and UA sends a NOTIFY with a higher "version" (+1) attribute. If this NOTIFY is lost and subsequently another NOTIFY with yet higher (+2) version attribute is sent then this SHOULD result in refresh request from Subscriber (sec 4.3). The Notifier will then generate a "full" notification but it will potentially NOT have any information on the "terminated" dialog. The Subscriber now needs a higher level reference to the DialogID that it can use to now flush the now terminated dialog.=20 This probably is implied in the text but IMO may help implementers if specified clearly.=20 =20 =20 5> Should target refreshes be reported, i.e. have a new "event" type in schema for state element for = target refreshes?=20 =20 =20 6> Section 6.1 Minor typo -=20 "If it receives a second 180 with a different tag: =20 ------- SIP/2.0 180 Ringing =20 This results in the creation of a second dialog: =20 =20 early early " =20 The dialog id in the second dialog created should have a different dialogID as specified in section 4.1 =20 =20 7> The draft talks about the dialog events at the UAs because this is where the dialog state machine exists, but will it be useful to have the capability to monitor such dialogs at a record routing proxy? So will it be useful to enable a Subscriber SUBSCRIBE to a dialog which is "known" at a proxy?=20 =20 =20 =20 8> This draft more than other event drafts points towards a need for a mechanism in which a subscription would be required through a non SUBSCRIBE mechanism. This is because the Subscriber in this case may be a party outside of the dialog that needs to monitor and may not know when the dialog came into existence. Of course the subscriber can subscribe before hand, but will still lack the capability to subscribe in real-time to a dialog to which the subscriber may be interested in.=20 Will it be worthwhile to add a mechanism by which the subscriptions could also carry over another method like INVITE?=20 A new "Subscription" header could carry the subscription and the value of the header may be the target for the subsequent NOTIFY. This could be a non- SUBSCRIBE way of installing subscription. The Event header would then have the required event package. =20 If the subscriber is within the trust domain then the NOTIFY's could start as soon as the first qualifying event occurs rather than waiting for SUBSCRIBE or relying on before-hand subscriptions. =20 This feature could be useful for future event users like say an event package for notifying the Voice XML media server interaction state after dialog establishment [e.g. notifications about the digit collection etc. rather than using HTTP route].=20 =20 In a nutshell this would be useful to a subscriber who cannot know before hand where/whom to subscribe for the events that it is interested in as the dynamic network situations create these event conditions. So the "application" (say a proxy) that knows about the Subscriber and this special condition occurring in the network, inserts this Subscription header and Event header with the subscribers target address. =20 If Notifier wants to authenticate the subscriber it could generate a NOTIFY with Subscription-State as "terminated" and = reason=3Dauth-required. =20 =20 Regards=20 Nasir Khan BEA Systems, Inc.=20 =20 ------_=_NextPart_001_01C54633.7911EDA6 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Following are some comments on http://www.ietf.org/internet-drafts/draft-ietf-sipping-dialo= g-package-06.txt

 

1>  Section 4.1

  =
“state: This attribute indicates whether the =
document contains the
      full dialog =
information, or whether it contains only =
information
      on those =
dialogs which have changed since the previous =
document
      (partial). =
“
 
From this it looks that the =
“state” attribute is partial or full depending upon if =
“some” or “all” dialogs are reported in the =
NOTIFY. The semantics of partial or full do not convey any information =
on the completeness of information within a <dialog> element (in =
context of any filter that subscriber may have set). =
This needs to be clarified =
in the spec: Should the implementer flush and rewrite the =
“row” with that dialog ID even when the dialog-info element =
indicates “partial” (which would imply that information =
within the <dialog> element is always complete for subsequent =
NOTIFY’s) or should it do equivalent of SQL update with whatever =
information is available within the dialog element. (In this latter case =
is there a need for equivalent of “full” in context of an =
individual dialog update). 
 
2>  Section =
4.1.4
 =
“4.1.4  Replaces
 
   The replaces element is used to =
correlate a new dialog with one =
it
   replaced as a result of an =
invitation with a Replaces header.  =
This
   element is present in the =
replacement dialog only (the newer =
dialog)
   and contains attributes with the =
call-id, local-tag, and =
remote-tag
   of the replaced =
dialog.
 
   <replaces =
call-id=3D"hg287s98s89"
       &nbs=
p;     local-tag=3D"6762h7" =
remote-tag=3D"09278hsb"/>”
 
IMHO instead of call-id, =
local-tag and remote-tag the dialogID is necessary and sufficient =
information in the replaces element. The Subscriber may not be =
authorized to get this “replaced” dialog information like =
call-id etc.based upon some authorization policy. By giving away the =
dialog information of the replaced dialog the subscriber can gain =
information it was not privy of originally. However, if the subscriber =
was getting notifications for the replaced dialog also then it can use =
the dialogID to correlate. (Besides the subscriber table will most =
likely be keyed on dialogID. and =
user.)
 
 
3>  Section 4.1.5 =
Referre=
d-By [11] header and contains the (optional) display =
name
   attribute and the Referred-By =
URI as its value.
 
   <referred-by =
display=3D"Bob">sip:bob@example.com</referred-by>̶=
1;
 
There could be identity =
concerns in sending out the referred-by information. Though not directly =
concerned with this draft, it could be mentioned about the mechanism to =
expunge the referer information based on privacy headers. The same =
applies to other identity elements also. =
 
 
 
4> Section 4.3 =
Perhaps it could be added =
that the dialog information table as suggested is referenced by the =
SUBSCRIBE/NOTIFY dialog (that which subscriber maintains with the =
notifier) AND the user whose dialog information is retrieved, this will =
help to associate the incremental status updates that each NOTIFY =
entails. In the absence of any such association there could be a =
problem: Let us say that there were two dialogs that were being reported =
about, one dialog gets terminated and UA sends a NOTIFY with a higher =
“version” (+1) attribute. If this NOTIFY is lost and =
subsequently another NOTIFY with yet higher (+2) version attribute is =
sent then this SHOULD result in refresh request from Subscriber (sec =
4.3). The Notifier will then generate a “full” notification =
but it will potentially NOT have any information on the =
“terminated” dialog. The Subscriber now needs a higher level =
reference to the DialogID that it can use to now flush the now =
terminated dialog. 
This probably is implied in =
the text but IMO may help implementers if specified clearly. =
 
 
5> Should target =
refreshes be reported, i.e. have a new “event” type in =
schema for state element <xs:enumeration =
value=3D"refreshed"/> for target refreshes? =
 
 
6> Section 6.1 Minor =
typo - 
If it =
receives a second 180 with a different tag:
 
------- =
SIP/2.0 180 Ringing
 
   This results in the creation of =
a second dialog:
 
 
   <?xml =
version=3D"1.0"?>
   <dialog-info =
xmlns=3D"urn:ietf:params:xml:ns:dialog-info"<=
/font>
       &nbs=
p;        =
version=3D"2"
       &nbs=
p;        =
state=3D"full"
       &nbs=
p;        =
entity=3D"sip:alice@example.com">
     <dialog =
id=3D"as7d900as8" =
call-id=3D"a84b4c76e66710"
<=
font
size=3D2 face=3D"Courier New">       &nbs=
p;     local-tag=3D"1928301774" =
remote-tag=3D"456887766"
       &nbs=
p;     =
direction=3D"initiator">
=
       =
<state>early</state>
     =
</dialog>
     <dialog =
id=3D"as7d900as8" =
call-id=3D"a84b4c76e66710"
<=
font
size=3D2 face=3D"Courier New">       &nbs=
p;     local-tag=3D"1928301774" =
remote-tag=3D"hh76a"
       &nbs=
p;     =
direction=3D"initiator">
=
       =
<state>early</state>
     =
</dialog>
   </dialog-info> =
“
 
The dialog id in the second =
dialog created should have a different dialogID as specified in section =
4.1
 
 
7> The draft talks about =
the dialog events at the UAs because this is where the dialog state =
machine exists, but will it be useful to have the capability to monitor =
such dialogs at a record routing proxy?  So will it be useful to =
enable a Subscriber SUBSCRIBE to a dialog which is “known” =
at  a proxy? 
 
 
 
8> This draft more than =
other event drafts points towards a need for a mechanism in which a =
subscription would be required through a non SUBSCRIBE mechanism. This =
is because the Subscriber in this case may be a party outside of the =
dialog that needs to monitor and may not know when the dialog came into =
existence. Of course the subscriber can subscribe before hand, but will =
still lack the capability to subscribe in real-time to a dialog to which =
the subscriber may be interested in. =
Will it be worthwhile to =
add a mechanism by which the subscriptions could also carry over another =
method like INVITE? 
A new =
“Subscription” header could carry the subscription and the =
value of the header may be the target for the subsequent NOTIFY. This =
could be a non- SUBSCRIBE way of installing subscription. The Event =
header would then have the required event package. =
 
If the subscriber is within =
the trust domain then the NOTIFY’s could start as soon as the =
first qualifying event occurs rather than waiting for SUBSCRIBE or =
relying on before-hand subscriptions. =
 
This feature could be =
useful for future event users like say an event package for notifying =
the Voice XML media server interaction state after dialog establishment =
[e.g. notifications about the digit collection etc. rather than using =
HTTP route]. 
 
In a nutshell this would be =
useful to a subscriber who cannot know before hand where/whom to =
subscribe for the events that it is interested in as the dynamic network =
situations create these event conditions. So the =
“application” (say a proxy) that knows about the Subscriber =
and this special condition occurring in the network, inserts this =
Subscription header and Event header with the subscribers target =
address.  
If Notifier wants to =
authenticate the subscriber it could generate a NOTIFY with =
Subscription-State as “terminated” and =
reason=3Dauth-required.
 
 
Regards =
Nasir =
Khan
BEA Systems, Inc. =

 

------_=_NextPart_001_01C54633.7911EDA6-- --===============0482019498== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip --===============0482019498==-- From sip-bounces@ietf.org Thu Apr 21 02:14:52 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DOUx6-00022R-LW; Thu, 21 Apr 2005 02:14:16 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DOUx2-00021Q-J2 for sip@megatron.ietf.org; Thu, 21 Apr 2005 02:14:13 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA18369 for ; Thu, 21 Apr 2005 02:14:11 -0400 (EDT) Received: from goliath.siemens.de ([192.35.17.28]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DOV8O-0004gs-U8 for sip@ietf.org; Thu, 21 Apr 2005 02:25:57 -0400 Received: from mail2.siemens.de (mail2.siemens.de [139.25.208.11]) by goliath.siemens.de (8.12.6/8.12.6) with ESMTP id j3L6CxIm021893; Thu, 21 Apr 2005 08:12:59 +0200 Received: from mchp9daa.mch.sbs.de (mchp9daa.mch.sbs.de [139.25.137.99]) by mail2.siemens.de (8.12.6/8.12.6) with ESMTP id j3L6Cxme026416; Thu, 21 Apr 2005 08:12:59 +0200 Received: by mchp9daa.mch.sbs.de with Internet Mail Service (5.5.2657.72) id <2SQ5NRQV>; Thu, 21 Apr 2005 08:12:59 +0200 Message-ID: From: Fries Steffen To: Cullen Jennings , Jon Peterson Subject: RE: [Sip] RE: Question to Identity draft Date: Thu, 21 Apr 2005 08:12:58 +0200 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2657.72) Content-Type: text/plain X-Spam-Score: 0.8 (/) X-Scan-Signature: e16ce0269ccb2f59707d16700199d13b Cc: sip@ietf.org X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org Assume an enterprise does not issue certificates to users but for devices for whatever reason. So the user authenticates during registration by using his username and password with HTTP Digest Authentication. The client he uses possesses a certificate. When this user wants to make a phone call to somebody else, were, e.g., SRTP shall be used to encrypt the media, he simply may use the certificate (and corresponding private key) belonging to the phone he is using, if some instance is there assuring that he uses a dedicated (allowed) identity in the from field. As soon as the call ends and the same person is called again by the same user, the callee might receive a different certificate in case the caller switched the phone. The certificate may be used to protect the signaling for DSRTP with either MIKEY or sdecription. I would consider this as a scenario, were the identity draft helps, as the authentication server assures the identity from the FROM field, while the cert approach may be to long winded. > -----Original Message----- > From: Cullen Jennings [mailto:fluffy@cisco.com] > Sent: Wednesday, April 20, 2005 7:38 PM > To: Fries Steffen; Jon Peterson > Cc: sip@ietf.org > Subject: Re: [Sip] RE: Question to Identity draft > > > I'm lost on why and how you would use a device certificate to > be a user certificate. When a user logged off the phone would > you revoke the device certificate? It just all sounds very > convoluted. I more or less view a user certificate as > something that binds a user to a private key. What it sounds > like you are doing here is binding a private key that is > specific to the device to the user. > > On 4/20/05 1:05 AM, "Fries Steffen" wrote: > > > Agreed. > > What I had in mind was more that Alice from example.com uses a cert > > issued for 00342506@mysip.example.com, which may be a self-signed > > certificate or come from a corporate CA, which has not public > > available root certificate. In this case the authentication service > > asserts the FROM field and the cert (in the body) may be > used within > > the dialog. > > > > @Jon, I dont think this approach obviates the > authentication service at all. > > On > > the contrary, the authentication service MUST assert the > identity at > > the beginning of the session, and the receiver is able to keep this > > assertion together with the certificate received in the asserted > > message. The authentication service may be then left out of > the path > > for the rest of the session, when not needed or may be invoked for > > further assertions. From my point of view this would be worth > > mentioning it as an example in the identity ID. > > > > Regarding the cert service, this service is extermely useful, > > especially for the approach of storing credentials. But > there may be > > scenarios, were the usage may be simplyfied by using just the > > authentication service. For instance in cases were the user has no > > certificate at all but the used device has one assigned (I > used that > > example at the beginning of this discussion too). The > certificate may > > have no meaning outside an enterprise but using the authentication > > service provides the meaning for the receiver, at least for the > > duration of the session. The worst case here would be that > the caller > > uses a different phone for each call. Well, it might not be very > > likely, but it may be the worst case. Using a cert service > here would > > mean, that I would have to propagate my certificate > information each > > time I change the device. > > The > > certificate server would use the authentication server to > assert the > > FROM field and provide integrity protection for the body > when sending > > a NOTIFY. In those scenarios, the user may also sent the > certificate > > information inline via an authentication service and thus save > > additional communication with the cert server. Another > scenario may be > > the case were the cert server is not reachable by every > receiver of a call. > > > > Regards > > Steffen > > > > > > > >> -----Original Message----- > >> From: Cullen Jennings [mailto:fluffy@cisco.com] > >> Sent: Tuesday, April 19, 2005 10:30 PM > >> To: Fries Steffen > >> Cc: sip@ietf.org; Jon Peterson > >> Subject: Re: [Sip] RE: Question to Identity draft > >> Importance: High > >> > >> > >> Agreeing with Jon here and want to point out a critical > thing about > >> the certificates. For the AOR alice@example.com, the > certificate in a > >> body would most likely be for the user alice@example.com while the > >> certificate used for identity is for the domain example.com. You > >> can't use a certificate for a user, like alice@example.com > to assert > >> identity using the identity draft mechanism. > >> > >> Cullen > >> > >> > >> On 4/19/05 11:55 AM, "Peterson, Jon" > wrote: > >> > >>> > >>> I do agree that sip-identity provides body integrity, and > as such, > >>> that it could be used to provide integrity protection for a > >>> self-signed certificate in the body of a SIP message, and > >> furthermore, > >>> that such a self-signed certificate could be used in subsequently > >>> messages to provide confidentiality services for SIP > >> message bodies in > >>> order to encrypt symmetric keys used for SRTP. > >>> > >>> I have reservations when we start describing the use of that > >>> self-signed certificate to provide integrity services for > >> subsequent > >>> requests, thereby obviating the need to use an authentication > >>> services. I furthermore think that sipping-certs provides a > >> better way > >>> to discover certificates for confidentiality than this > >> method of tunneling certificates in SIP requests. > >>> > >>> That much said, I would not rule out tunneling self-signed > >>> certificates in this fashion, no. > >>> > >>> Jon Peterson > >>> NeuStar, Inc. > >>> > >>>> -----Original Message----- > >>>> From: Fries Steffen [mailto:steffen.fries@siemens.com] > >>>> Sent: Thursday, April 14, 2005 7:48 AM > >>>> To: Peterson, Jon; fluffy@cisco.com > >>>> Cc: IETF SIP List > >>>> Subject: RE: [Sip] RE: Question to Identity draft > >>>> > >>>> > >>>> Hi Jon, > >>>> > >>>> I'm still not sure what the answer to the scenarios is. > >>>> > >>>> Do you see the option with the identity draft to assert a > >> FROM field > >>>> of a SIP message and also an embedded certificate in the > body and > >>>> thus have a security context for that dialog. The > >> security context > >>>> may be used on subsequent messages (e.g., to negotiate media > >>>> encryption), which do not need to be sent via the > >> authentication service? > >>>> > >>>> Regards > >>>> Steffen > >>>> > >>>> > >>>>> -----Original Message----- > >>>>> From: sip-bounces@ietf.org [mailto:sip-bounces@ietf.org] > >> On Behalf > >>>>> Of Fries Steffen > >>>>> Sent: Thursday, April 07, 2005 4:56 PM > >>>>> To: Peterson, Jon; fluffy@cisco.com > >>>>> Cc: IETF SIP List > >>>>> Subject: [Sip] RE: Question to Identity draft > >>>>> Importance: High > >>>>> > >>>>> Hi Jon, > >>>>> > >>>>>>> [stf] yes, RFC3261 talks about certificate exchhange. But > >>>>>> here it is > >>>>>>> only possible to take certificates, which are (more or > >>>>>> less) bound to a person. > >>>>>>> Assume that you use certificates, which are bound to the > >>>>>> host used for > >>>>>>> phone calls. Then you would need some instance assuring, > >>>>> that this > >>>>>>> certificate is connected with the registration under some AOR. > >>>>>>> > >>>>>>> What I had in mind is an inband certificate exchange from, > >>>>>> e.g., self > >>>>>>> signed certificates, were the authentication services > basically > >>>>>>> assures that the message (and thus the certificate) came > >>>>>> from a person > >>>>>>> registered under a certain AOR. > >>>>>> > >>>>>> RFC3261 does in fact describe the self-signed certificate case. > >>>>> [stf] Okay, I put it in a wrong way, I meant the > certificate must > >>>>> follow some dedicated syntax, connected with the domain you are > >>>>> registering in. > >>>>> When you have something like device certificates, which > >> are issued > >>>>> by a corporate CA on the base of machine names, these > >> certificates > >>>>> may be used in SIP scenarios. After successful registering, the > >>>>> Proxy knows, that a user, who authenticated himself > using digest > >>>>> authentication over a TLS link that he uses the > dedicated device > >>>>> certificate for the duration of his registration for security > >>>>> purposes. That means next time he registers, his > identity may be > >>>>> connected with a different certificate, as he may use a > different > >>>>> phone. Sure, the user could publish the certificate to a cert > >>>>> server, as described in the certs draft, but I was > >> thinking of some > >>>>> kind of "inband provisioning" for such a scenario. > >>>>> > >>>>>> > >>>>>>> The certificate itself may then be used for end-to-end > >>>> integrity > >>>>>>> services. > >>>>>> > >>>>>> In what respect would using this certificates for an > end-to-end > >>>>>> integrity service be superior to just using > >>>>>> sip-identity-04 for integrity? Note that that strength of a > >>>>>> self-signed credential is necessarily equivalent to the > >>>> strength of > >>>>>> the security mechanism used to deliver that self-signed > >>>>> credential to > >>>>>> potential users. So, if > >>>>>> sip-identity-04 is used to secure the cert, it isn't > >>>> clear how the > >>>>>> cert provides a stronger or more attractive assurance than > >>>>>> sip-identity-04 itself would provide. > >>>>> [stf]Using the certificate would require to send just > one message > >>>>> over the authentication service and use the supplied > >> certificate for > >>>>> the rest of the communication. > >>>>> > >>>>> > >>>>>>> A usage example would be the key management for SRTP using > >>>>>> MIKEY, were > >>>>>>> one option is the usage of certificates. When here a > >>>>> certificate is > >>>>>>> used, which is completely unknown to the receiver, then > >>>>> there is no > >>>>>>> real value. But when a trusted component (the > >>>>>> authentication service) > >>>>>>> assures, that a person registered with a dedicated AOR is > >>>>> connected > >>>>>>> with this certificate, then it gets a meaning. It would > >>>> basically > >>>>>>> provide the assurance, that for the time I am in the call, > >>>>>> I am using > >>>>>>> this certificate, which may be sufficient. > >>>>>> > >>>>>> No question that using sip-identity-04 would guarantee the > >>>>> integrity > >>>>>> of the certificate contained in a SIP message body. > >>>>>> But why not have sip-identity-04 secure the SDP body > >>>> containing the > >>>>>> keymgmt attribute for MIKEY, rather than going through a > >>>>> certificate > >>>>>> exchange phase in order to subsequently use the a cert > >>>>> (whose strength > >>>>>> is equivalent to > >>>>>> sip-identity-04) to secure the SDP body containing the > >>>> keymgmt? In > >>>>>> what respect is this not a redundant step? > >>>>> [stf] as stated above, the authentication server would only be > >>>>> needed for one message, to support the establishment of > a session > >>>>> security context. The other thing is that for the key > >> management for > >>>>> SRTP the client itself needs to include the appropriate > >> message body > >>>>> for MIKEY, as the MIKEY container is protected. The > same would be > >>>>> true in scenarios were S/MIME would be required to protect > >>>>> sdescriptions. > >>>>> > >>>>> > >>>>> Regards > >>>>> Steffen > >>>>> > >>>>>> > >>>>>> Jon Peterson > >>>>>> NeuStar, Inc. > >>>>>> > >>>>>>> Regards > >>>>>>> Steffen > >>>>>>> > >>>>>>> > >>>>>> > >>>>> > >>>>> _______________________________________________ > >>>>> Sip mailing list https://www1.ietf.org/mailman/listinfo/sip > >>>>> This list is for NEW development of the core SIP Protocol Use > >>>>> sip-implementors@cs.columbia.edu for questions on > current sip Use > >>>>> sipping@ietf.org for new developments on the application of sip > >>>>> > >>>> > >> > _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Thu Apr 21 09:02:43 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DObKN-0002e5-80; Thu, 21 Apr 2005 09:02:43 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DObKL-0002dT-9l for sip@megatron.ietf.org; Thu, 21 Apr 2005 09:02:41 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA23365 for ; Thu, 21 Apr 2005 09:02:40 -0400 (EDT) Received: from rtp-iport-2.cisco.com ([64.102.122.149]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DObVj-0005jN-Qc for sip@ietf.org; Thu, 21 Apr 2005 09:14:30 -0400 Received: from rtp-core-1.cisco.com (64.102.124.12) by rtp-iport-2.cisco.com with ESMTP; 21 Apr 2005 09:02:30 -0400 Received: from xbh-rtp-201.amer.cisco.com (xbh-rtp-201.cisco.com [64.102.31.12]) by rtp-core-1.cisco.com (8.12.10/8.12.6) with ESMTP id j3LD1eS2019301; Thu, 21 Apr 2005 09:02:27 -0400 (EDT) Received: from xfe-rtp-202.amer.cisco.com ([64.102.31.21]) by xbh-rtp-201.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Thu, 21 Apr 2005 09:02:26 -0400 Received: from cisco.com ([161.44.79.173]) by xfe-rtp-202.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Thu, 21 Apr 2005 09:02:26 -0400 Message-ID: <4267A461.4090103@cisco.com> Date: Thu, 21 Apr 2005 09:02:25 -0400 From: Paul Kyzivat User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.1) Gecko/20020826 X-Accept-Language: en-us, en MIME-Version: 1.0 To: Michael Thomas Subject: Re: authority for a domain (was RE: [Sip] sip-identity-05:display-name woes) References: <24EAE5D4448B9D4592C6D234CBEBD59701502E4D@stntexch03.cis.neustar.com> <1114041102.5650.126.camel@thomasm-lnx.cisco.com> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-OriginalArrivalTime: 21 Apr 2005 13:02:26.0211 (UTC) FILETIME=[5DB24F30:01C54672] X-Spam-Score: 0.0 (/) X-Scan-Signature: bb8f917bb6b8da28fc948aeffb74aa17 Content-Transfer-Encoding: 7bit Cc: sip@ietf.org, Francois Audet , "Peterson, Jon" X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org Mike & Jon, I don't know much about the mechanics of this, but I'm learning a lot and having fun watching the two of you go at it. If the two of you don't kill each other then I think we may get a good outcome. I want to comment on one point from a requirements point of view: Michael Thomas wrote: > The point here is that you're forcing a particular shape of the > namespace to accommodate the ability to delegate authorization. What > disturbs me is that you're not doing this by shunting the authorization > information into a backwater of the namespace (which is what both > IIM and DK do), but instead forcing the real life *users* of the > namespace to be shunted over there too. That is, I'd have to be known > as mat@sip.example.com and mat@prtp.example.com, and so forth. That > strikes me as really, really ugly and mostly likely administratively > infeasible for large existing domains. Preserving a single name for > end identities across different services seems like it should be a > *requirement* to me. As in, a first principle. I think this is really important. Its not sufficient that the email service at example.com may have a user mat@example.com and the sip service may have a user mat@example.com. Its important that those two be assigned to the same "entity". I don't want to get into a situation where, after having talked with "Miles Anderson Thomas" I send email to mat@example.com only to discover that it goes to "Mary Alice Taylor" Paul _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Thu Apr 21 09:21:52 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DObcu-0000dl-9l; Thu, 21 Apr 2005 09:21:52 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DObcq-0000dg-00 for sip@megatron.ietf.org; Thu, 21 Apr 2005 09:21:49 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA28080 for ; Thu, 21 Apr 2005 09:21:46 -0400 (EDT) Received: from rtp-iport-1.cisco.com ([64.102.122.148]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DOboG-000781-ID for sip@ietf.org; Thu, 21 Apr 2005 09:33:37 -0400 Received: from rtp-core-1.cisco.com (64.102.124.12) by rtp-iport-1.cisco.com with ESMTP; 21 Apr 2005 09:32:52 -0400 X-IronPort-AV: i="3.92,120,1112587200"; d="scan'208"; a="45550514:sNHT34114796" Received: from xbh-rtp-201.amer.cisco.com (xbh-rtp-201.cisco.com [64.102.31.12]) by rtp-core-1.cisco.com (8.12.10/8.12.6) with ESMTP id j3LDLFRi023960; Thu, 21 Apr 2005 09:21:36 -0400 (EDT) Received: from xfe-rtp-202.amer.cisco.com ([64.102.31.21]) by xbh-rtp-201.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Thu, 21 Apr 2005 09:21:27 -0400 Received: from cisco.com ([161.44.79.173]) by xfe-rtp-202.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Thu, 21 Apr 2005 09:21:26 -0400 Message-ID: <4267A8D6.4000205@cisco.com> Date: Thu, 21 Apr 2005 09:21:26 -0400 From: Paul Kyzivat User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.1) Gecko/20020826 X-Accept-Language: en-us, en MIME-Version: 1.0 To: Francois Audet Subject: Re: sipping-retarget (was RE: [Sip] RE: Question to Identity draf t) References: <1ECE0EB50388174790F9694F77522CCF01F98045@zrc2hxm0.corp.nortel.com> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-OriginalArrivalTime: 21 Apr 2005 13:21:26.0727 (UTC) FILETIME=[057F3D70:01C54675] X-Spam-Score: 0.8 (/) X-Scan-Signature: 3f3e54d3c03ed638c06aa9fa6861237e Content-Transfer-Encoding: 7bit Cc: "'fluffy@cisco.com'" , 'IETF SIP List' , 'Fries Steffen' , "'Peterson, Jon'" X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org While I think there are many cases where redirection is the best way to do retargetting, I fear that *forcing* the use of redirection may be counterproductive. Such a requirement seems likely to encourage the introduction of B2BUAs so that forwarding may be done without disclosing the identity of the new target. Paul Francois Audet wrote: > It looks like this time, we are going somewhere. > > See below. > > -----Original Message----- > *From:* Peterson, Jon [mailto:jon.peterson@neustar.biz] > *Sent:* Wednesday, April 20, 2005 17:12 > *To:* Audet, Francois [SC100:9T51:EXCH]; Fries Steffen; fluffy@cisco.com > *Cc:* IETF SIP List > *Subject:* RE: sipping-retarget (was RE: [Sip] RE: Question to > Identity draft) > > > The idea of providing a 'Connected' header and signing it is the > subject of 2.2.1 of sipping-retarget. It was in fact the strawman > against which the unanticipated respondent problem was defined. > Namely, 2.2.1 is concerned with the fact that impersonation is > difficult to even define when it comes to response identity, because > there is no concept of a unique impersonatable respondent, and > consequently it is impossible for the UAC to know who is actually > authorized to respond - it must assume that virtually anyone could > legitimately be answering. It is possible to detect an impersonation > of a particular someone; very difficult, and most likely > self-defeating, to try to detect the impersonation of virtually > anyone. I'm not sure how your points below (in the first part) > provide us with any traction on this issue. > > I think the solution to this is to have a redirection to the ultimate > retargeting endpoint. Let me get to that at the end of the email. > > Regarding your flow for sipping-certs, a few comments. First of all, > yes, Alice could include her certificate in an INVITE, thereby > obviating 4 and 5 (and 11 and 12). I don't think sipping-certs meant > to rule that out; the point is, before one sends a request, it is > useful to be able to look up the cert in a repository rather than > just sending an INVITE without SDP or something - the same > principle clearly does not apply to receiving a request, wherein the > request itself can always provide the caller's cert. > > Good. That's exactly what I wanted to hear. This idea of having > SUBSCRIBEs sent at session setup by the responder (before sending a > response) was bothering me quite a bit. > > Of course, having them available already through Certs, because Bob or > Carol already know Alice, is even better. > > More importantly, I think the promise of a certs-like approach lies > in what happens in step 2. If the cert store has access to Bob's > location service, the cert store may be able to anticipate that > Alice needs to talk to Carol right now, not Bob. If that's the case, > maybe sending back a NOTIFY with Bob's cert isn't the right thing to > do in this instance. > > In certain cases, perhaps Bob could send his own certificate, plus > Carol's and any other's it might forward to in the immediate future. > But, this is not applicable to all scenarios. I can see a lot of cases > where this is just plain impossible, and we need a solution for those > cases too. > > Imagine that Bob is a service (like a group list) that dispatches to > many different individuals, randomly, or to a bunch of agents that do > not share the same cert (e.g., a bunch of insurance company agents, a > group of geographically dispersed people in a virtual call center for > customer support, etc.). These call center applications will happen all > the time, in fact, it seems to me to be a prime candidate to moving from > PSTN to SIP because of the increase flexibility in customizing their > application (and for reducing cost). Their requirement will often be "I > need to encrypt media" and "I need to authenticate the originator". Now, > I know you will respond that you could try to anticipate who will > respond, but this is just not the way these services operate. The > routing decision is made real-time (seconds count) based on the status > of the agents (when they hang-up). With forking, it is even worst. > > To add even more complexity, imagine that Carol is a PSTN user. The > network may be using a bunch of PSTN gateways. It may even use a bunch > of different service providers to terminate PSTN calls. The algorithm > for distributing the calls is their own. It will again not be possible > to predict who will answer. > > This the types of scenarios that I want to make sure we support, and why > I think we must have some sort of connected identity. > > The whole point of having things like SUBSCRIBE/NOTIFY in the SIP > protocol is to allow the network to adapt to changing conditions in > real time. If Bob is no longer the person that you're going to reach > when you call Bob, and your request will only work for Bob (e.g., > you're going to encrypt it with Bob's public key), the cert store > should be able to tell you that this isn't going to work, and > potentially give you some idea of who you will reach. To be clear, > I'm not suggesting that sipping-certs provides a mechanism for this > today - but I am arguing that the fundamental -approach- of > sipping-certs allows for this sort of functionality, and that this > could potentially eliminate surprise 493 responses. > > Yes: sometimes it will work. Other times it won't, as you point out > below and as I did above. > > Of course, even if a cert store has access to a location service, it > may be in no position to tell you who is going to pick up the call. > It may be that Bob has populated his location service with 5 > different URIs, targeting any one of which might result in a > completed call or not. In these cases we are in a genuine quandry. > Encrypting an SDP body five different times, and including all five > in a message, is no fun, let alone discovering the certificates of > the five targets. This is a generic forking problem, though, and it > taps into the heart of the question of whether or not redirection or > retargeting is preferable architecturally. Encrypting to multiple > targets has always been one of forking's known drawbacks. > > Sequential forking is also quite problematic. You could imagine doing > these certificate fetching many times before finding the right one. > > I don't understand what is wrong with "forcing" a redirection at the end > of many retargetings. It seems to me that retargeting in the network is > here to stay. But, we have the power to force a redirection for the > unanticipated respondent problem, at least in the context of identity. > When the respondent figures out that he wants its identity to be known > to the initiator regardless of retargeting, he could force this > redirection. Incidently, this is why I tought that a 3XX response code > would be more appropriate than a 493: the reason is that he wants to > session to be reinitiated/redirected directly to itself, not through a > bunch of retargeting entities. > > Now, of course, the sender also needs to be able to not go through with > a call if the unanticipated answerer is not the suitable. If we mandate > the use of 3XX/493 (by the responder) for retargeting when identity is > required, then we avoid the problem of the unanticipated responder > accepting the call (followed by the sender clearing it after answer > which is quite ugly). That 3XX would have an identity and the cert. I > like the fact that this solution works well with both the connected > identity problem and with the sRTP & S/MIME problem. > > > > > > Jon Peterson > NeuStar, Inc. > > -----Original Message----- > *From:* Francois Audet [mailto:audet@nortel.com] > *Sent:* Tuesday, April 19, 2005 5:43 PM > *To:* Peterson, Jon; 'Fries Steffen'; 'fluffy@cisco.com' > *Cc:* 'IETF SIP List' > *Subject:* RE: sipping-retarget (was RE: [Sip] RE: Question to > Identity draft) > > > OK, forget about the idea I was proposing, and instead let's > try to achieve it using the something along the lines of the > identity draft. > > What about the connected number information being essentially > the same mechanism as what you have for the Calling identity, > but provided in the response? > > Something like a new "Connected header" (or perhaps Contact > would be sufficient, I'm not sure), followed by the > Identity and Identity-Info? The Identity-Info header could > have something like https://biloxy.example.com. > > The unanticipated respondent problem would be easier to deal > with because: > - In a lot of case, Bob and Carol (the retargetter and retargettee) > could have the same certification authority, so Alice's > decision to > proceed or not with the call may not require going fetching the > yet another certificate. > - Maybe we have "Require: connected-identity" header if we need the > identity. > - Yes, if the SDP was encrypted (because of sRTP or whatever), > it would > cause another session to be re-established because of the 493 (or > other appropriate rejection code). > > Would that be a good way to solve the Connected number problem? > > Now, moving to the next problem, the encrypted SDP. > > Alice wants to call Bob and have secure media (because she is > afraid of hackers > tapping in). In fact, she essentially wants all her media > encrypted, regardless of > who she talks too, even strangers. She does not have Bob in her > contact list, as she > is calling him for the first time. She also doesn't know Carol, > his assistant to whom the > call will be retargetted. > > In the example above, the sequence would be this: > > 1 - Alice sends SUBSCRIBE to Bob to fetch his certificate > because she doesn't have it. > 2 - Bob sends NOTIFY to Alice with his certificate. > 3 - Alice sends INVITE to Bob, with SDP encrypted using Bob's > key, along with her Identity > 4 - Bob doesnt' have Alice's certificate, so he sends SUBSCRIBE > to Alice to fetch her cert. > 5 - Alice sends NOTIFY to Bob with her certificate. > 6 - Bob retargets to Carol (forwards the INVITE to Carol). > 7 - Carol responds with 493, since she can't decode the SDP, and > includes her Contact > and her Identity. > 8 - Alice sends SUBSCRIBE to Carol to get her cert. > 9 - Carol sends NOTIFY to Alice with her cert. > 10 - Alice sends INVITE to Alice with her Identity, encrypted > with Carol's key. > 11 - Carol sends Alice a SUBSCRIBE to get her certificate. > 12 - Alice sends NOTIFY to Carol with her certificate. > 13 - Carol sends 200 OK to Alice, with SDP encrypted using > Alice's key. > > This is way too complicated and will take forever to complete a > call. And in my mind, > lots (if not the majority) of calls would look like this in > environments where > unanticipated respondents are typical (which is the case for a > lot of > businesses). > > Couldn't this be avoided if not only was Identity used in both > directions > (solving the unanticipated respondent problem), and if Alice and > Carol also > included their user certificate (for the purposed of sRTP) in > the INVITE and > 493? Instead of a 10 roundtrip session setup, it would be a 2 > roundtrip > session setup. > > Of course, in the case of people who know each other, Alice > would have subscribed to > Bob and Carol's certificate, so none of this would happen: it > would be a 1 round-trip > session setup. In other words, I DO like the Certs draft, and it > should be used > whenever possible. > > > ------------------------------------------------------------------------ > > _______________________________________________ > Sip mailing list https://www1.ietf.org/mailman/listinfo/sip > This list is for NEW development of the core SIP Protocol > Use sip-implementors@cs.columbia.edu for questions on current sip > Use sipping@ietf.org for new developments on the application of sip _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Thu Apr 21 09:46:50 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DOc14-0004b3-CM; Thu, 21 Apr 2005 09:46:50 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DOc12-0004aA-Ex for sip@megatron.ietf.org; Thu, 21 Apr 2005 09:46:48 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA00671 for ; Thu, 21 Apr 2005 09:46:47 -0400 (EDT) Received: from ns.execdsl.net ([208.184.15.238] helo=EXECDSL.COM) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DOcCS-00082n-KB for sip@ietf.org; Thu, 21 Apr 2005 09:58:37 -0400 Received: from [64.254.114.114] (HELO JMHLap3.stevecrocker.com) by EXECDSL.COM (CommuniGate Pro SMTP 3.3) with ESMTP id 10010958; Thu, 21 Apr 2005 09:46:20 -0400 Message-Id: <6.2.1.2.0.20050421094351.02e05360@localhost> X-Mailer: QUALCOMM Windows Eudora Version 6.2.1.2 Date: Thu, 21 Apr 2005 09:46:19 -0400 To: Paul Kyzivat From: "Joel M. Halpern" Subject: Re: authority for a domain (was RE: [Sip] sip-identity-05:display-name woes) In-Reply-To: <4267A461.4090103@cisco.com> References: <24EAE5D4448B9D4592C6D234CBEBD59701502E4D@stntexch03.cis.neustar.com> <1114041102.5650.126.camel@thomasm-lnx.cisco.com> <4267A461.4090103@cisco.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-Spam-Score: 0.0 (/) X-Scan-Signature: 7d33c50f3756db14428398e2bdedd581 Cc: sip@ietf.org X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org You may not want to find that situation. But preventing a mistake in that regard is up to the domain. A domain can choose to use separate assignment policies and practices to assign SIP and Email addresses. I agree that this would be a foolish practice, but it is not a violation of the standards, and our authentication work can not assume a specific practice in this regard. yours, Joel M. Halpern At 09:02 AM 4/21/2005, Paul Kyzivat wrote: >I don't want to get into a situation where, after having talked with > > "Miles Anderson Thomas" > >I send email to mat@example.com only to discover that it goes to > > "Mary Alice Taylor" > >Paul _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Thu Apr 21 10:30:25 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DOchE-0000yj-Vn; Thu, 21 Apr 2005 10:30:24 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DOchC-0000y8-82 for sip@megatron.ietf.org; Thu, 21 Apr 2005 10:30:22 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA04401 for ; Thu, 21 Apr 2005 10:30:20 -0400 (EDT) Received: from sj-iport-3-in.cisco.com ([171.71.176.72] helo=sj-iport-3.cisco.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DOcsc-0000Ym-Bk for sip@ietf.org; Thu, 21 Apr 2005 10:42:11 -0400 Received: from sj-core-2.cisco.com (171.71.177.254) by sj-iport-3.cisco.com with ESMTP; 21 Apr 2005 07:28:07 -0700 X-IronPort-AV: i="3.92,121,1112598000"; d="scan'208"; a="252809954:sNHT927992076" Received: from imail.cisco.com (imail.cisco.com [128.107.200.91]) by sj-core-2.cisco.com (8.12.10/8.12.6) with ESMTP id j3LES4Kx003618; Thu, 21 Apr 2005 07:28:05 -0700 (PDT) Received: from [10.32.245.150] (stealth-10-32-245-150.cisco.com [10.32.245.150]) by imail.cisco.com (8.12.11/8.12.10) with SMTP id j3LEIuFt008949; Thu, 21 Apr 2005 07:18:59 -0700 In-Reply-To: <4266E7F9.4030508@cisco.com> References: <4266E7F9.4030508@cisco.com> Mime-Version: 1.0 (Apple Message framework v622) Content-Type: text/plain; charset=US-ASCII; format=flowed Message-Id: <86db337652fd8e299ba545ea02bc3c82@cisco.com> Content-Transfer-Encoding: 7bit From: "David R. Oran" Subject: Re: [Sip] Re: Consequence of destroying INVITE server transaction on 200 Date: Thu, 21 Apr 2005 10:27:53 -0400 To: Jonathan Rosenberg X-Mailer: Apple Mail (2.622) IIM-SIG: v:"1.1"; h:"imail.cisco.com"; d:"cisco.com"; z:"home"; m:"krs"; t:"1114093143.235807"; x:"432200"; a:"rsa-sha1"; b:"nofws:929"; e:"Iw=="; n:"sQYarK2E51MdcTiUqeif3F7cWdxIfoCiXhdfb9vD5ee/j0jXL15gbFxF2p" "XIweAblu0N6XAgK7k+wrbr7bQDJaCDqOmzqpRUBjIRQAXQ7NzadpmR3pUL6wxaRUtW+c43sl9jC" "50Qg1sXHpPjt8Y+Y16ioyQAQAdSunM4YhevURc="; s:"WSKRnG2nGRDl9/mkEXvCZch3IwB7eFMfWs+QDBb4Kx6FWwvL23i2iQSCPYYU27mR+F2mTJOm" "wmbizB5k9MpnAApcBMgVruqFlSb+IxZfASrmxSpG71PjSfZGSB/Jz2aVtv5AAtAmpsiN/TiXrA1" "1/n7CgDz02hd+mgQG9kNniUw="; c:"From: David R. Oran "; c:"Subject: Re: [Sip] Re: Consequence of destroying INVITE server trans" "action on 200"; c:"Date: Thu, 21 Apr 2005 10:27:53 -0400" IIM-VERIFY: s:"y"; v:"y"; r:"60"; h:"imail.cisco.com"; c:"message from imail.cisco.com verified; " X-Spam-Score: 0.0 (/) X-Scan-Signature: 2409bba43e9c8d580670fda8b695204a Content-Transfer-Encoding: 7bit Cc: "sip@ietf.org WG" X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org >> I believe the intent was that the application on top of the original >> transaction (the endpoint, or the response context in the proxy) >> remember >> enough to absorb that retransmission. The spec needs more description >> around this so that it is obvious that this retransmission should >> make it to >> the part of the application that handled the original request. It >> needs to talk >> about. how long this part of the application needs to hang around to >> drain >> these retransmissions. > > Right. A slightly different way to think about this is that the server > transaction doesnt actually disappear on a 2xx; but rather, it remains > in a wait state only to suppress INVITE retransmits. It would still > transparently pass 2xx from the TU out on the network. > Absolutely. This is exactly analogous to FIN_WAIT state in TCP. >> Can anyone see text that we may have missed when discussing >> this problem that adds clarity to it. If not, does anyone disagree >> with >> the approach for clarification proposed above. >> If the answer to both of those questions is no, I'll enter a bug and >> propose text. > > Please do. _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Thu Apr 21 12:13:37 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DOeHL-0005gf-9Y; Thu, 21 Apr 2005 12:11:47 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DOeHJ-0005gU-EL for sip@megatron.ietf.org; Thu, 21 Apr 2005 12:11:45 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA12641 for ; Thu, 21 Apr 2005 12:11:43 -0400 (EDT) Received: from rtp-iport-1.cisco.com ([64.102.122.148]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DOeSj-0003Ko-T4 for sip@ietf.org; Thu, 21 Apr 2005 12:23:36 -0400 Received: from rtp-core-2.cisco.com (64.102.124.13) by rtp-iport-1.cisco.com with ESMTP; 21 Apr 2005 12:22:49 -0400 X-IronPort-AV: i="3.92,121,1112587200"; d="scan'208"; a="45589513:sNHT28014040" Received: from xbh-rtp-201.amer.cisco.com (xbh-rtp-201.cisco.com [64.102.31.12]) by rtp-core-2.cisco.com (8.12.10/8.12.6) with ESMTP id j3LGBJe3009498; Thu, 21 Apr 2005 12:11:30 -0400 (EDT) Received: from xfe-rtp-211.amer.cisco.com ([64.102.31.113]) by xbh-rtp-201.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Thu, 21 Apr 2005 12:11:23 -0400 Received: from cisco.com ([161.44.79.173]) by xfe-rtp-211.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Thu, 21 Apr 2005 12:11:23 -0400 Message-ID: <4267D0AB.7030603@cisco.com> Date: Thu, 21 Apr 2005 12:11:23 -0400 From: Paul Kyzivat User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.1) Gecko/20020826 X-Accept-Language: en-us, en MIME-Version: 1.0 To: "Joel M. Halpern" Subject: Re: authority for a domain (was RE: [Sip] sip-identity-05:display-name woes) References: <24EAE5D4448B9D4592C6D234CBEBD59701502E4D@stntexch03.cis.neustar.com> <1114041102.5650.126.camel@thomasm-lnx.cisco.com> <4267A461.4090103@cisco.com> <6.2.1.2.0.20050421094351.02e05360@localhost> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-OriginalArrivalTime: 21 Apr 2005 16:11:23.0185 (UTC) FILETIME=[C30F4210:01C5468C] X-Spam-Score: 0.0 (/) X-Scan-Signature: e5ba305d0e64821bf3d8bc5d3bb07228 Content-Transfer-Encoding: 7bit Cc: sip@ietf.org X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org Joel M. Halpern wrote: > You may not want to find that situation. > But preventing a mistake in that regard is up to the domain. A domain > can choose to use separate assignment policies and practices to assign > SIP and Email addresses. I agree that this would be a foolish practice, > but it is not a violation of the standards, and our authentication work > can not assume a specific practice in this regard. It may be out of scope of any particular group. But it would be nice to find a way to make this some kind of best practice if nothing else. Paul > yours, > Joel M. Halpern > > At 09:02 AM 4/21/2005, Paul Kyzivat wrote: > >> I don't want to get into a situation where, after having talked with >> >> "Miles Anderson Thomas" >> >> I send email to mat@example.com only to discover that it goes to >> >> "Mary Alice Taylor" >> >> Paul > > _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Thu Apr 21 12:33:14 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DOec6-00021z-9z; Thu, 21 Apr 2005 12:33:14 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DOec4-00021c-7I for sip@megatron.ietf.org; Thu, 21 Apr 2005 12:33:12 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA14740 for ; Thu, 21 Apr 2005 12:33:09 -0400 (EDT) Received: from [65.220.123.3] (helo=mail.pingtel.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DOenV-0003zQ-GA for sip@ietf.org; Thu, 21 Apr 2005 12:45:02 -0400 Received: from keywest (hide.pingtel.com [65.220.123.2]) by mail.pingtel.com (Postfix) with SMTP id 34A906C01C; Thu, 21 Apr 2005 12:33:04 -0400 (EDT) From: "Dale Worley" To: , Date: Thu, 21 Apr 2005 12:30:01 -0400 Message-ID: <007a01c5468f$5eabc430$6a01010a@keywest> MIME-Version: 1.0 Content-Type: text/plain; charset="US-ASCII" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook CWS, Build 9.0.2416 (9.0.2910.0) In-Reply-To: X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1441 Importance: Normal X-Spam-Score: 0.0 (/) X-Scan-Signature: 8b431ad66d60be2d47c7bfeb879db82c Content-Transfer-Encoding: 7bit Cc: Subject: [Sip] RE: [Sip-implementors] UAC behaviour X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org > From: Udit_Goyal@3com.com > > Consider the following prepaid card application scenario:: > > Assuming party A and B are talking and following steps occur: > i) Party B hung up. > ii) B2BUA end the dialog with user B and connect user A to > media server > using REINVITE asking for another number. > iii) After A presses the digits, B2BUA initiates a new dialog > for user C > iv) When party C is ringing, B2BUA sends 180 Ringing to agent A. IMHO, the fundamental problem is that your call flow maintains one dialog between A and the B2BUA, but you want to reflect back to A all the call progress indications (provisional responses) from the dialogs between B2BUA and B, C, etc. To avoid this, perhaps the B2BUA could issue INVITE with Replaces: to A to "reinitialize" the dialog state with A. (In reality, replace the previous dialog with a new one.) > > > User A B2BUA User B > Media Server > | |(1) BYE | | > | |<------------------| | > | |(2) 200 | | > | |------------------>| | | INV with Replaces| |<------------------| | BYE of dialog 1 | |------------------>| | 200 of dialog 2 | |------------------>| OK, I'm too lazy to draw the entire message flow. But it seems like you could generate suitable INVITEs with Replaces and/or REFER messages to cause A to drop the dialog with B, establish a new one with the media server, then drop that dialog and replace it with one to C, etc. Since each is a new dialog, A's UA will receive and display correctly any call progress indications. This is also more in line with the architecture envisioned in RFC 3261. Instead of having a B2BUA, you might be able to just use a proxy that keeps itself in the signaling path with a Record-Route. Dale _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Thu Apr 21 13:00:37 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DOf2b-0005cb-Lj; Thu, 21 Apr 2005 13:00:37 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DOf2Z-0005cW-Bw for sip@megatron.ietf.org; Thu, 21 Apr 2005 13:00:35 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA17046 for ; Thu, 21 Apr 2005 13:00:32 -0400 (EDT) From: Udit_Goyal@3com.com Received: from ahmler5.mail.eds.com ([192.85.154.70]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DOfE0-0004i7-E9 for sip@ietf.org; Thu, 21 Apr 2005 13:12:26 -0400 Received: from ahmlir4.mail.eds.com (ahmlir4-2.mail.eds.com [192.85.154.134]) by ahmler5.mail.eds.com (8.13.2/8.12.10) with ESMTP id j3LH05Lu018174; Thu, 21 Apr 2005 13:00:10 -0400 Received: from ahmlir4.mail.eds.com (localhost [127.0.0.1]) by ahmlir4.mail.eds.com (8.13.2/8.12.10) with ESMTP id j3LGxPAH030112; Thu, 21 Apr 2005 12:59:25 -0400 Received: from usut001.3com.com ([205.142.126.149]) by ahmlir4.mail.eds.com (8.13.2/8.12.10) with ESMTP id j3LGxO8L030101; Thu, 21 Apr 2005 12:59:24 -0400 In-Reply-To: <007a01c5468f$5eabc430$6a01010a@keywest> To: "Dale Worley" Subject: Re: [Sip] RE: [Sip-implementors] UAC behaviour MIME-Version: 1.0 X-Mailer: Lotus Notes Release 6.5.2 June 01, 2004 Message-ID: Date: Thu, 21 Apr 2005 13:05:15 -0400 X-MIMETrack: Serialize by Router on USUT001/US/3Com(Release 6.0.3|September 26, 2003) at 04/21/2005 09:59:24 AM, Serialize complete at 04/21/2005 09:59:24 AM X-Spam-Score: 0.8 (/) X-Scan-Signature: a4e5f67c5e230eddf754446d1a2201a4 Cc: sip@ietf.org, sip-implementors@cs.columbia.edu X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============0626801389==" Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org This is a multipart message in MIME format. --===============0626801389== Content-Type: multipart/alternative; boundary="=_alternative 005D47AE85256FEA_=" This is a multipart message in MIME format. --=_alternative 005D47AE85256FEA_= Content-Type: text/plain; charset="US-ASCII" Hi Dale, Thanks for the response.. I know the only thing that we can do for this scenario is to have B2BUA sends REFER method so that user A can initiate new INVITE and hence it can act as UAC and respond to 180 ringback. Even if we use INVITE with Replaces, it will still act as UAS and hence will not process 180 response. Actually only concern is because of the exsiting architectute B2BUA has to keep track of different dialogs which is not generally the case in other protocols if he wants to implement these types of scenarios. Some implementations think it of as call legs (or sessions) and they dont want maintain two different dialogs which are more or less session for them. As there is no mechanism to reinitialize the state of the dialog of UAC, you always need to send the REFER method so that UAC start a new dialog and hence will behave as a new call. It is a new dialog but for user its not a new call. One possible quick solution was to have Aler-Info header in the Re-invite send to the UAC which will indicate to UAC that UAC can play ringback to the user, but this only solves the ringback problem. There can be other different scenarios. Actually the scenario which I have discussed is very common, it can be for toll free calling card calls also where first the call is connected to voice mail server (using 2xx and not reliable provisional response) to get the digits and then call is connected to the actual destination party. Basically, from SIP perspective we have to treat all these scenarios as like transfer where B2BUA takes the role of transferor and connecting the user A to different calls. I am not sure if this type of approach will have any repurcussions on billing issues. -Udit "Dale Worley" Sent by: sip-bounces@ietf.org 04/21/2005 12:30 PM To , cc Subject [Sip] RE: [Sip-implementors] UAC behaviour > From: Udit_Goyal@3com.com > > Consider the following prepaid card application scenario:: > > Assuming party A and B are talking and following steps occur: > i) Party B hung up. > ii) B2BUA end the dialog with user B and connect user A to > media server > using REINVITE asking for another number. > iii) After A presses the digits, B2BUA initiates a new dialog > for user C > iv) When party C is ringing, B2BUA sends 180 Ringing to agent A. IMHO, the fundamental problem is that your call flow maintains one dialog between A and the B2BUA, but you want to reflect back to A all the call progress indications (provisional responses) from the dialogs between B2BUA and B, C, etc. To avoid this, perhaps the B2BUA could issue INVITE with Replaces: to A to "reinitialize" the dialog state with A. (In reality, replace the previous dialog with a new one.) > > > User A B2BUA User B > Media Server > | |(1) BYE | | > | |<------------------| | > | |(2) 200 | | > | |------------------>| | | INV with Replaces| |<------------------| | BYE of dialog 1 | |------------------>| | 200 of dialog 2 | |------------------>| OK, I'm too lazy to draw the entire message flow. But it seems like you could generate suitable INVITEs with Replaces and/or REFER messages to cause A to drop the dialog with B, establish a new one with the media server, then drop that dialog and replace it with one to C, etc. Since each is a new dialog, A's UA will receive and display correctly any call progress indications. This is also more in line with the architecture envisioned in RFC 3261. Instead of having a B2BUA, you might be able to just use a proxy that keeps itself in the signaling path with a Record-Route. Dale _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip --=_alternative 005D47AE85256FEA_= Content-Type: text/html; charset="US-ASCII"
Hi Dale,

Thanks for the response..
I know the only thing that we can do for this scenario is to have B2BUA sends REFER method so that user A can initiate new INVITE and hence it can act as UAC and respond to 180 ringback.

Even if we use INVITE with Replaces, it will still act as UAS and hence will not process 180 response.

Actually only concern is because of the exsiting architectute B2BUA has to keep track of different dialogs which is not generally the case in other protocols if he wants to implement these types of scenarios. Some implementations think it of as call legs (or sessions) and they dont want maintain two different dialogs which are more or less session for them.

As there is no mechanism to reinitialize the state of the dialog of UAC, you always need to send the REFER method so that UAC start a new dialog and hence will behave as a new call. It is a new dialog but for user its not a new call.

One possible quick solution was to have Aler-Info header in the Re-invite send to the UAC which will indicate to UAC that UAC can play ringback to the user, but this only solves the ringback problem. There can be other different scenarios.

Actually the scenario which I have discussed is very common, it can be for toll free calling card calls also where first the call is connected to voice mail server (using 2xx and not reliable provisional response) to get the digits and then call is connected to the actual destination party.
Basically, from SIP perspective we have to treat all these scenarios as like transfer where B2BUA takes the role of transferor and connecting the user A to different calls. I am not sure if this type of approach will have any repurcussions on billing issues.

-Udit



"Dale Worley" <dworley@pingtel.com>
Sent by: sip-bounces@ietf.org

04/21/2005 12:30 PM

To
<sip@ietf.org>, <sip-implementors@cs.columbia.edu>
cc
Subject
[Sip] RE: [Sip-implementors] UAC behaviour





> From: Udit_Goyal@3com.com
>
> Consider the following prepaid card application scenario::
>
> Assuming party A and B are talking and following steps occur:
> i)   Party B hung up.
> ii)  B2BUA end the dialog with user B and connect user A to
> media server
> using REINVITE asking for another number.
> iii) After A presses the digits, B2BUA initiates a new dialog
> for user C
> iv) When party C is ringing,  B2BUA sends 180 Ringing to agent A.

IMHO, the fundamental problem is that your call flow maintains one dialog
between A and the B2BUA, but you want to reflect back to A all the call
progress indications (provisional responses) from the dialogs between B2BUA
and B, C, etc.

To avoid this, perhaps the B2BUA could issue INVITE with Replaces: to A to
"reinitialize" the dialog state with A.  (In reality, replace the previous
dialog with a new one.)

>
>
>     User A              B2BUA               User B
> Media Server
>       |                   |(1) BYE            |                   |
>       |                   |<------------------|                   |
>       |                   |(2) 200            |                   |
>       |                   |------------------>|                   |

|  INV with Replaces|
|<------------------|
|  BYE of dialog 1  |
|------------------>|
|  200 of dialog 2  |
|------------------>|


OK, I'm too lazy to draw the entire message flow.  But it seems like you
could generate suitable INVITEs with Replaces and/or REFER messages to cause
A to drop the dialog with B, establish a new one with the media server, then
drop that dialog and replace it with one to C, etc.  Since each is a new
dialog, A's UA will receive and display correctly any call progress
indications.

This is also more in line with the architecture envisioned in RFC 3261.
Instead of having a B2BUA, you might be able to just use a proxy that keeps
itself in the signaling path with a Record-Route.

Dale


_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use sip-implementors@cs.columbia.edu for questions on current sip

Use sipping@ietf.org for new developments on the application of sip
--=_alternative 005D47AE85256FEA_=-- --===============0626801389== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip --===============0626801389==-- From sip-bounces@ietf.org Thu Apr 21 13:12:33 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DOfE9-0007TN-H6; Thu, 21 Apr 2005 13:12:33 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DOfE4-0007T6-V8 for sip@megatron.ietf.org; Thu, 21 Apr 2005 13:12:31 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA18080 for ; Thu, 21 Apr 2005 13:12:26 -0400 (EDT) Received: from sj-iport-4.cisco.com ([171.68.10.86]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DOfPV-00054o-FW for sip@ietf.org; Thu, 21 Apr 2005 13:24:20 -0400 Received: from sj-core-4.cisco.com (171.68.223.138) by sj-iport-4.cisco.com with ESMTP; 21 Apr 2005 10:12:14 -0700 Received: from vtg-um-e2k4.sj21ad.cisco.com (vtg-um-e2k4.cisco.com [171.70.93.57]) by sj-core-4.cisco.com (8.12.10/8.12.6) with ESMTP id j3LHCBpR028351; Thu, 21 Apr 2005 10:12:12 -0700 (PDT) Received: from 10.32.130.175 ([10.32.130.175]) by vtg-um-e2k4.sj21ad.cisco.com ([171.70.93.57]) with Microsoft Exchange Server HTTP-DAV ; Thu, 21 Apr 2005 17:13:08 +0000 User-Agent: Microsoft-Entourage/11.1.0.040913 Date: Thu, 21 Apr 2005 10:12:10 -0700 Subject: Re: [Sip] RE: Question to Identity draft From: Cullen Jennings To: Fries Steffen , Jon Peterson Message-ID: In-Reply-To: Mime-version: 1.0 Content-type: text/plain; charset="US-ASCII" Content-transfer-encoding: 7bit X-Spam-Score: 0.8 (/) X-Scan-Signature: 913ee11e7c554f7d4da75d500826397e Content-Transfer-Encoding: 7bit Cc: "sip@ietf.org" X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org If Alice and Bob both get to use a phone called Device A, do both Alice and Bob learn the private key of Device A? If device A calls Bob, and Bob is going to answer on device B, how does A know what certificate to use for encrypting. On 4/20/05 11:12 PM, "Fries Steffen" wrote: > Assume an enterprise does not issue certificates to users but for devices > for whatever reason. So the user authenticates during registration by using > his username and password with HTTP Digest Authentication. The client he > uses possesses a certificate. When this user wants to make a phone call to > somebody else, were, e.g., SRTP shall be used to encrypt the media, he > simply may use the certificate (and corresponding private key) belonging to > the phone he is using, if some instance is there assuring that he uses a > dedicated (allowed) identity in the from field. As soon as the call ends and > the same person is called again by the same user, the callee might receive a > different certificate in case the caller switched the phone. The certificate > may be used to protect the signaling for DSRTP with either MIKEY or > sdecription. I would consider this as a scenario, were the identity draft > helps, as the authentication server assures the identity from the FROM > field, while the cert approach may be to long winded. > >> -----Original Message----- >> From: Cullen Jennings [mailto:fluffy@cisco.com] >> Sent: Wednesday, April 20, 2005 7:38 PM >> To: Fries Steffen; Jon Peterson >> Cc: sip@ietf.org >> Subject: Re: [Sip] RE: Question to Identity draft >> >> >> I'm lost on why and how you would use a device certificate to >> be a user certificate. When a user logged off the phone would >> you revoke the device certificate? It just all sounds very >> convoluted. I more or less view a user certificate as >> something that binds a user to a private key. What it sounds >> like you are doing here is binding a private key that is >> specific to the device to the user. >> >> On 4/20/05 1:05 AM, "Fries Steffen" wrote: >> >>> Agreed. >>> What I had in mind was more that Alice from example.com uses a cert >>> issued for 00342506@mysip.example.com, which may be a self-signed >>> certificate or come from a corporate CA, which has not public >>> available root certificate. In this case the authentication service >>> asserts the FROM field and the cert (in the body) may be >> used within >>> the dialog. >>> >>> @Jon, I dont think this approach obviates the >> authentication service at all. >>> On >>> the contrary, the authentication service MUST assert the >> identity at >>> the beginning of the session, and the receiver is able to keep this >>> assertion together with the certificate received in the asserted >>> message. The authentication service may be then left out of >> the path >>> for the rest of the session, when not needed or may be invoked for >>> further assertions. From my point of view this would be worth >>> mentioning it as an example in the identity ID. >>> >>> Regarding the cert service, this service is extermely useful, >>> especially for the approach of storing credentials. But >> there may be >>> scenarios, were the usage may be simplyfied by using just the >>> authentication service. For instance in cases were the user has no >>> certificate at all but the used device has one assigned (I >> used that >>> example at the beginning of this discussion too). The >> certificate may >>> have no meaning outside an enterprise but using the authentication >>> service provides the meaning for the receiver, at least for the >>> duration of the session. The worst case here would be that >> the caller >>> uses a different phone for each call. Well, it might not be very >>> likely, but it may be the worst case. Using a cert service >> here would >>> mean, that I would have to propagate my certificate >> information each >>> time I change the device. >>> The >>> certificate server would use the authentication server to >> assert the >>> FROM field and provide integrity protection for the body >> when sending >>> a NOTIFY. In those scenarios, the user may also sent the >> certificate >>> information inline via an authentication service and thus save >>> additional communication with the cert server. Another >> scenario may be >>> the case were the cert server is not reachable by every >> receiver of a call. >>> >>> Regards >>> Steffen >>> >>> >>> >>>> -----Original Message----- >>>> From: Cullen Jennings [mailto:fluffy@cisco.com] >>>> Sent: Tuesday, April 19, 2005 10:30 PM >>>> To: Fries Steffen >>>> Cc: sip@ietf.org; Jon Peterson >>>> Subject: Re: [Sip] RE: Question to Identity draft >>>> Importance: High >>>> >>>> >>>> Agreeing with Jon here and want to point out a critical >> thing about >>>> the certificates. For the AOR alice@example.com, the >> certificate in a >>>> body would most likely be for the user alice@example.com while the >>>> certificate used for identity is for the domain example.com. You >>>> can't use a certificate for a user, like alice@example.com >> to assert >>>> identity using the identity draft mechanism. >>>> >>>> Cullen >>>> >>>> >>>> On 4/19/05 11:55 AM, "Peterson, Jon" >> wrote: >>>> >>>>> >>>>> I do agree that sip-identity provides body integrity, and >> as such, >>>>> that it could be used to provide integrity protection for a >>>>> self-signed certificate in the body of a SIP message, and >>>> furthermore, >>>>> that such a self-signed certificate could be used in subsequently >>>>> messages to provide confidentiality services for SIP >>>> message bodies in >>>>> order to encrypt symmetric keys used for SRTP. >>>>> >>>>> I have reservations when we start describing the use of that >>>>> self-signed certificate to provide integrity services for >>>> subsequent >>>>> requests, thereby obviating the need to use an authentication >>>>> services. I furthermore think that sipping-certs provides a >>>> better way >>>>> to discover certificates for confidentiality than this >>>> method of tunneling certificates in SIP requests. >>>>> >>>>> That much said, I would not rule out tunneling self-signed >>>>> certificates in this fashion, no. >>>>> >>>>> Jon Peterson >>>>> NeuStar, Inc. >>>>> >>>>>> -----Original Message----- >>>>>> From: Fries Steffen [mailto:steffen.fries@siemens.com] >>>>>> Sent: Thursday, April 14, 2005 7:48 AM >>>>>> To: Peterson, Jon; fluffy@cisco.com >>>>>> Cc: IETF SIP List >>>>>> Subject: RE: [Sip] RE: Question to Identity draft >>>>>> >>>>>> >>>>>> Hi Jon, >>>>>> >>>>>> I'm still not sure what the answer to the scenarios is. >>>>>> >>>>>> Do you see the option with the identity draft to assert a >>>> FROM field >>>>>> of a SIP message and also an embedded certificate in the >> body and >>>>>> thus have a security context for that dialog. The >>>> security context >>>>>> may be used on subsequent messages (e.g., to negotiate media >>>>>> encryption), which do not need to be sent via the >>>> authentication service? >>>>>> >>>>>> Regards >>>>>> Steffen >>>>>> >>>>>> >>>>>>> -----Original Message----- >>>>>>> From: sip-bounces@ietf.org [mailto:sip-bounces@ietf.org] >>>> On Behalf >>>>>>> Of Fries Steffen >>>>>>> Sent: Thursday, April 07, 2005 4:56 PM >>>>>>> To: Peterson, Jon; fluffy@cisco.com >>>>>>> Cc: IETF SIP List >>>>>>> Subject: [Sip] RE: Question to Identity draft >>>>>>> Importance: High >>>>>>> >>>>>>> Hi Jon, >>>>>>> >>>>>>>>> [stf] yes, RFC3261 talks about certificate exchhange. But >>>>>>>> here it is >>>>>>>>> only possible to take certificates, which are (more or >>>>>>>> less) bound to a person. >>>>>>>>> Assume that you use certificates, which are bound to the >>>>>>>> host used for >>>>>>>>> phone calls. Then you would need some instance assuring, >>>>>>> that this >>>>>>>>> certificate is connected with the registration under some AOR. >>>>>>>>> >>>>>>>>> What I had in mind is an inband certificate exchange from, >>>>>>>> e.g., self >>>>>>>>> signed certificates, were the authentication services >> basically >>>>>>>>> assures that the message (and thus the certificate) came >>>>>>>> from a person >>>>>>>>> registered under a certain AOR. >>>>>>>> >>>>>>>> RFC3261 does in fact describe the self-signed certificate case. >>>>>>> [stf] Okay, I put it in a wrong way, I meant the >> certificate must >>>>>>> follow some dedicated syntax, connected with the domain you are >>>>>>> registering in. >>>>>>> When you have something like device certificates, which >>>> are issued >>>>>>> by a corporate CA on the base of machine names, these >>>> certificates >>>>>>> may be used in SIP scenarios. After successful registering, the >>>>>>> Proxy knows, that a user, who authenticated himself >> using digest >>>>>>> authentication over a TLS link that he uses the >> dedicated device >>>>>>> certificate for the duration of his registration for security >>>>>>> purposes. That means next time he registers, his >> identity may be >>>>>>> connected with a different certificate, as he may use a >> different >>>>>>> phone. Sure, the user could publish the certificate to a cert >>>>>>> server, as described in the certs draft, but I was >>>> thinking of some >>>>>>> kind of "inband provisioning" for such a scenario. >>>>>>> >>>>>>>> >>>>>>>>> The certificate itself may then be used for end-to-end >>>>>> integrity >>>>>>>>> services. >>>>>>>> >>>>>>>> In what respect would using this certificates for an >> end-to-end >>>>>>>> integrity service be superior to just using >>>>>>>> sip-identity-04 for integrity? Note that that strength of a >>>>>>>> self-signed credential is necessarily equivalent to the >>>>>> strength of >>>>>>>> the security mechanism used to deliver that self-signed >>>>>>> credential to >>>>>>>> potential users. So, if >>>>>>>> sip-identity-04 is used to secure the cert, it isn't >>>>>> clear how the >>>>>>>> cert provides a stronger or more attractive assurance than >>>>>>>> sip-identity-04 itself would provide. >>>>>>> [stf]Using the certificate would require to send just >> one message >>>>>>> over the authentication service and use the supplied >>>> certificate for >>>>>>> the rest of the communication. >>>>>>> >>>>>>> >>>>>>>>> A usage example would be the key management for SRTP using >>>>>>>> MIKEY, were >>>>>>>>> one option is the usage of certificates. When here a >>>>>>> certificate is >>>>>>>>> used, which is completely unknown to the receiver, then >>>>>>> there is no >>>>>>>>> real value. But when a trusted component (the >>>>>>>> authentication service) >>>>>>>>> assures, that a person registered with a dedicated AOR is >>>>>>> connected >>>>>>>>> with this certificate, then it gets a meaning. It would >>>>>> basically >>>>>>>>> provide the assurance, that for the time I am in the call, >>>>>>>> I am using >>>>>>>>> this certificate, which may be sufficient. >>>>>>>> >>>>>>>> No question that using sip-identity-04 would guarantee the >>>>>>> integrity >>>>>>>> of the certificate contained in a SIP message body. >>>>>>>> But why not have sip-identity-04 secure the SDP body >>>>>> containing the >>>>>>>> keymgmt attribute for MIKEY, rather than going through a >>>>>>> certificate >>>>>>>> exchange phase in order to subsequently use the a cert >>>>>>> (whose strength >>>>>>>> is equivalent to >>>>>>>> sip-identity-04) to secure the SDP body containing the >>>>>> keymgmt? In >>>>>>>> what respect is this not a redundant step? >>>>>>> [stf] as stated above, the authentication server would only be >>>>>>> needed for one message, to support the establishment of >> a session >>>>>>> security context. The other thing is that for the key >>>> management for >>>>>>> SRTP the client itself needs to include the appropriate >>>> message body >>>>>>> for MIKEY, as the MIKEY container is protected. The >> same would be >>>>>>> true in scenarios were S/MIME would be required to protect >>>>>>> sdescriptions. >>>>>>> >>>>>>> >>>>>>> Regards >>>>>>> Steffen >>>>>>> >>>>>>>> >>>>>>>> Jon Peterson >>>>>>>> NeuStar, Inc. >>>>>>>> >>>>>>>>> Regards >>>>>>>>> Steffen >>>>>>>>> >>>>>>>>> >>>>>>>> >>>>>>> >>>>>>> _______________________________________________ >>>>>>> Sip mailing list https://www1.ietf.org/mailman/listinfo/sip >>>>>>> This list is for NEW development of the core SIP Protocol Use >>>>>>> sip-implementors@cs.columbia.edu for questions on >> current sip Use >>>>>>> sipping@ietf.org for new developments on the application of sip >>>>>>> >>>>>> >>>> >> _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Thu Apr 21 14:31:32 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DOgSa-00082o-Cy; Thu, 21 Apr 2005 14:31:32 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DOgSY-00081w-8x for sip@megatron.ietf.org; Thu, 21 Apr 2005 14:31:30 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA24736 for ; Thu, 21 Apr 2005 14:31:28 -0400 (EDT) Received: from oak.neustar.com ([209.173.53.70]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DOge0-00075q-Eb for sip@ietf.org; Thu, 21 Apr 2005 14:43:21 -0400 Received: from stntsmtp1.cis.neustar.com (smartexch.neustar.com [10.31.13.79]) by oak.neustar.com (8.12.8/8.11.0) with ESMTP id j3LIVEKD003492; Thu, 21 Apr 2005 18:31:14 GMT Received: from stntexch03.cis.neustar.com ([10.31.13.45]) by stntsmtp1.cis.neustar.com with Microsoft SMTPSVC(6.0.3790.211); Thu, 21 Apr 2005 14:31:13 -0400 X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0 Content-class: urn:content-classes:message MIME-Version: 1.0 Subject: RE: sipping-retarget (was RE: [Sip] RE: Question to Identity draft) Date: Thu, 21 Apr 2005 14:31:13 -0400 Message-ID: <24EAE5D4448B9D4592C6D234CBEBD59701502E53@stntexch03.cis.neustar.com> Thread-Topic: RE: sipping-retarget (was RE: [Sip] RE: Question to Identity draft) Thread-Index: AcVGoC9n1TlPzzCmTDakWwUH246UEw== From: "Peterson, Jon" To: "Francois Audet" , "Fries Steffen" , X-OriginalArrivalTime: 21 Apr 2005 18:31:13.0784 (UTC) FILETIME=[4C3F0F80:01C546A0] X-Spam-Score: 1.0 (+) X-Scan-Signature: 9aa22b77adc37e7d33e29644e4dc0b33 Cc: IETF SIP List X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============0021782214==" Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org This is a multi-part message in MIME format. --===============0021782214== Content-class: urn:content-classes:message Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C546A0.4BF39830" This is a multi-part message in MIME format. ------_=_NextPart_001_01C546A0.4BF39830 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Francois,=20 Definitely agreed that we are converging, here. I substantially concur = with all that you say pretty much up to the last couple paragraphs.=20 If Bob is actually a group list, I would note that for certain kinds of = call center applications and so on, it actually -does- make sense for = the group to share a cert. No question, though, that for a large group = like that where a common cert cannot be used, it would be very difficult = for a location service to anticipate precisely who is going to answer.=20 Regarding forcing redirection in order to prevent the unanticipated = respondent problem - well, that was the proposal of sip-identity-02. At = the time, that made a lot of people very nervous, although to some = degree I think it was an overreaction (sip-identity-02 didn't propose = eliminating retargeting from SIP, it proposed limiting the cases in = which an entity which acted as an auth service would be eligible to = retarget requests), I think that conceptually there were problems with = the approach. We really don't have the fundamental apparatus in SIP to = be able to make intelligent decisions about when retargeting should and = should not occur, largely because the distinction between AoRs and other = types of URIs is merely a conceptual distinction, and not something that = a location service could distinguish programmatically.=20 Moreover, how would a respondent 'force' a redirection, I wonder? If the = redirection actually comes from the respondent, I submit that we're no = better off in solving the unanticipated respondent problem than we are = if the respondent sends a 200, or a 604. The UAC still has no way to = tell if the response (success, failure, or redirection) is coming from = an authorized respondent. Moreover, how would a respondent know that it = is necessary to force a redirection?=20 Finally, let me say a couple more things about redirection and the = SUB/NOT model. I think you and I at least agree that many of the = sipping-retarget problems start to go away if Bob's location service = exposes the route target list associated with Bob to Alice. The more = information the UAC gets, the less 'unanticpated' these respondents = become. Redirection is of course one way that the route target list can = be given to the UAC for its own use. Lately, though, I've been giving a = lot of thought to what sip-events might be able to do for us here. = Assuming something like reg-event, say, or maybe even just presence, the = UAC can receive an up-to-the-minute picture of what sorts of services = and URIs are associated with Bob. Presence can provide a menu of = services, different URIs with different capabilities, associated with a = particular user from which prospective callers can actually choose. If, = when Alice subscribes to Bob's reg-events, say, she was able to see that = Carol is a potential contact for Bob, then Alice wouldn't be surprised = if, when she sent an INVITE to Bob, Carol answered. Potentially, = exposing route target sets ahead of time could let Alice even choose = from among the possible alternative contacts (to avoid people she = wouldn't want to talk to anyway). If Alice sees that Carol is a contact = for Bob, Alice could even fetch Carol's reg-event and learn that Ted is = a contact for Carol, and thus be able to anticipate Ted, and so and so = forth. The interesting thing about this approach is, of course, that we = get to keep retargeting. What it further demonstrates is that it is = possible for a UAC to get the information it needs to be able to = anticipate retargeting even the UAC does not control call routing - I = think this separation is critical to retargeting advocates. One can even = imagine that presence-style policies, XCAP and so on, could be used to = govern how much information the UAC gets about Bob's contacts for callee = privacy purposes.=20 My point here is not, of course, to make a concrete proposal, but just = to say that there are ways other than redirection that we might approach = the unanticipated respondent problem, that there are clear tradeoffs, = and that we can get some pretty interesting capabilities if we go down = one path instead of another. Ultimately, I think we still have a long = road ahead of us, in terms of understanding the problem we want to solve = and understanding what is the best approach to a solution.=20 Jon Peterson=20 NeuStar, Inc.=20 -----Original Message----- From: Francois Audet [mailto:audet@nortel.com] Sent: Wednesday, April 20, 2005 9:36 PM To: Peterson, Jon; 'Fries Steffen'; 'fluffy@cisco.com' Cc: 'IETF SIP List' Subject: RE: sipping-retarget (was RE: [Sip] RE: Question to Identity = draft) =09 It looks like this time, we are going somewhere.=20 See below.=20 -----Original Message----- From: Peterson, Jon [mailto:jon.peterson@neustar.biz]=20 Sent: Wednesday, April 20, 2005 17:12 To: Audet, Francois [SC100:9T51:EXCH]; Fries Steffen; fluffy@cisco.com Cc: IETF SIP List Subject: RE: sipping-retarget (was RE: [Sip] RE: Question to Identity = draft) =09 The idea of providing a 'Connected' header and signing it is the = subject of 2.2.1 of sipping-retarget. It was in fact the strawman = against which the unanticipated respondent problem was defined. Namely, = 2.2.1 is concerned with the fact that impersonation is difficult to even = define when it comes to response identity, because there is no concept = of a unique impersonatable respondent, and consequently it is impossible = for the UAC to know who is actually authorized to respond - it must = assume that virtually anyone could legitimately be answering. It is = possible to detect an impersonation of a particular someone; very = difficult, and most likely self-defeating, to try to detect the = impersonation of virtually anyone. I'm not sure how your points below = (in the first part) provide us with any traction on this issue. I think the solution to this is to have a redirection to the ultimate = retargeting endpoint. Let me get to that at the end of the email.=20 Regarding your flow for sipping-certs, a few comments. First of all, = yes, Alice could include her certificate in an INVITE, thereby obviating = 4 and 5 (and 11 and 12). I don't think sipping-certs meant to rule that = out; the point is, before one sends a request, it is useful to be able = to look up the cert in a repository rather than just sending an INVITE = without SDP or something - the same principle clearly does not apply to = receiving a request, wherein the request itself can always provide the = caller's cert.=20 Good. That's exactly what I wanted to hear. This idea of having = SUBSCRIBEs sent at session setup by the responder (before sending a = response) was bothering me quite a bit. Of course, having them available = already through Certs, because Bob or Carol already know Alice, is even = better.=20 More importantly, I think the promise of a certs-like approach lies in = what happens in step 2. If the cert store has access to Bob's location = service, the cert store may be able to anticipate that Alice needs to = talk to Carol right now, not Bob. If that's the case, maybe sending back = a NOTIFY with Bob's cert isn't the right thing to do in this instance. In certain cases, perhaps Bob could send his own certificate, plus = Carol's and any other's it might forward to in the immediate future. = But, this is not applicable to all scenarios. I can see a lot of cases = where this is just plain impossible, and we need a solution for those = cases too. Imagine that Bob is a service (like a group list) that = dispatches to many different individuals, randomly, or to a bunch of = agents that do not share the same cert (e.g., a bunch of insurance = company agents, a group of geographically dispersed people in a virtual = call center for customer support, etc.). These call center applications = will happen all the time, in fact, it seems to me to be a prime = candidate to moving from PSTN to SIP because of the increase flexibility = in customizing their application (and for reducing cost). Their = requirement will often be "I need to encrypt media" and "I need to = authenticate the originator". Now, I know you will respond that you = could try to anticipate who will respond, but this is just not the way = these services operate. The routing decision is made real-time (seconds = count) based on the status of the agents (when they hang-up). With = forking, it is even worst. To add even more complexity, imagine that = Carol is a PSTN user. The network may be using a bunch of PSTN gateways. = It may even use a bunch of different service providers to terminate PSTN = calls. The algorithm for distributing the calls is their own. It will = again not be possible to predict who will answer. This the types of = scenarios that I want to make sure we support, and why I think we must = have some sort of connected identity.=20 The whole point of having things like SUBSCRIBE/NOTIFY in the SIP = protocol is to allow the network to adapt to changing conditions in real = time. If Bob is no longer the person that you're going to reach when you = call Bob, and your request will only work for Bob (e.g., you're going to = encrypt it with Bob's public key), the cert store should be able to tell = you that this isn't going to work, and potentially give you some idea of = who you will reach. To be clear, I'm not suggesting that sipping-certs = provides a mechanism for this today - but I am arguing that the = fundamental -approach- of sipping-certs allows for this sort of = functionality, and that this could potentially eliminate surprise 493 = responses. Yes: sometimes it will work. Other times it won't, as you point out = below and as I did above.=20 Of course, even if a cert store has access to a location service, it = may be in no position to tell you who is going to pick up the call. It = may be that Bob has populated his location service with 5 different = URIs, targeting any one of which might result in a completed call or = not. In these cases we are in a genuine quandry. Encrypting an SDP body = five different times, and including all five in a message, is no fun, = let alone discovering the certificates of the five targets. This is a = generic forking problem, though, and it taps into the heart of the = question of whether or not redirection or retargeting is preferable = architecturally. Encrypting to multiple targets has always been one of = forking's known drawbacks. Sequential forking is also quite problematic. You could imagine doing = these certificate fetching many times before finding the right one. I = don't understand what is wrong with "forcing" a redirection at the end = of many retargetings. It seems to me that retargeting in the network is = here to stay. But, we have the power to force a redirection for the = unanticipated respondent problem, at least in the context of identity. = When the respondent figures out that he wants its identity to be known = to the initiator regardless of retargeting, he could force this = redirection. Incidently, this is why I tought that a 3XX response code = would be more appropriate than a 493: the reason is that he wants to = session to be reinitiated/redirected directly to itself, not through a = bunch of retargeting entities. Now, of course, the sender also needs to = be able to not go through with a call if the unanticipated answerer is = not the suitable. If we mandate the use of 3XX/493 (by the responder) = for retargeting when identity is required, then we avoid the problem of = the unanticipated responder accepting the call (followed by the sender = clearing it after answer which is quite ugly). That 3XX would have an = identity and the cert. I like the fact that this solution works well = with both the connected identity problem and with the sRTP & S/MIME = problem.=20 ------_=_NextPart_001_01C546A0.4BF39830 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable RE: sipping-retarget (was RE: [Sip] RE: Question to Identity = draft)

Francois,
Definitely agreed = that we are converging, here. I substantially concur with all that you = say pretty much up to the last couple paragraphs.

If Bob is actually a = group list, I would note that for certain kinds of call center = applications and so on, it actually -does- make sense for the group to = share a cert. No question, though, that for a large group like that = where a common cert cannot be used, it would be very difficult for a = location service to anticipate precisely who is going to = answer.

Regarding forcing = redirection in order to prevent the unanticipated respondent problem - = well, that was the proposal of sip-identity-02. At the time, that made a = lot of people very nervous, although to some degree I think it was an = overreaction (sip-identity-02 didn't propose eliminating retargeting = from SIP, it proposed limiting the cases in which an entity which acted = as an auth service would be eligible to retarget requests), I think that = conceptually there were problems with the approach. We really don't have = the fundamental apparatus in SIP to be able to make intelligent = decisions about when retargeting should and should not occur, largely = because the distinction between AoRs and other types of URIs is merely a = conceptual distinction, and not something that a location service could = distinguish programmatically. =

Moreover, how would a = respondent 'force' a redirection, I wonder? If the redirection actually = comes from the respondent, I submit that we're no better off in solving = the unanticipated respondent problem than we are if the respondent sends = a 200, or a 604. The UAC still has no way to tell if the response = (success, failure, or redirection) is coming from an authorized = respondent. Moreover, how would a respondent know that it is necessary = to force a redirection? =

Finally, let me say a = couple more things about redirection and the SUB/NOT model. I think you = and I at least agree that many of the sipping-retarget problems start to = go away if Bob's location service exposes the route target list = associated with Bob to Alice. The more information the UAC gets, the = less 'unanticpated' these respondents become. Redirection is of course = one way that the route target list can be given to the UAC for its own = use. Lately, though, I've been giving a lot of thought to what = sip-events might be able to do for us here. Assuming something like = reg-event, say, or maybe even just presence, the UAC can receive an = up-to-the-minute picture of what sorts of services and URIs are = associated with Bob. Presence can provide a menu of services, different = URIs with different capabilities, associated with a particular user from = which prospective callers can actually choose. If, when Alice subscribes = to Bob's reg-events, say, she was able to see that Carol is a potential = contact for Bob, then Alice wouldn't be surprised if, when she sent an = INVITE to Bob, Carol answered. Potentially, exposing route target sets = ahead of time could let Alice even choose from among the possible = alternative contacts (to avoid people she wouldn't want to talk to = anyway). If Alice sees that Carol is a contact for Bob, Alice could even = fetch Carol's reg-event and learn that Ted is a contact for Carol, and = thus be able to anticipate Ted, and so and so forth. The interesting = thing about this approach is, of course, that we get to keep = retargeting. What it further demonstrates is that it is possible for a = UAC to get the information it needs to be able to anticipate retargeting = even the UAC does not control call routing - I think this separation is = critical to retargeting advocates. One can even imagine that = presence-style policies, XCAP and so on, could be used to govern how = much information the UAC gets about Bob's contacts for callee privacy = purposes.

My point here is not, = of course, to make a concrete proposal, but just to say that there are = ways other than redirection that we might approach the unanticipated = respondent problem, that there are clear tradeoffs, and that we can get = some pretty interesting capabilities if we go down one path instead of = another. Ultimately, I think we still have a long road ahead of us, in = terms of understanding the problem we want to solve and understanding = what is the best approach to a solution.

Jon = Peterson
NeuStar, = Inc.

I think the solution = to this is to have a redirection to the ultimate retargeting endpoint. = Let me get to that at the end of the email.

    Regarding your flow = for sipping-certs, a few comments. First of all, yes, Alice could = include her certificate in an INVITE, thereby obviating 4 and 5 (and 11 = and 12). I don't think sipping-certs meant to rule that out; the point = is, before one sends a request, it is useful to be able to look up the = cert in a repository rather than just sending an INVITE without SDP or = something - the same principle clearly does not apply to receiving a = request, wherein the request itself can always provide the caller's = cert.

Good. That's exactly = what I wanted to hear. This idea of having SUBSCRIBEs sent at session = setup by the responder (before sending a response) was bothering me = quite a bit. Of course, having them available already through Certs, = because Bob or Carol already know Alice, is even better.

    More importantly, I = think the promise of a certs-like approach lies in what happens in step = 2. If the cert store has access to Bob's location service, the cert = store may be able to anticipate that Alice needs to talk to Carol right = now, not Bob. If that's the case, maybe sending back a NOTIFY with Bob's = cert isn't the right thing to do in this instance.

In certain cases, = perhaps Bob could send his own certificate, plus Carol's and any other's = it might forward to in the immediate future. But, = this is not applicable to all scenarios. I can see a lot of cases where = this is just plain impossible, and we need a solution for those cases = too. Imagine that Bob is a service = (like a group list) that dispatches to many different individuals, = randomly, or to a bunch of agents that do not share the same cert (e.g., = a bunch of insurance company agents, a group of geographically dispersed = people in a virtual call center for customer support, etc.). These call = center applications will happen all the time, in fact, it seems to me to = be a prime candidate to moving from PSTN to SIP because of the increase = flexibility in customizing their application (and for reducing cost). = Their requirement will often be "I need to encrypt media" and = "I need to authenticate the originator". Now, I know you will = respond that you could try to anticipate who will respond, but this is = just not the way these services operate. The routing decision is made = real-time (seconds count) based on the status of the agents (when they = hang-up). With forking, it is even worst. To add = even more complexity, imagine that Carol is a PSTN user. The network may = be using a bunch of PSTN gateways. It may even use a bunch of different = service providers to terminate PSTN calls. The algorithm for = distributing the calls is their own. It will again not be possible to = predict who will answer. = This the types of = scenarios that I want to make sure we support, and why I think we must = have some sort of connected identity.

    The whole point of = having things like SUBSCRIBE/NOTIFY in the SIP protocol is to allow the = network to adapt to changing conditions in real time. If Bob is no = longer the person that you're going to reach when you call Bob, and your = request will only work for Bob (e.g., you're going to encrypt it with = Bob's public key), the cert store should be able to tell you that this = isn't going to work, and potentially give you some idea of who you will = reach. To be clear, I'm not suggesting that sipping-certs provides a = mechanism for this today - but I am arguing that the fundamental = -approach- of sipping-certs allows for this sort of functionality, and = that this could potentially eliminate surprise 493 responses.

Yes: sometimes it = will work. Other times it won't, as you point out below and as I did = above.=20

    Of course, even if a = cert store has access to a location service, it may be in no position to = tell you who is going to pick up the call. It may be that Bob has = populated his location service with 5 different URIs, targeting any one = of which might result in a completed call or not. In these cases we are = in a genuine quandry. Encrypting an SDP body five different times, and = including all five in a message, is no fun, let alone discovering the = certificates of the five targets. This is a generic forking problem, = though, and it taps into the heart of the question of whether or not = redirection or retargeting is preferable architecturally. Encrypting to = multiple targets has always been one of forking's known = drawbacks.

Sequential forking is = also quite problematic. You could imagine doing these certificate = fetching many times before finding the right one. I don't understand what is wrong with "forcing" = a redirection at the end of many retargetings. It seems to me that = retargeting in the network is here to stay. But, we have the power to = force a redirection for the unanticipated respondent problem, at least = in the context of identity. When the respondent figures out that he = wants its identity to be known to the initiator regardless of = retargeting, he could force this redirection. Incidently, this is why I = tought that a 3XX response code would be more appropriate than a 493: = the reason is that he wants to session to be reinitiated/redirected = directly to itself, not through a bunch of retargeting = entities. Now, of course, the sender = also needs to be able to not go through with a call if the unanticipated = answerer is not the suitable. If we mandate the use of 3XX/493 (by the = responder) for retargeting when identity is required, then we avoid the = problem of the unanticipated responder accepting the call (followed by = the sender clearing it after answer which is quite ugly). That 3XX would = have an identity and the cert. I like the fact that this solution works = well with both the connected identity problem and with the sRTP & = S/MIME problem.

------_=_NextPart_001_01C546A0.4BF39830-- --===============0021782214== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip --===============0021782214==-- From sip-bounces@ietf.org Thu Apr 21 15:12:59 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DOh6h-0004Br-7S; Thu, 21 Apr 2005 15:12:59 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DOh6e-0004Bl-Rg for sip@megatron.ietf.org; Thu, 21 Apr 2005 15:12:57 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA28133 for ; Thu, 21 Apr 2005 15:12:55 -0400 (EDT) Received: from sj-iport-4.cisco.com ([171.68.10.86]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DOhI6-0007xu-K4 for sip@ietf.org; Thu, 21 Apr 2005 15:24:48 -0400 Received: from sj-core-1.cisco.com (171.71.177.237) by sj-iport-4.cisco.com with ESMTP; 21 Apr 2005 12:12:45 -0700 Received: from imail.cisco.com (imail.cisco.com [128.107.200.91]) by sj-core-1.cisco.com (8.12.10/8.12.6) with ESMTP id j3LJCd2w011453; Thu, 21 Apr 2005 12:12:40 -0700 (PDT) Received: from thomasm-lnx.cisco.com (thomasm-lnx.cisco.com [171.71.96.50]) by imail.cisco.com (8.12.11/8.12.10) with ESMTP id j3LJ3dX4011467; Thu, 21 Apr 2005 12:03:39 -0700 Subject: Re: [Sip] RE: Question to Identity draft From: Michael Thomas To: Cullen Jennings In-Reply-To: References: Organization: Cisco Systems Message-Id: <1114110761.10360.44.camel@thomasm-lnx.cisco.com> Mime-Version: 1.0 X-Mailer: Ximian Evolution 1.4.6 Date: Thu, 21 Apr 2005 12:12:41 -0700 IIM-SIG: v:"1.1"; h:"imail.cisco.com"; d:"cisco.com"; z:"home"; m:"krs"; t:"1114110219.642686"; x:"432200"; a:"rsa-sha1"; b:"nofws:849"; e:"Iw=="; n:"sQYarK2E51MdcTiUqeif3F7cWdxIfoCiXhdfb9vD5ee/j0jXL15gbFxF2p" "XIweAblu0N6XAgK7k+wrbr7bQDJaCDqOmzqpRUBjIRQAXQ7NzadpmR3pUL6wxaRUtW+c43sl9jC" "50Qg1sXHpPjt8Y+Y16ioyQAQAdSunM4YhevURc="; s:"hnEuQBxRm21bO7aeqw8km+/v+ifw1AMWCYzMVyGGm1bI0A+NguQOyS7an0ajJwukVcx/ekXl" "rgK45jI1E/YKK3Gvaxz/ZWA/i1+MIsfgHzU0dRfgmZGFDqJzMhGQD75zHGl6yB+I2oyq/TgFNe9" "k+8EsSlmncLzBTz/KeeHePrs="; c:"Subject: Re: [Sip] RE: Question to Identity draft"; c:"From: Michael Thomas "; c:"Date: Thu, 21 Apr 2005 12:12:41 -0700" IIM-VERIFY: s:"y"; v:"y"; r:"60"; h:"imail.cisco.com"; c:"message from imail.cisco.com verified; " X-Spam-Score: 0.0 (/) X-Scan-Signature: 52e1467c2184c31006318542db5614d5 Cc: "sip@ietf.org" , Jon Peterson , Fries Steffen X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============0223887918==" Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org --===============0223887918== Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="=-YDPj/OJwRuT77aMtAy2v" --=-YDPj/OJwRuT77aMtAy2v Content-Type: text/plain Content-Transfer-Encoding: quoted-printable On Thu, 2005-04-21 at 10:12, Cullen Jennings wrote: > If Alice and Bob both get to use a phone called Device A, do both Alice a= nd > Bob learn the private key of Device A? >=20 > If device A calls Bob, and Bob is going to answer on device B, how does A > know what certificate to use for encrypting. Good question; I'd say "all of the above". As in, this=20 is not an either/or question. Have fun with forking! :) Mike --=-YDPj/OJwRuT77aMtAy2v Content-Type: application/pgp-signature; name=signature.asc Content-Description: This is a digitally signed message part -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.3 (GNU/Linux) iQCVAwUAQmf7KLMsDAj/Eq++AQKuGAP+Ia0ungUESxUC3wk9BOFBiinrlbdvPPTW fcVAtlO30qDWumhKu/hMRSBrdlj3yXNuTuIkT/3v6nfgU5tX6GfiSgpH1Rag+1sS Rmup0B9F1kkKKkcSh/+e1DoETJT+5t2TUL9eAWBOSQvaLVJPYrKVf/CHaZhraJMx TbcNhnI0370= =FLbe -----END PGP SIGNATURE----- --=-YDPj/OJwRuT77aMtAy2v-- --===============0223887918== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip --===============0223887918==-- From sip-bounces@ietf.org Thu Apr 21 16:18:08 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DOi7k-0007fR-0N; Thu, 21 Apr 2005 16:18:08 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DOi7h-0007dU-R3 for sip@megatron.ietf.org; Thu, 21 Apr 2005 16:18:06 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA11531 for ; Thu, 21 Apr 2005 16:18:04 -0400 (EDT) Received: from rtp-iport-1.cisco.com ([64.102.122.148]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DOiJA-0003yY-FE for sip@ietf.org; Thu, 21 Apr 2005 16:29:58 -0400 Received: from rtp-core-2.cisco.com (64.102.124.13) by rtp-iport-1.cisco.com with ESMTP; 21 Apr 2005 16:29:11 -0400 X-IronPort-AV: i="3.92,121,1112587200"; d="scan'208"; a="45632746:sNHT27099056" Received: from xbh-rtp-201.amer.cisco.com (xbh-rtp-201.cisco.com [64.102.31.12]) by rtp-core-2.cisco.com (8.12.10/8.12.6) with ESMTP id j3LKHFeR019495; Thu, 21 Apr 2005 16:17:52 -0400 (EDT) Received: from xfe-rtp-211.amer.cisco.com ([64.102.31.113]) by xbh-rtp-201.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Thu, 21 Apr 2005 16:17:50 -0400 Received: from cisco.com ([161.44.79.173]) by xfe-rtp-211.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Thu, 21 Apr 2005 16:17:49 -0400 Message-ID: <42680A6D.4020907@cisco.com> Date: Thu, 21 Apr 2005 16:17:49 -0400 From: Paul Kyzivat User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.1) Gecko/20020826 X-Accept-Language: en-us, en MIME-Version: 1.0 To: "Peterson, Jon" Subject: Re: sipping-retarget (was RE: [Sip] RE: Question to Identity draft) References: <24EAE5D4448B9D4592C6D234CBEBD59701502E53@stntexch03.cis.neustar.com> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-OriginalArrivalTime: 21 Apr 2005 20:17:49.0512 (UTC) FILETIME=[3065B480:01C546AF] X-Spam-Score: 0.0 (/) X-Scan-Signature: d6b246023072368de71562c0ab503126 Content-Transfer-Encoding: 7bit Cc: fluffy@cisco.com, IETF SIP List , Francois Audet , Fries Steffen X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org Peterson, Jon wrote: > If Bob is actually a group list, I would note that for certain kinds of > call center applications and so on, it actually -does- make sense for > the group to share a cert. No question, though, that for a large group > like that where a common cert cannot be used, it would be very difficult > for a location service to anticipate precisely who is going to answer. I think this is largely a red herring. In many call center applications it will be a requirement not to disclose the identity of the actual agent - probably not even a synonym. There is a high likelihood that the call center will act as a B2BUA between the caller and the agents, for that reason and others. ("Your call may be monitored for quality.") So there will be no retargetting as far as the caller is concerned, and no identity problem. Paul _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Thu Apr 21 19:51:43 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DOlSQ-0008Tf-V1; Thu, 21 Apr 2005 19:51:42 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DOlSO-0008TV-Oi for sip@megatron.ietf.org; Thu, 21 Apr 2005 19:51:41 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA02458 for ; Thu, 21 Apr 2005 19:51:37 -0400 (EDT) Received: from oak.neustar.com ([209.173.53.70]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DOldu-00019F-8Y for sip@ietf.org; Thu, 21 Apr 2005 20:03:35 -0400 Received: from stntsmtp1.cis.neustar.com (smartexch.neustar.com [10.31.13.79]) by oak.neustar.com (8.12.8/8.11.0) with ESMTP id j3LNpTKD017616; Thu, 21 Apr 2005 23:51:29 GMT Received: from stntexch03.cis.neustar.com ([10.31.13.45]) by stntsmtp1.cis.neustar.com with Microsoft SMTPSVC(6.0.3790.211); Thu, 21 Apr 2005 19:51:28 -0400 X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Subject: RE: sipping-retarget (was RE: [Sip] RE: Question to Identity draft) Date: Thu, 21 Apr 2005 19:51:28 -0400 Message-ID: <24EAE5D4448B9D4592C6D234CBEBD59701502E56@stntexch03.cis.neustar.com> Thread-Topic: sipping-retarget (was RE: [Sip] RE: Question to Identity draft) Thread-Index: AcVGrzRarx0J0Ez2QGW7khfU2gPq2wAHYeLA From: "Peterson, Jon" To: "Paul Kyzivat" X-OriginalArrivalTime: 21 Apr 2005 23:51:28.0964 (UTC) FILETIME=[0962D840:01C546CD] X-Spam-Score: 0.0 (/) X-Scan-Signature: 7655788c23eb79e336f5f8ba8bce7906 Content-Transfer-Encoding: quoted-printable Cc: fluffy@cisco.com, IETF SIP List , Francois Audet , Fries Steffen X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org That is certainly one of the primary cases I had in mind when I = suggested that a "group cert" would sometimes work; a case where there = is in fact effectively a group user agent. Jon Peterson NeuStar, Inc. > I think this is largely a red herring. In many call center = applications=20 > it will be a requirement not to disclose the identity of the actual=20 > agent - probably not even a synonym. There is a high likelihood that = the=20 > call center will act as a B2BUA between the caller and the agents, for = > that reason and others. ("Your call may be monitored for quality.") So = > there will be no retargetting as far as the caller is concerned, and = no=20 > identity problem. >=20 > Paul >=20 _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Thu Apr 21 20:04:18 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DOlec-0002TP-Oy; Thu, 21 Apr 2005 20:04:18 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DOlea-0002TG-T9 for sip@megatron.ietf.org; Thu, 21 Apr 2005 20:04:17 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA03346 for ; Thu, 21 Apr 2005 20:04:14 -0400 (EDT) Received: from sj-iport-3-in.cisco.com ([171.71.176.72] helo=sj-iport-3.cisco.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DOlq7-0001Tz-3n for sip@ietf.org; Thu, 21 Apr 2005 20:16:11 -0400 Received: from sj-core-5.cisco.com (171.71.177.238) by sj-iport-3.cisco.com with ESMTP; 21 Apr 2005 16:56:52 -0700 X-IronPort-AV: i="3.92,122,1112598000"; d="asc'?scan'208"; a="253088606:sNHT6424899600" Received: from imail.cisco.com (imail.cisco.com [128.107.200.91]) by sj-core-5.cisco.com (8.12.10/8.12.6) with ESMTP id j3LNunhu027258; Thu, 21 Apr 2005 16:56:50 -0700 (PDT) Received: from thomasm-lnx.cisco.com (thomasm-lnx.cisco.com [171.71.96.50]) by imail.cisco.com (8.12.11/8.12.10) with ESMTP id j3LNlkue013598; Thu, 21 Apr 2005 16:47:46 -0700 Subject: RE: authority for a domain (was RE: [Sip]sip-identity-05:display-name woes) From: Michael Thomas To: "Peterson, Jon" In-Reply-To: <24EAE5D4448B9D4592C6D234CBEBD59701502E51@stntexch03.cis.neustar.com> References: <24EAE5D4448B9D4592C6D234CBEBD59701502E51@stntexch03.cis.neustar.com> Organization: Cisco Systems Message-Id: <1114127808.10362.328.camel@thomasm-lnx.cisco.com> Mime-Version: 1.0 X-Mailer: Ximian Evolution 1.4.6 Date: Thu, 21 Apr 2005 16:56:48 -0700 IIM-SIG: v:"1.1"; h:"imail.cisco.com"; d:"cisco.com"; z:"home"; m:"krs"; t:"1114127266.633709"; x:"432200"; a:"rsa-sha1"; b:"nofws:5989"; e:"Iw=="; n:"sQYarK2E51MdcTiUqeif3F7cWdxIfoCiXhdfb9vD5ee/j0jXL15gbFxF2p" "XIweAblu0N6XAgK7k+wrbr7bQDJaCDqOmzqpRUBjIRQAXQ7NzadpmR3pUL6wxaRUtW+c43sl9jC" "50Qg1sXHpPjt8Y+Y16ioyQAQAdSunM4YhevURc="; s:"j5JRb23+dwbhWyn9vCN1L4SixxMTuVDtgcnN5ch6wOxOJIjGl/2fHK8xbeh/bsO61HEDIHp3" "fz9ahq6qQNkhyoiSeUAi1ZkMaUwxqyyyL6xxMuwdoqRrPqJP7wk8wT5NUb0NQHf3LsniNPO6rOv" "zru+LGHOqDWFsr9GUdWOhI40="; c:"Subject: RE: authority for a domain (was RE:=0A [Sip]sip-identity-05" ":display-name woes)"; c:"From: Michael Thomas "; c:"Date: Thu, 21 Apr 2005 16:56:48 -0700" IIM-VERIFY: s:"y"; v:"y"; r:"60"; h:"imail.cisco.com"; c:"message from imail.cisco.com verified; " X-Spam-Score: 0.0 (/) X-Scan-Signature: c54bc2f42d02429833c0ca4b8725abd7 Cc: sip@ietf.org, Francois Audet , Paul Kyzivat X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============1809083731==" Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org --===============1809083731== Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="=-G1gw37rxV1OiajcwVZzO" --=-G1gw37rxV1OiajcwVZzO Content-Type: text/plain Content-Transfer-Encoding: quoted-printable On Wed, 2005-04-20 at 18:36, Peterson, Jon wrote: > Mike, >=20 > This is likely to continue to be a conversation in which we talk past one= another. Below, you've taken my attempt to establish some common ground ab= out name subordination and submitted that instead, each bullet should be ab= out the requirements of an identity system. I'm talking about one thing, yo= u're talking about something else entirely. As an aside, I don't disagree s= ubstantially with any of the requirements you outlined, and I think they ar= e largely met by sip-identity. >=20 > Clearly, if you disagree so vehemently with the fundamental assumptions u= nderlying sip-identity, then no solutions in this space will make you happy= . It is true that I believe the DNS and its associated hierarchical structu= re and concepts of authority are integral to how we understand authority ov= er SIP identities, because SIP identities are names rooted in the DNS. I th= ink that disregarding the delegation of authority in the DNS would result i= n a design for SIP identities that does not correspond to the way SIP users= are enrolled nor the manner in which SIP requests are routed. That much sa= id, aside from concerns about the assumptions and how the problem has been = cast, you seem to have three concrete points of discomfiture below: > - You don't believe that existing CAs which issue certificates for web si= tes (i.e., for domain names) have enrollment policies that restrict the iss= uance of certificates to the owners of the domain names in question; instea= d, you believe these CAs issue you a certificate "for whatever reason they = wanted to", No. The CA vendors merely issue the cert to a properly authorized entity for a given *name* which they are authorized to assert. This says nothing about the *role* that cert plays within the organization. It is Out Of Scope from the CA vendor's standpoint. If you want to bind authz/role information to an identity which is provable via a cert, that is up to the users/protocols not the CA vendors.=20 What I specifically have a lot of problem with is saying as you do that there is something inherently significant about a cert that doesn't have a xxx@ in the subjectAltName. That is an invention/expectation of sip-identity. And since it is not, we need to be careful about overloading those semantics for SIP onto a more general purpose name binding system. > - You don't believe that a signature generated with the private key corre= sponding to a certificate serves to authenticate the entity to which the ce= rtificate was issued ("Sorry this is just fundamentally wrong", you say), No, that's not what you said:=20 > > Consequently, when a certificate is used to secure=20 > communications, it signifies to you (the recipient) that you=20 > are receiving this information from the administrator of the=20 ^^^^^^^^^^^^^^^^^ > namespace=20 That is, you are saying that it implies role and/or authorization. It does not. People *conflate* this all the time, but that is because there is exactly one service that uses certs right now: the web. But that conflation all falls apart when you need to delegate that name to some entities for service X and other entities for service Y. Otherwise your SIP proxy will be=20 authorized to trade my Prized Roosters again. > - You assert that sip-identity is not useful unless it has a mechanism th= at will prevent any need for namespace "shunting"; that is, being forced to= take users with AoRs of form 'sip:jon@example.com' and move them to the na= mespace 'sip:jon@sip.example.com', in order to accommodate the architecture= of sip-identity ("the rest of your argument falls apart if that requiremen= t is accepted", you say, apparently neglecting that the "argument" of the p= aragraphs after the one you are commenting on accept and discuss the soluti= on for this requirement). >=20 > To which I will reply, in order: >=20 > - I believe that existing CAs which offer certs to web sites have an enro= llment process which verifies ownership of the requested domain name. If yo= u disagree, please go to Verisign, GoDaddy or GeoTrust and procure a certif= icate for 'www.amazon.com' and post it to this list. I'll pay you back for = the certificate later. That's not what is at issue. It's whether there's any implied connection of www.amazon.com to the https service. There isn't. You can use a www.amazon.com cert for the Prized Rooster Trading Protocol just as well. > - I believe that when I form a TLS connection to www.amazon.com, I downlo= ad a certificate which allows me to verify that integrity-protected content= sent over the TLS connection actually comes from the organization authorit= ative for the name 'www.amazon.com'. I believe that if we don't understand = certificates this way, e-commerce security is nonsensical. Suffice it to say that there is much less to web server based authentication than meets the eye. The little lock icon is, uh, not a complete fiction, but it's not really as much as a safety net as people might think. Let's not go here though. > - In my previous mail, and in the draft, I acknowledged that this is a li= mitation of sip-identity, though I don't share your apocalyptic feelings ab= out it. I agree it is a requirement, and it is, as I said, a subject for fu= ture work [].=20 I'm sorry, but how can something be a requirement and a subject for future work at the same time? Doesn't the Pauli exclusion principle apply? And fwiw, I don't feel apocalyptic about it, I just don't want you to have the accidental authority to trade my=20 prized roosters in the mean time. > Incidentally, I have been aware of the various MASS drafts for some time,= and I continue to believe that there are far more similarities than differ= ences between sip-identity and the MASS efforts. However, SIP and email are= slightly different problem spaces for identity , and I don't think that th= ere is a lot to be gained from importing from IIM or DK into sip-identity. = I did make the check, at one point, though, to see if there was anything we= could glean there. One major distinction is that SIP has not yet enjoyed t= he universal deployment of email, and accordingly, we have a bit of wiggle-= room still in making surgical changes to the protocol and deployment enviro= nment. I've been trying very hard to stay on the fence about that subject. But I do have to ask: do you think there are things that dk/iim can't do for sip that sip-identity can? I've been struggling to come up with any differences in the problem spaces they are attempting to address. This isn't a rhetorical question. Mike --=-G1gw37rxV1OiajcwVZzO Content-Type: application/pgp-signature; name=signature.asc Content-Description: This is a digitally signed message part -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.3 (GNU/Linux) iQCVAwUAQmg9wLMsDAj/Eq++AQJ03QP7Bunitz6iC7OFFPp/goK05DXtTlIE7+iE e4mTBEpLgPw2vputBHdrD4GeJi8vtwBDAfmPD2pH8d+DgVY2ic0woo+39TVIHZ9L 74xvRra4YDyvWduyneJtT4XE9NgYCST9hpIvOj12PVW98U9XgHmLcj/tHNfXUSoo 2tnuuVwTywg= =Obtl -----END PGP SIGNATURE----- --=-G1gw37rxV1OiajcwVZzO-- --===============1809083731== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip --===============1809083731==-- From sip-bounces@ietf.org Thu Apr 21 22:30:28 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DOnw4-0006bq-Mz; Thu, 21 Apr 2005 22:30:28 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DOnw2-0006bl-UI for sip@megatron.ietf.org; Thu, 21 Apr 2005 22:30:27 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA11156 for ; Thu, 21 Apr 2005 22:30:24 -0400 (EDT) Received: from zrtps0kn.nortelnetworks.com ([47.140.192.55]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DOo7Z-0004eM-Td for sip@ietf.org; Thu, 21 Apr 2005 22:42:22 -0400 Received: from zrtpd0jn.us.nortel.com (zrtpd0jn.us.nortel.com [47.140.202.35]) by zrtps0kn.nortelnetworks.com (Switch-2.2.6/Switch-2.2.0) with ESMTP id j3M2U9H09423; Thu, 21 Apr 2005 22:30:09 -0400 (EDT) Received: by zrtpd0jn.us.nortel.com with Internet Mail Service (5.5.2653.19) id ; Thu, 21 Apr 2005 22:30:09 -0400 Message-ID: <1ECE0EB50388174790F9694F77522CCF01F986AC@zrc2hxm0.corp.nortel.com> From: "Francois Audet" To: "'Peterson, Jon'" , "'Fries Steffen'" , "'fluffy@cisco.com'" Subject: RE: sipping-retarget (was RE: [Sip] RE: Question to Identity draf t) Date: Thu, 21 Apr 2005 22:30:01 -0400 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2653.19) X-Spam-Score: 0.7 (/) X-Scan-Signature: 1df8e4abc9851cb4adb45bd64d8514ae Cc: 'IETF SIP List' X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============0777622822==" Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. --===============0777622822== Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C546E3.3059BE6A" This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. ------_=_NextPart_001_01C546E3.3059BE6A Content-Type: text/plain Francois, Definitely agreed that we are converging, here. I substantially concur with all that you say pretty much up to the last couple paragraphs. Good! If Bob is actually a group list, I would note that for certain kinds of call center applications and so on, it actually -does- make sense for the group to share a cert. No question, though, that for a large group like that where a common cert cannot be used, it would be very difficult for a location service to anticipate precisely who is going to answer. I most definitively agree with this paragraph. Regarding forcing redirection in order to prevent the unanticipated respondent problem - well, that was the proposal of sip-identity-02. At the time, that made a lot of people very nervous, although to some degree I think it was an overreaction (sip-identity-02 didn't propose eliminating retargeting from SIP, it proposed limiting the cases in which an entity which acted as an auth service would be eligible to retarget requests), I think that conceptually there were problems with the approach. We really don't have the fundamental apparatus in SIP to be able to make intelligent decisions about when retargeting should and should not occur, largely because the distinction between AoRs and other types of URIs is merely a conceptual distinction, and not something that a location service could distinguish programmatically. Actually, what I was proposing is different from what was in sip-identity-02. I was proposing that the unanticipated responder itself (or its Authentication service) would do the redirection (to itself) upon receiving the retargeted request (sip-identity-02 put that responsibility in the redirecting proxies themselves which I want to avoid). In other words, if the responder (or it's authentication proxy) supports "connected identity", it MUST use the redirection. The advantage is that suddently, it doesn't matter if there are non-conformant retargetting proxies in the middle. It is also much more efficient as there is only ONE redirection ever needed. The sender could have a Required or Supported header or something to request the connected identity. To use your wording, we also "get to use retargeting" (or at least retargeting where it matters) with this approach because the generic proxies are still retargeting. It is therefore backward compatible with existing proxies. The ultimate endpoints in the session handle the retargeting, so there is only one retargeting. It allows the sender and responder to control their own destiny regadless of what happens in the middle (or their respective authentication surrogate). Also, it doesn't waste any round-trips for establishing the session because it the S/MIME would have been rejected anyways, so it's the same. Keep in mind here that this procedure only really kick in when subscription failed to produced the right result because of non-predictable retargeting. Another thing that comes to my mind is that if using 3XX/4XX (redirection) is not appropriate (because of HERFP for example), the unanticipated respondent could send an UPDATE instead as a target refresh (without an SDP Offer) before sending the final response. This works quite well for Identity in isolation of certs (i.e., if S/MIME is not use), and seems logical to me. (Or maybe the UPDATE should come from the sender based on reception of a reliable provisional response including the Connected identity: need to think about that). If S/MIME was used, the UPDATE would be send by the responder before the final response (presumably a 492 because the responder can't decode it) as above (again, perhaps the 1XX followed by sender initiated UPDATE makes more sense). It could also include a Cert in the UPDATE (or 1XX). The responder may or may not receive the 492, as we know since it could get some other response, but it does leave good options to the sender. If another negative response is received from another remote UA, the sender could re-attempt the call to the authentified unanticipated respondent, but this time encypting the S/MIME with its cert. Another option would be for the sender to re-INVITE to the AoR (which could fork again) but without an SDP because it now expects nasty forking (anyways, this is just implementation details). This paragraph is kind of messy: we might be able to find something better. Moreover, how would a respondent 'force' a redirection, I wonder? If the redirection actually comes from the respondent, I submit that we're no better off in solving the unanticipated respondent problem than we are if the respondent sends a 200, or a 604. The UAC still has no way to tell if the response (success, failure, or redirection) is coming from an authorized respondent. The respondent would have to use the same identity procedures as the sender, i.e., the Identity and Identity-Info header. The sender can then look at that identity header to determine if it is valid. Moreover, how would a respondent know that it is necessary to force a redirection? Perhaps if the "To" header does not correspond to itself and if the Connected identity was requested (as per the suggestion above to use a Required or Supported header). Finally, let me say a couple more things about redirection and the SUB/NOT model. I think you and I at least agree that many of the sipping-retarget problems start to go away if Bob's location service exposes the route target list associated with Bob to Alice. The more information the UAC gets, the less 'unanticpated' these respondents become. Redirection is of course one way that the route target list can be given to the UAC for its own use. Lately, though, I've been giving a lot of thought to what sip-events might be able to do for us here. Assuming something like reg-event, say, or maybe even just presence, the UAC can receive an up-to-the-minute picture of what sorts of services and URIs are associated with Bob. Presence can provide a menu of services, different URIs with different capabilities, associated with a particular user from which prospective callers can actually choose. If, when Alice subscribes to Bob's reg-events, say, she was able to see that Carol is a potential contact for Bob, then Alice wouldn't be surprised if, when she sent an INVITE to Bob, Carol answered. Potentially, exposing route target sets ahead of time could let Alice even choose from among the possible alternative contacts (to avoid people she wouldn't want to talk to anyway). If Alice sees that Carol is a contact for Bob, Alice could even fetch Carol's reg-event and learn that Ted is a contact for Carol, and thus be able to anticipate Ted, and so and so forth. The interesting thing about this approach is, of course, that we get to keep retargeting. What it further demonstrates is that it is possible for a UAC to get the information it needs to be able to anticipate retargeting even the UAC does not control call routing - I think this separation is critical to retargeting advocates. One can even imagine that presence-style policies, XCAP and so on, could be used to govern how much information the UAC gets about Bob's contacts for callee privacy purposes. Hum, I'm not completely sold on the idea, because it seems quite heavy. But to be fair, I can see how it could work in a lot of closely integrated environments. So I would say, why not give it a try and define those procedures. But... ;^) I don't believe it will solve all the problems. I strongly believe that ultimately, the sender and responder should be able to detect by themselves when retargeting occurs (including with existing "legacy" proxies), and be able to check their own identities. Who knows what the nasty network will do. In a way, you could view what I am proposing (or something along those lines) as the mechanism of last resort. When not everybody in the network is doing it's job, or when the trust and administrative domain are many. My point here is not, of course, to make a concrete proposal, but just to say that there are ways other than redirection that we might approach the unanticipated respondent problem, that there are clear tradeoffs, and that we can get some pretty interesting capabilities if we go down one path instead of another. Ultimately, I think we still have a long road ahead of us, in terms of understanding the problem we want to solve and understanding what is the best approach to a solution. Indeed. The way I see it, we need to design this in a way that encourages the use of presence/subscription, but has a fall-back mechanism for the cases where it doesn't apply or fails. So I really don't think it is a matter of one way or another. Cheers. ------_=_NextPart_001_01C546E3.3059BE6A Content-Type: text/html Message
 
Francois,
Definitely agreed that we are converging, here. I substantially concur with all that you say pretty much up to the last couple paragraphs.  
Good! 

If Bob is actually a group list, I would note that for certain kinds of call center applications and so on, it actually -does- make sense for the group to share a cert. No question, though, that for a large group like that where a common cert cannot be used, it would be very difficult for a location service to anticipate precisely who is going to answer.  

I most definitively agree with this paragraph.

Regarding forcing redirection in order to prevent the unanticipated respondent problem - well, that was the proposal of sip-identity-02. At the time, that made a lot of people very nervous, although to some degree I think it was an overreaction (sip-identity-02 didn't propose eliminating retargeting from SIP, it proposed limiting the cases in which an entity which acted as an auth service would be eligible to retarget requests), I think that conceptually there were problems with the approach. We really don't have the fundamental apparatus in SIP to be able to make intelligent decisions about when retargeting should and should not occur, largely because the distinction between AoRs and other types of URIs is merely a conceptual distinction, and not something that a location service could distinguish programmatically.  

Actually, what I was proposing is different from what was in sip-identity-02.

I was proposing that the unanticipated responder itself (or its Authentication service) would do the redirection (to itself) upon receiving the retargeted request (sip-identity-02 put that responsibility in the redirecting proxies themselves which I want to avoid).

In other words, if the responder (or it's authentication proxy) supports "connected identity", it MUST use the redirection. The advantage is that suddently, it doesn't matter if there are non-conformant retargetting proxies in the middle. It is also much more efficient as there is only ONE redirection ever needed. The sender could have a Required or Supported header or something to request the connected identity.

To use your wording, we also "get to use retargeting" (or at least retargeting where it matters) with this approach because the generic proxies are still retargeting. It is therefore backward compatible with existing proxies. The ultimate endpoints in the session handle the retargeting, so there is only one retargeting. It allows the sender and responder to control their own destiny regadless of what happens in the middle (or their respective authentication surrogate). Also, it doesn't waste any round-trips for establishing the session because it the S/MIME would have been rejected anyways, so it's the same. Keep in mind here that this procedure only really kick in when subscription failed to produced the right result because of non-predictable retargeting.

Another thing that comes to my mind is that if using 3XX/4XX (redirection) is not appropriate (because of HERFP for example), the unanticipated respondent could send an UPDATE instead as a target refresh (without an SDP Offer) before sending the final response. This works quite well for Identity in isolation of certs (i.e., if S/MIME is not use), and seems logical to me. (Or maybe the UPDATE should come from the sender based on reception of a reliable provisional response including the Connected identity: need to think about that).

If S/MIME was used, the UPDATE would be send by the responder before the final response (presumably a 492 because the responder can't decode it) as above (again, perhaps the 1XX followed by sender initiated UPDATE makes more sense). It could also include a Cert in the UPDATE (or 1XX). The responder may or may not receive the 492, as we know since it could get some other response, but it does leave good options to the sender. If another negative response is received from another remote UA, the sender could re-attempt the call to the authentified unanticipated respondent, but this time encypting the S/MIME with its cert. Another option would be for the sender to re-INVITE to the AoR (which could fork again) but without an SDP because it now expects nasty forking (anyways, this is just implementation details). This paragraph is kind of messy: we might be able to find something better.

Moreover, how would a respondent 'force' a redirection, I wonder? If the redirection actually comes from the respondent, I submit that we're no better off in solving the unanticipated respondent problem than we are if the respondent sends a 200, or a 604. The UAC still has no way to tell if the response (success, failure, or redirection) is coming from an authorized respondent.  

The respondent would have to use the same identity procedures as the sender, i.e., the Identity and Identity-Info header. The sender can then look at that identity header to determine if it is valid.

 Moreover, how would a respondent know that it is necessary to force a redirection?  

Perhaps if the "To" header does not correspond to itself and if the Connected identity was requested (as per the suggestion above to use a Required or Supported header).

Finally, let me say a couple more things about redirection and the SUB/NOT model. I think you and I at least agree that many of the sipping-retarget problems start to go away if Bob's location service exposes the route target list associated with Bob to Alice. The more information the UAC gets, the less 'unanticpated' these respondents become. Redirection is of course one way that the route target list can be given to the UAC for its own use. Lately, though, I've been giving a lot of thought to what sip-events might be able to do for us here. Assuming something like reg-event, say, or maybe even just presence, the UAC can receive an up-to-the-minute picture of what sorts of services and URIs are associated with Bob. Presence can provide a menu of services, different URIs with different capabilities, associated with a particular user from which prospective callers can actually choose. If, when Alice subscribes to Bob's reg-events, say, she was able to see that Carol is a potential contact for Bob, then Alice wouldn't be surprised if, when she sent an INVITE to Bob, Carol answered. Potentially, exposing route target sets ahead of time could let Alice even choose from among the possible alternative contacts (to avoid people she wouldn't want to talk to anyway). If Alice sees that Carol is a contact for Bob, Alice could even fetch Carol's reg-event and learn that Ted is a contact for Carol, and thus be able to anticipate Ted, and so and so forth. The interesting thing about this approach is, of course, that we get to keep retargeting. What it further demonstrates is that it is possible for a UAC to get the information it needs to be able to anticipate retargeting even the UAC does not control call routing - I think this separation is critical to retargeting advocates. One can even imagine that presence-style policies, XCAP and so on, could be used to govern how much information the UAC gets about Bob's contacts for callee privacy purposes.  

Hum, I'm not completely sold on the idea, because it seems quite heavy. But to be fair, I can see how it could work in a lot of closely integrated environments. So I would say, why not give it a try and define those procedures.

But... ;^)

I don't believe it will solve all the problems. I strongly believe that ultimately, the sender and responder should be able to detect by themselves when retargeting occurs (including with existing "legacy" proxies), and be able to check their own identities. Who knows what the nasty network will do.

In a way, you could view what I am proposing (or something along those lines) as the mechanism of last resort. When not everybody in the network is doing it's job, or when the trust and administrative domain are many.

My point here is not, of course, to make a concrete proposal, but just to say that there are ways other than redirection that we might approach the unanticipated respondent problem, that there are clear tradeoffs, and that we can get some pretty interesting capabilities if we go down one path instead of another. Ultimately, I think we still have a long road ahead of us, in terms of understanding the problem we want to solve and understanding what is the best approach to a solution.

Indeed.

The way I see it, we need to design this in a way that encourages the use of presence/subscription, but has a fall-back mechanism for the cases where it doesn't apply or fails. So I really don't think it is a matter of one way or another.

Cheers.

 

------_=_NextPart_001_01C546E3.3059BE6A-- --===============0777622822== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip --===============0777622822==-- From sip-bounces@ietf.org Thu Apr 21 22:48:32 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DOoDY-0000i7-3N; Thu, 21 Apr 2005 22:48:32 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DOoDU-0000hw-Ej for sip@megatron.ietf.org; Thu, 21 Apr 2005 22:48:30 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA12413 for ; Thu, 21 Apr 2005 22:48:25 -0400 (EDT) Received: from zrtps0kp.nortelnetworks.com ([47.140.192.56]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DOoP1-00053E-5A for sip@ietf.org; Thu, 21 Apr 2005 23:00:23 -0400 Received: from zrtpd0jn.us.nortel.com (zrtpd0jn.us.nortel.com [47.140.202.35]) by zrtps0kp.nortelnetworks.com (Switch-2.2.6/Switch-2.2.0) with ESMTP id j3M2m7F03741; Thu, 21 Apr 2005 22:48:08 -0400 (EDT) Received: by zrtpd0jn.us.nortel.com with Internet Mail Service (5.5.2653.19) id ; Thu, 21 Apr 2005 22:48:08 -0400 Message-ID: <1ECE0EB50388174790F9694F77522CCF01F986B2@zrc2hxm0.corp.nortel.com> From: "Francois Audet" To: "'Peterson, Jon'" , "'Paul Kyzivat'" Subject: RE: sipping-retarget (was RE: [Sip] RE: Question to Identity draf t) Date: Thu, 21 Apr 2005 22:48:00 -0400 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2653.19) X-Spam-Score: 1.6 (+) X-Scan-Signature: 6e922792024732fb1bb6f346e63517e4 Cc: "'fluffy@cisco.com'" , 'IETF SIP List' , 'Fries Steffen' X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============1319970569==" Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. --===============1319970569== Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C546E5.B3C79C4A" This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. ------_=_NextPart_001_01C546E5.B3C79C4A Content-Type: text/plain I think we circled that one: in some cases it is appropriate, in other cases it is not. > -----Original Message----- > From: Peterson, Jon [mailto:jon.peterson@neustar.biz] > Sent: Thursday, April 21, 2005 16:51 > To: Paul Kyzivat > Cc: Audet, Francois [SC100:9T51:EXCH]; Fries Steffen; > fluffy@cisco.com; IETF SIP List > Subject: RE: sipping-retarget (was RE: [Sip] RE: Question to > Identity draft) > > > > That is certainly one of the primary cases I had in mind when > I suggested that a "group cert" would sometimes work; a case > where there is in fact effectively a group user agent. > > Jon Peterson > NeuStar, Inc. > > > I think this is largely a red herring. In many call center > > applications > > it will be a requirement not to disclose the identity of the actual > > agent - probably not even a synonym. There is a high > likelihood that the > > call center will act as a B2BUA between the caller and the > agents, for > > that reason and others. ("Your call may be monitored for > quality.") So > > there will be no retargetting as far as the caller is > concerned, and no > > identity problem. > > > > Paul > > > > ------_=_NextPart_001_01C546E5.B3C79C4A Content-Type: text/html RE: sipping-retarget (was RE: [Sip] RE: Question to Identity draft)

I think we circled that one: in some cases it is appropriate, in
other cases it is not.

> -----Original Message-----
> From: Peterson, Jon [
mailto:jon.peterson@neustar.biz]
> Sent: Thursday, April 21, 2005 16:51
> To: Paul Kyzivat
> Cc: Audet, Francois [SC100:9T51:EXCH]; Fries Steffen;
> fluffy@cisco.com; IETF SIP List
> Subject: RE: sipping-retarget (was RE: [Sip] RE: Question to
> Identity draft)
>
>
>
> That is certainly one of the primary cases I had in mind when
> I suggested that a "group cert" would sometimes work; a case
> where there is in fact effectively a group user agent.
>
> Jon Peterson
> NeuStar, Inc.
>
> > I think this is largely a red herring. In many call center
> > applications
> > it will be a requirement not to disclose the identity of the actual
> > agent - probably not even a synonym. There is a high
> likelihood that the
> > call center will act as a B2BUA between the caller and the
> agents, for
> > that reason and others. ("Your call may be monitored for
> quality.") So
> > there will be no retargetting as far as the caller is
> concerned, and no
> > identity problem.
> >
> >     Paul
> >
>
>

------_=_NextPart_001_01C546E5.B3C79C4A-- --===============1319970569== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip --===============1319970569==-- From sip-bounces@ietf.org Thu Apr 21 23:52:30 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DOpDR-0000Ak-EX; Thu, 21 Apr 2005 23:52:29 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DOpDO-00006P-C0 for sip@megatron.ietf.org; Thu, 21 Apr 2005 23:52:26 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA15918 for ; Thu, 21 Apr 2005 23:52:24 -0400 (EDT) Received: from syd-iport-1.cisco.com ([64.104.193.196]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DOpOw-0006Nw-MJ for sip@ietf.org; Fri, 22 Apr 2005 00:04:23 -0400 Received: from syd-core-1.cisco.com (64.104.193.198) by syd-iport-1.cisco.com with ESMTP; 22 Apr 2005 14:00:23 +1000 Received: from edison.cisco.com (edison.cisco.com [171.71.180.109]) by syd-core-1.cisco.com (8.12.10/8.12.6) with ESMTP id j3M3pdLM001729; Fri, 22 Apr 2005 13:51:40 +1000 (EST) Received: from dwingwxp (sjc-vpn2-840.cisco.com [10.21.115.72]) by edison.cisco.com (8.8.6 (PHNE_14041)/CISCO.SERVER.1.2) with ESMTP id UAA02865; Thu, 21 Apr 2005 20:52:05 -0700 (PDT) Message-Id: <200504220352.UAA02865@edison.cisco.com> From: "Dan Wing" To: "'Francois Audet'" , "'Cullen Jennings'" , "'Jon Peterson'" Subject: RE: [Sip] Question to Identity draft & cert draft Date: Thu, 21 Apr 2005 20:52:05 -0700 MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Office Outlook, Build 11.0.5510 Thread-Index: AcVFMZqiXk6JVOEvSNGTBCjivM7kgABiT9Pg In-Reply-To: <1ECE0EB50388174790F9694F77522CCF01F9784D@zrc2hxm0.corp.nortel.com> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1441 X-Spam-Score: 0.0 (/) X-Scan-Signature: d8ae4fd88fcaf47c1a71c804d04f413d Content-Transfer-Encoding: 7bit Cc: sip@ietf.org X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org > Cullen/Jon, > > I'm a little confused by the following paragraph in > draft-ietf-sip-identity-04 > in section 10: > > The Identity-Info header MUST contain either an HTTPS URI > or a SIPS > URI. If it contains an HTTPS URI, the URI must dereference to a > resource that contains a single MIME body containing the > certificate > of the authentication service. If it is a SIPS URI, then the > authentication service intends for a user agent that > wishes to fetch > the certificate to form a TLS connection to that URI, acquire the > certificate during normal TLS negotiation, and close the > connection. > > I understand the HTTPS URI case (which is used in the example in > draft-ietf-sip-identity-04), but I'm not sure I understand the > SIPS URI which is used in draft-ietf-sipping-certs-01. Hm, I couldn't find a SIPS URI used in -sipping-certs-01. > What do you > mean by fetching the certificate through a TLS connection? Why would > sips mean TLS? Do you mean fetch it using a SIP request over TLS? > I don't understand how it works (and why HTTPS is not sufficient). > > Can you elaborate? What I believe is being described is that, TLS client receives the TLS server's certificate during the TLS handshake. sip-identity-04 is unclear if you're supposed to complete the entire TLS exchange, or if you're supposed to prematurely terminate the TLS exchange to avoid the public-key operation on the SIPS TLS server. If you're supposed to prematurely terminate the TLS exchange, you won't get to the last step of the TLS handshake where TLS checks for a MiM (via the TLS "finished" messages). But maybe I interpreted it incorrectly. For sip-identity, I'm unsure of the advantage a TLS-protected HTTP or SIP connection affords retrieving a certificate: 1. If an impersonator is able to modify the SIP signaling in transit, the impersonator will be capable of generating a valid signature using their own certificate and will provide a URI pointing to the impersonator's certificate. However, sip-identity-04's existing comparison of the subjectAltName to the domain of the URI (section 7, 4th paragraph) should be sufficient to notice such an impersonation. 2. If an impersonator is UNable to modify signaling, but can be a MiM when you retrieve the certificate with your non-TLS-protected HTTP or SIP connection, that certificate won't authenticate the signed identity. So what's the attack that is mitigated through the use using a TLS-protected HTTP or SIP connection in retrieving the certificate for sip-identity? ... and I thought you were going to ask why sip-identity didn't use the SUBSCRIBE/NOTIFY method of sipping-certs, especially considering the common authors. Cullen/Jon? -d > I'm keeping this in SIP instead of SIPPING since one draft is > SIP the other > is SIPPING. > > _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Fri Apr 22 06:18:51 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DOvFL-0004Go-IG; Fri, 22 Apr 2005 06:18:51 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DOvFG-0004Fg-HN for sip@megatron.ietf.org; Fri, 22 Apr 2005 06:18:47 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id GAA01449 for ; Fri, 22 Apr 2005 06:18:44 -0400 (EDT) Received: from david.siemens.de ([192.35.17.14]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DOvQr-0006Gn-Q3 for sip@ietf.org; Fri, 22 Apr 2005 06:30:46 -0400 Received: from mail2.siemens.de (mail2.siemens.de [139.25.208.11]) by david.siemens.de (8.12.6/8.12.6) with ESMTP id j3MAIUEC022555; Fri, 22 Apr 2005 12:18:30 +0200 Received: from mchp9daa.mch.sbs.de (mchp9daa.mch.sbs.de [139.25.137.99]) by mail2.siemens.de (8.12.6/8.12.6) with ESMTP id j3MAITIQ008296; Fri, 22 Apr 2005 12:18:29 +0200 Received: by mchp9daa.mch.sbs.de with Internet Mail Service (5.5.2657.72) id <2SQ533KL>; Fri, 22 Apr 2005 12:18:29 +0200 Message-ID: From: Fries Steffen To: Cullen Jennings , Jon Peterson Subject: RE: [Sip] RE: Question to Identity draft Date: Fri, 22 Apr 2005 12:18:18 +0200 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2657.72) Content-Type: text/plain X-Spam-Score: 0.8 (/) X-Scan-Signature: 4d9ae72af46718088458d214998cc683 Cc: sip@ietf.org X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org > If Alice and Bob both get to use a phone called Device A, do > both Alice and Bob learn the private key of Device A? Good point. It may lead to the same problem downloading credentials to a device which is is not completely under the users control. > If device A calls Bob, and Bob is going to answer on device > B, how does A know what certificate to use for encrypting. There are for instance MIKEY options in discussion, were the sender proposes his certificate in the first message, while the receiver uses it for encryption in a reply. So there is no need of having the certificate in advance. Also signed DH variants do not need the receivers certificate in advance. For sdescriptions, well, you are right, there I would need to have the cert in advance. > > > > On 4/20/05 11:12 PM, "Fries Steffen" > wrote: > > > Assume an enterprise does not issue certificates to users but for > > devices for whatever reason. So the user authenticates during > > registration by using his username and password with HTTP Digest > > Authentication. The client he uses possesses a certificate. > When this > > user wants to make a phone call to somebody else, were, e.g., SRTP > > shall be used to encrypt the media, he simply may use the > certificate > > (and corresponding private key) belonging to the phone he > is using, if > > some instance is there assuring that he uses a dedicated (allowed) > > identity in the from field. As soon as the call ends and the same > > person is called again by the same user, the callee might receive a > > different certificate in case the caller switched the phone. The > > certificate may be used to protect the signaling for DSRTP > with either > > MIKEY or sdecription. I would consider this as a scenario, were the > > identity draft helps, as the authentication server assures > the identity from the FROM field, while the cert approach may > be to long winded. > > > >> -----Original Message----- > >> From: Cullen Jennings [mailto:fluffy@cisco.com] > >> Sent: Wednesday, April 20, 2005 7:38 PM > >> To: Fries Steffen; Jon Peterson > >> Cc: sip@ietf.org > >> Subject: Re: [Sip] RE: Question to Identity draft > >> > >> > >> I'm lost on why and how you would use a device certificate to be a > >> user certificate. When a user logged off the phone would > you revoke > >> the device certificate? It just all sounds very > convoluted. I more > >> or less view a user certificate as something that binds a > user to a > >> private key. What it sounds like you are doing here is binding a > >> private key that is specific to the device to the user. > >> > >> On 4/20/05 1:05 AM, "Fries Steffen" > wrote: > >> > >>> Agreed. > >>> What I had in mind was more that Alice from example.com > uses a cert > >>> issued for 00342506@mysip.example.com, which may be a self-signed > >>> certificate or come from a corporate CA, which has not public > >>> available root certificate. In this case the > authentication service > >>> asserts the FROM field and the cert (in the body) may be > >> used within > >>> the dialog. > >>> > >>> @Jon, I dont think this approach obviates the > >> authentication service at all. > >>> On > >>> the contrary, the authentication service MUST assert the > >> identity at > >>> the beginning of the session, and the receiver is able to > keep this > >>> assertion together with the certificate received in the asserted > >>> message. The authentication service may be then left out of > >> the path > >>> for the rest of the session, when not needed or may be > invoked for > >>> further assertions. From my point of view this would be worth > >>> mentioning it as an example in the identity ID. > >>> > >>> Regarding the cert service, this service is extermely useful, > >>> especially for the approach of storing credentials. But > >> there may be > >>> scenarios, were the usage may be simplyfied by using just the > >>> authentication service. For instance in cases were the > user has no > >>> certificate at all but the used device has one assigned (I > >> used that > >>> example at the beginning of this discussion too). The > >> certificate may > >>> have no meaning outside an enterprise but using the > authentication > >>> service provides the meaning for the receiver, at least for the > >>> duration of the session. The worst case here would be that > >> the caller > >>> uses a different phone for each call. Well, it might not be very > >>> likely, but it may be the worst case. Using a cert service > >> here would > >>> mean, that I would have to propagate my certificate > >> information each > >>> time I change the device. > >>> The > >>> certificate server would use the authentication server to > >> assert the > >>> FROM field and provide integrity protection for the body > >> when sending > >>> a NOTIFY. In those scenarios, the user may also sent the > >> certificate > >>> information inline via an authentication service and thus save > >>> additional communication with the cert server. Another > >> scenario may be > >>> the case were the cert server is not reachable by every > >> receiver of a call. > >>> > >>> Regards > >>> Steffen > >>> > >>> > >>> > >>>> -----Original Message----- > >>>> From: Cullen Jennings [mailto:fluffy@cisco.com] > >>>> Sent: Tuesday, April 19, 2005 10:30 PM > >>>> To: Fries Steffen > >>>> Cc: sip@ietf.org; Jon Peterson > >>>> Subject: Re: [Sip] RE: Question to Identity draft > >>>> Importance: High > >>>> > >>>> > >>>> Agreeing with Jon here and want to point out a critical > >> thing about > >>>> the certificates. For the AOR alice@example.com, the > >> certificate in a > >>>> body would most likely be for the user alice@example.com > while the > >>>> certificate used for identity is for the domain example.com. You > >>>> can't use a certificate for a user, like alice@example.com > >> to assert > >>>> identity using the identity draft mechanism. > >>>> > >>>> Cullen > >>>> > >>>> > >>>> On 4/19/05 11:55 AM, "Peterson, Jon" > >> wrote: > >>>> > >>>>> > >>>>> I do agree that sip-identity provides body integrity, and > >> as such, > >>>>> that it could be used to provide integrity protection for a > >>>>> self-signed certificate in the body of a SIP message, and > >>>> furthermore, > >>>>> that such a self-signed certificate could be used in > subsequently > >>>>> messages to provide confidentiality services for SIP > >>>> message bodies in > >>>>> order to encrypt symmetric keys used for SRTP. > >>>>> > >>>>> I have reservations when we start describing the use of that > >>>>> self-signed certificate to provide integrity services for > >>>> subsequent > >>>>> requests, thereby obviating the need to use an authentication > >>>>> services. I furthermore think that sipping-certs provides a > >>>> better way > >>>>> to discover certificates for confidentiality than this > >>>> method of tunneling certificates in SIP requests. > >>>>> > >>>>> That much said, I would not rule out tunneling self-signed > >>>>> certificates in this fashion, no. > >>>>> > >>>>> Jon Peterson > >>>>> NeuStar, Inc. > >>>>> > >>>>>> -----Original Message----- > >>>>>> From: Fries Steffen [mailto:steffen.fries@siemens.com] > >>>>>> Sent: Thursday, April 14, 2005 7:48 AM > >>>>>> To: Peterson, Jon; fluffy@cisco.com > >>>>>> Cc: IETF SIP List > >>>>>> Subject: RE: [Sip] RE: Question to Identity draft > >>>>>> > >>>>>> > >>>>>> Hi Jon, > >>>>>> > >>>>>> I'm still not sure what the answer to the scenarios is. > >>>>>> > >>>>>> Do you see the option with the identity draft to assert a > >>>> FROM field > >>>>>> of a SIP message and also an embedded certificate in the > >> body and > >>>>>> thus have a security context for that dialog. The > >>>> security context > >>>>>> may be used on subsequent messages (e.g., to negotiate media > >>>>>> encryption), which do not need to be sent via the > >>>> authentication service? > >>>>>> > >>>>>> Regards > >>>>>> Steffen > >>>>>> > >>>>>> > >>>>>>> -----Original Message----- > >>>>>>> From: sip-bounces@ietf.org [mailto:sip-bounces@ietf.org] > >>>> On Behalf > >>>>>>> Of Fries Steffen > >>>>>>> Sent: Thursday, April 07, 2005 4:56 PM > >>>>>>> To: Peterson, Jon; fluffy@cisco.com > >>>>>>> Cc: IETF SIP List > >>>>>>> Subject: [Sip] RE: Question to Identity draft > >>>>>>> Importance: High > >>>>>>> > >>>>>>> Hi Jon, > >>>>>>> > >>>>>>>>> [stf] yes, RFC3261 talks about certificate exchhange. But > >>>>>>>> here it is > >>>>>>>>> only possible to take certificates, which are (more or > >>>>>>>> less) bound to a person. > >>>>>>>>> Assume that you use certificates, which are bound to the > >>>>>>>> host used for > >>>>>>>>> phone calls. Then you would need some instance assuring, > >>>>>>> that this > >>>>>>>>> certificate is connected with the registration > under some AOR. > >>>>>>>>> > >>>>>>>>> What I had in mind is an inband certificate exchange from, > >>>>>>>> e.g., self > >>>>>>>>> signed certificates, were the authentication services > >> basically > >>>>>>>>> assures that the message (and thus the certificate) came > >>>>>>>> from a person > >>>>>>>>> registered under a certain AOR. > >>>>>>>> > >>>>>>>> RFC3261 does in fact describe the self-signed > certificate case. > >>>>>>> [stf] Okay, I put it in a wrong way, I meant the > >> certificate must > >>>>>>> follow some dedicated syntax, connected with the > domain you are > >>>>>>> registering in. > >>>>>>> When you have something like device certificates, which > >>>> are issued > >>>>>>> by a corporate CA on the base of machine names, these > >>>> certificates > >>>>>>> may be used in SIP scenarios. After successful > registering, the > >>>>>>> Proxy knows, that a user, who authenticated himself > >> using digest > >>>>>>> authentication over a TLS link that he uses the > >> dedicated device > >>>>>>> certificate for the duration of his registration for security > >>>>>>> purposes. That means next time he registers, his > >> identity may be > >>>>>>> connected with a different certificate, as he may use a > >> different > >>>>>>> phone. Sure, the user could publish the certificate to a cert > >>>>>>> server, as described in the certs draft, but I was > >>>> thinking of some > >>>>>>> kind of "inband provisioning" for such a scenario. > >>>>>>> > >>>>>>>> > >>>>>>>>> The certificate itself may then be used for end-to-end > >>>>>> integrity > >>>>>>>>> services. > >>>>>>>> > >>>>>>>> In what respect would using this certificates for an > >> end-to-end > >>>>>>>> integrity service be superior to just using > >>>>>>>> sip-identity-04 for integrity? Note that that strength of a > >>>>>>>> self-signed credential is necessarily equivalent to the > >>>>>> strength of > >>>>>>>> the security mechanism used to deliver that self-signed > >>>>>>> credential to > >>>>>>>> potential users. So, if > >>>>>>>> sip-identity-04 is used to secure the cert, it isn't > >>>>>> clear how the > >>>>>>>> cert provides a stronger or more attractive assurance than > >>>>>>>> sip-identity-04 itself would provide. > >>>>>>> [stf]Using the certificate would require to send just > >> one message > >>>>>>> over the authentication service and use the supplied > >>>> certificate for > >>>>>>> the rest of the communication. > >>>>>>> > >>>>>>> > >>>>>>>>> A usage example would be the key management for SRTP using > >>>>>>>> MIKEY, were > >>>>>>>>> one option is the usage of certificates. When here a > >>>>>>> certificate is > >>>>>>>>> used, which is completely unknown to the receiver, then > >>>>>>> there is no > >>>>>>>>> real value. But when a trusted component (the > >>>>>>>> authentication service) > >>>>>>>>> assures, that a person registered with a dedicated AOR is > >>>>>>> connected > >>>>>>>>> with this certificate, then it gets a meaning. It would > >>>>>> basically > >>>>>>>>> provide the assurance, that for the time I am in the call, > >>>>>>>> I am using > >>>>>>>>> this certificate, which may be sufficient. > >>>>>>>> > >>>>>>>> No question that using sip-identity-04 would guarantee the > >>>>>>> integrity > >>>>>>>> of the certificate contained in a SIP message body. > >>>>>>>> But why not have sip-identity-04 secure the SDP body > >>>>>> containing the > >>>>>>>> keymgmt attribute for MIKEY, rather than going through a > >>>>>>> certificate > >>>>>>>> exchange phase in order to subsequently use the a cert > >>>>>>> (whose strength > >>>>>>>> is equivalent to > >>>>>>>> sip-identity-04) to secure the SDP body containing the > >>>>>> keymgmt? In > >>>>>>>> what respect is this not a redundant step? > >>>>>>> [stf] as stated above, the authentication server > would only be > >>>>>>> needed for one message, to support the establishment of > >> a session > >>>>>>> security context. The other thing is that for the key > >>>> management for > >>>>>>> SRTP the client itself needs to include the appropriate > >>>> message body > >>>>>>> for MIKEY, as the MIKEY container is protected. The > >> same would be > >>>>>>> true in scenarios were S/MIME would be required to protect > >>>>>>> sdescriptions. > >>>>>>> > >>>>>>> > >>>>>>> Regards > >>>>>>> Steffen > >>>>>>> > >>>>>>>> > >>>>>>>> Jon Peterson > >>>>>>>> NeuStar, Inc. > >>>>>>>> > >>>>>>>>> Regards > >>>>>>>>> Steffen > >>>>>>>>> > >>>>>>>>> > >>>>>>>> > >>>>>>> > >>>>>>> _______________________________________________ > >>>>>>> Sip mailing list https://www1.ietf.org/mailman/listinfo/sip > >>>>>>> This list is for NEW development of the core SIP Protocol Use > >>>>>>> sip-implementors@cs.columbia.edu for questions on > >> current sip Use > >>>>>>> sipping@ietf.org for new developments on the > application of sip > >>>>>>> > >>>>>> > >>>> > >> > _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Fri Apr 22 10:43:41 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DOzNd-0005HX-PI; Fri, 22 Apr 2005 10:43:41 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DOzNb-0005HP-GK for sip@megatron.ietf.org; Fri, 22 Apr 2005 10:43:39 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA24325 for ; Fri, 22 Apr 2005 10:43:37 -0400 (EDT) Received: from motgate3.mot.com ([144.189.100.103]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DOzZE-0004PA-N4 for sip@ietf.org; Fri, 22 Apr 2005 10:55:42 -0400 Received: from il06exr02.mot.com (il06exr02.mot.com [129.188.137.132]) by motgate3.mot.com (8.12.11/Motgate3) with ESMTP id j3MEqqaa000560 for ; Fri, 22 Apr 2005 07:52:52 -0700 (MST) Received: from zit05exm01.mtci.mot.com (zit05exm01.mtci.mot.com [10.162.32.8]) by il06exr02.mot.com (8.13.1/8.13.0) with ESMTP id j3MEjxMC009440 for ; Fri, 22 Apr 2005 09:46:00 -0500 (CDT) Received: by zit05exm01.mtci.mot.com with Internet Mail Service (5.5.2657.72) id ; Fri, 22 Apr 2005 16:43:27 +0200 Message-ID: <0B072DCDF0F4D511A7EA00805FA784C808352920@zit05exm01.mtci.mot.com> From: Derenale Corrado-ACD101 To: sip@ietf.org Date: Fri, 22 Apr 2005 16:43:23 +0200 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2657.72) Content-Type: text/plain X-Spam-Score: 0.0 (/) X-Scan-Signature: 7aefe408d50e9c7c47615841cb314bed Subject: [Sip] sip-identity-05 X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org Sorry for bothering you all, but where can I find the 5th version of the sip identity draft? On the WG site I only found the sip-identity-04. Thank you, \cdr _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Fri Apr 22 17:15:44 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DP5V1-0005g5-SY; Fri, 22 Apr 2005 17:15:43 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DP5Uz-0005fb-0Y for sip@megatron.ietf.org; Fri, 22 Apr 2005 17:15:41 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA03132 for ; Fri, 22 Apr 2005 17:15:38 -0400 (EDT) Received: from sj-iport-5.cisco.com ([171.68.10.87]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DP5gf-0000Sr-LA for sip@ietf.org; Fri, 22 Apr 2005 17:27:47 -0400 Received: from sj-core-4.cisco.com (171.68.223.138) by sj-iport-5.cisco.com with ESMTP; 22 Apr 2005 14:15:30 -0700 Received: from vtg-um-e2k4.sj21ad.cisco.com (vtg-um-e2k4.cisco.com [171.70.93.57]) by sj-core-4.cisco.com (8.12.10/8.12.6) with ESMTP id j3MLFRpR007786; Fri, 22 Apr 2005 14:15:27 -0700 (PDT) Received: from [127.0.0.1] ([171.68.225.134]) by vtg-um-e2k4.sj21ad.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Fri, 22 Apr 2005 14:16:25 -0700 User-Agent: Microsoft-Entourage/11.1.0.040913 Date: Fri, 22 Apr 2005 14:15:26 -0700 Subject: Re: [Sip] sip-identity-05 From: Cullen Jennings To: Derenale Corrado-ACD101 , "sip@ietf.org" Message-ID: In-Reply-To: <0B072DCDF0F4D511A7EA00805FA784C808352920@zit05exm01.mtci.mot.com> Mime-version: 1.0 Content-type: text/plain; charset="US-ASCII" Content-transfer-encoding: 7bit X-OriginalArrivalTime: 22 Apr 2005 21:16:25.0943 (UTC) FILETIME=[8AC43E70:01C54780] X-Spam-Score: 1.1 (+) X-Scan-Signature: 798b2e660f1819ae38035ac1d8d5e3ab Content-Transfer-Encoding: 7bit Cc: X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org 05 does not exist yet - we are just debating what we should put in it On 4/22/05 7:43 AM, "Derenale Corrado-ACD101" wrote: > Sorry for bothering you all, but where can I find the 5th version of the sip > identity draft? > > On the WG site I only found the sip-identity-04. > > Thank you, > > \cdr > > _______________________________________________ > Sip mailing list https://www1.ietf.org/mailman/listinfo/sip > This list is for NEW development of the core SIP Protocol > Use sip-implementors@cs.columbia.edu for questions on current sip > Use sipping@ietf.org for new developments on the application of sip _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Fri Apr 22 17:46:04 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DP5yO-0003So-SK; Fri, 22 Apr 2005 17:46:04 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DP5yI-0003KC-GA for sip@megatron.ietf.org; Fri, 22 Apr 2005 17:46:02 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA05484 for ; Fri, 22 Apr 2005 17:45:56 -0400 (EDT) Received: from sj-iport-4.cisco.com ([171.68.10.86]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DP6A0-0001Em-EY for sip@ietf.org; Fri, 22 Apr 2005 17:58:04 -0400 Received: from sj-core-3.cisco.com (171.68.223.137) by sj-iport-4.cisco.com with ESMTP; 22 Apr 2005 14:45:49 -0700 Received: from vtg-um-e2k4.sj21ad.cisco.com (vtg-um-e2k4.cisco.com [171.70.93.57]) by sj-core-3.cisco.com (8.12.10/8.12.6) with ESMTP id j3MLjkb4023138; Fri, 22 Apr 2005 14:45:46 -0700 (PDT) Received: from [127.0.0.1] ([171.68.225.134]) by vtg-um-e2k4.sj21ad.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Fri, 22 Apr 2005 14:46:44 -0700 User-Agent: Microsoft-Entourage/11.1.0.040913 Date: Fri, 22 Apr 2005 14:45:45 -0700 From: Cullen Jennings To: Dan Wing , "'Francois Audet'" , Jon Peterson Message-ID: In-Reply-To: <200504220352.UAA02865@edison.cisco.com> Mime-version: 1.0 Content-type: text/plain; charset="US-ASCII" Content-transfer-encoding: 7bit X-OriginalArrivalTime: 22 Apr 2005 21:46:45.0239 (UTC) FILETIME=[C726C870:01C54784] X-Spam-Score: 1.1 (+) X-Scan-Signature: 14582b0692e7f70ce7111d04db3781c8 Content-Transfer-Encoding: 7bit Cc: "sip@ietf.org" Subject: [Sip] Identity draft and fetching the certificate X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org Right now, the draft works as Dan describes below but I have got a ton of feedback that we need to change that. I would like to change it to the URI specifies a URI to fetch a certificate as specified in RFC 2585. So the URI would look like http://www.netcom.com/sp/spyrus/housley.cer It would have to have an file extension of .cer . A normal HTTP GET would be performed on this and would return a MIME body of type application/pkix-cert. Inside this body would be the DER encoded X.509 cert. This is all defined in 2585. Cullen On 4/21/05 8:52 PM, "Dan Wing" wrote: >> Cullen/Jon, >> >> I'm a little confused by the following paragraph in >> draft-ietf-sip-identity-04 >> in section 10: >> >> The Identity-Info header MUST contain either an HTTPS URI >> or a SIPS >> URI. If it contains an HTTPS URI, the URI must dereference to a >> resource that contains a single MIME body containing the >> certificate >> of the authentication service. If it is a SIPS URI, then the >> authentication service intends for a user agent that >> wishes to fetch >> the certificate to form a TLS connection to that URI, acquire the >> certificate during normal TLS negotiation, and close the >> connection. >> >> I understand the HTTPS URI case (which is used in the example in >> draft-ietf-sip-identity-04), but I'm not sure I understand the >> SIPS URI which is used in draft-ietf-sipping-certs-01. > > Hm, I couldn't find a SIPS URI used in -sipping-certs-01. > >> What do you >> mean by fetching the certificate through a TLS connection? Why would >> sips mean TLS? Do you mean fetch it using a SIP request over TLS? >> I don't understand how it works (and why HTTPS is not sufficient). >> >> Can you elaborate? > > What I believe is being described is that, TLS client receives the TLS > server's certificate during the TLS handshake. sip-identity-04 is unclear > if you're supposed to complete the entire TLS exchange, or if you're > supposed to prematurely terminate the TLS exchange to avoid the public-key > operation on the SIPS TLS server. > > If you're supposed to prematurely terminate the TLS exchange, you won't get > to the last step of the TLS handshake where TLS checks for a MiM (via the > TLS "finished" messages). > > But maybe I interpreted it incorrectly. > > > > For sip-identity, I'm unsure of the advantage a TLS-protected HTTP or SIP > connection affords retrieving a certificate: > > 1. If an impersonator is able to modify the SIP signaling in transit, the > impersonator will be capable of generating a valid signature using their own > certificate and will provide a URI pointing to the impersonator's > certificate. However, sip-identity-04's existing comparison of the > subjectAltName to the domain of the URI (section 7, 4th paragraph) should be > sufficient to notice such an impersonation. > > 2. If an impersonator is UNable to modify signaling, but can be a MiM when > you retrieve the certificate with your non-TLS-protected HTTP or SIP > connection, that certificate won't authenticate the signed identity. > > So what's the attack that is mitigated through the use using a TLS-protected > HTTP or SIP connection in retrieving the certificate for sip-identity? > > > ... and I thought you were going to ask why sip-identity didn't use the > SUBSCRIBE/NOTIFY method of sipping-certs, especially considering the common > authors. Cullen/Jon? > > -d > > >> I'm keeping this in SIP instead of SIPPING since one draft is >> SIP the other >> is SIPPING. >> >> _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Fri Apr 22 17:46:14 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DP5yY-0003U5-6D; Fri, 22 Apr 2005 17:46:14 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DP5yV-0003Ts-5i for sip@megatron.ietf.org; Fri, 22 Apr 2005 17:46:11 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA05497 for ; Fri, 22 Apr 2005 17:46:08 -0400 (EDT) Received: from sj-iport-5.cisco.com ([171.68.10.87]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DP6AC-0001F3-6o for sip@ietf.org; Fri, 22 Apr 2005 17:58:17 -0400 Received: from sj-core-4.cisco.com (171.68.223.138) by sj-iport-5.cisco.com with ESMTP; 22 Apr 2005 14:46:01 -0700 Received: from vtg-um-e2k4.sj21ad.cisco.com (vtg-um-e2k4.cisco.com [171.70.93.57]) by sj-core-4.cisco.com (8.12.10/8.12.6) with ESMTP id j3MLjvpR017394; Fri, 22 Apr 2005 14:45:58 -0700 (PDT) Received: from [127.0.0.1] ([171.68.225.134]) by vtg-um-e2k4.sj21ad.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Fri, 22 Apr 2005 14:46:56 -0700 User-Agent: Microsoft-Entourage/11.1.0.040913 Date: Fri, 22 Apr 2005 14:45:57 -0700 Subject: Re: [Sip] RE: Question to Identity draft From: Cullen Jennings To: Michael Thomas Message-ID: In-Reply-To: <1114023181.5648.6.camel@thomasm-lnx.cisco.com> Mime-version: 1.0 Content-type: text/plain; charset="US-ASCII" Content-transfer-encoding: 7bit X-OriginalArrivalTime: 22 Apr 2005 21:46:56.0989 (UTC) FILETIME=[CE27B0D0:01C54784] X-Spam-Score: 1.1 (+) X-Scan-Signature: 0bc60ec82efc80c84b8d02f4b0e4de22 Content-Transfer-Encoding: 7bit Cc: "sip@ietf.org" , Jon Peterson , Fries Steffen X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org With email, you need to be able to do offline things and this may be needed but with SIP it is only online and it's not clear this extra level of indirection is needed. You can't phone the CEO without going to the proxy, likewise the CEO can't phone you without going to the same proxy that provides the Auth service. On 4/20/05 11:53 AM, "Michael Thomas" wrote: > On Tue, 2005-04-19 at 13:30, Cullen Jennings wrote: >> You can't use a certificate for a >> user, like alice@example.com to assert identity using the identity draft >> mechanism. > > That strikes me as a bug rather than a feature. What if I > have outsourced functions where I only want to delegate > a certain subset of sip URI's to them? Oh say, like > outsource@example.com that's really some other company? > That is, I want them to be able to assert outsource@example.com, > but nothing else. Or suppose that alice@example.com is the > CEO and she wants to be able to call from her device on the > road when she's not behind the example.com corporate > proxies? Why can't she just sign the identity herself... > she's the CEO, right? > > Mike _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Fri Apr 22 17:46:25 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DP5yj-0003Ui-Mw; Fri, 22 Apr 2005 17:46:25 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DP5yd-0003Ud-TA for sip@megatron.ietf.org; Fri, 22 Apr 2005 17:46:24 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA05500 for ; Fri, 22 Apr 2005 17:46:17 -0400 (EDT) Received: from sj-iport-4.cisco.com ([171.68.10.86]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DP6AL-0001FH-Tn for sip@ietf.org; Fri, 22 Apr 2005 17:58:26 -0400 Received: from sj-core-4.cisco.com (171.68.223.138) by sj-iport-4.cisco.com with ESMTP; 22 Apr 2005 14:46:11 -0700 Received: from vtg-um-e2k4.sj21ad.cisco.com (vtg-um-e2k4.cisco.com [171.70.93.57]) by sj-core-4.cisco.com (8.12.10/8.12.6) with ESMTP id j3MLk8pR017454; Fri, 22 Apr 2005 14:46:08 -0700 (PDT) Received: from [127.0.0.1] ([171.68.225.134]) by vtg-um-e2k4.sj21ad.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Fri, 22 Apr 2005 14:47:06 -0700 User-Agent: Microsoft-Entourage/11.1.0.040913 Date: Fri, 22 Apr 2005 14:46:07 -0700 Subject: Re: authority for a domain (was RE: [Sip] sip-identity-05: display-name woes) From: Cullen Jennings To: Michael Thomas , Jon Peterson Message-ID: In-Reply-To: <1114008600.5211.34.camel@thomasm-lnx.cisco.com> Mime-version: 1.0 Content-type: text/plain; charset="US-ASCII" Content-transfer-encoding: 7bit X-OriginalArrivalTime: 22 Apr 2005 21:47:06.0630 (UTC) FILETIME=[D3E6CA60:01C54784] X-Spam-Score: 1.1 (+) X-Scan-Signature: 8abaac9e10c826e8252866cbe6766464 Content-Transfer-Encoding: 7bit Cc: "sip@ietf.org" , Francois Audet , Paul H Kyzivat X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org It sounds like a possible solution to this problem would be to defined some Key Usage Extensions (see RFC 3280) in the certificate that said it was allowed to be used for SIP, SSH, Prize Rooster Protocol, or whatever. This would allow a certificate to be generated for example.com that could only be used by the SIP server and not the Rooster Roaster. On 4/20/05 7:50 AM, "Michael Thomas" wrote: > On Tue, 2005-04-19 at 11:37, Peterson, Jon wrote: >> Mike, >> >>> As far as I can tell, there's an implicit assumption in >>> sip-identity that the way that example.com would prevent >>> me from signing sip-identites for the whole domain is >>> to... just not give me that cert. >> >> The draft does assume that if you hold a cert for example.com (i.e., a >> CA-signed cert with the subjectAltName 'example.com'), then you are the >> legitimate authority for example.com. > > Authority for _what_? SIP? Prize Rooster trading? All of the > above? If not all of the above, what if I want to use the > same technique for the Prize Rooster Trading Protocol... but > it seems that I can't because SIP got there first[*]. If it is > all of the above, then that's a real problem in the delegation > arena since I don't want my telephony guys having any authority > over who's allowed to trade my Prize Roosters. _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Fri Apr 22 18:15:21 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DP6Np-0000fQ-12; Fri, 22 Apr 2005 18:12:21 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DP6Nm-0000fH-Ek for sip@megatron.ietf.org; Fri, 22 Apr 2005 18:12:18 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA08223 for ; Fri, 22 Apr 2005 18:12:15 -0400 (EDT) Received: from sj-iport-5.cisco.com ([171.68.10.87]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DP6ZT-0001yN-ET for sip@ietf.org; Fri, 22 Apr 2005 18:24:24 -0400 Received: from sj-core-4.cisco.com (171.68.223.138) by sj-iport-5.cisco.com with ESMTP; 22 Apr 2005 15:12:09 -0700 Received: from vtg-um-e2k4.sj21ad.cisco.com (vtg-um-e2k4.cisco.com [171.70.93.57]) by sj-core-4.cisco.com (8.12.10/8.12.6) with ESMTP id j3MMC5pR028126; Fri, 22 Apr 2005 15:12:05 -0700 (PDT) Received: from [127.0.0.1] ([171.68.225.134]) by vtg-um-e2k4.sj21ad.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Fri, 22 Apr 2005 15:13:04 -0700 User-Agent: Microsoft-Entourage/11.1.0.040913 Date: Fri, 22 Apr 2005 15:12:04 -0700 Subject: Re: authority for a domain (was RE: [Sip] sip-identity-05:display-name woes) From: Cullen Jennings To: Paul H Kyzivat , Michael Thomas Message-ID: In-Reply-To: <4267A461.4090103@cisco.com> Mime-version: 1.0 Content-type: text/plain; charset="US-ASCII" Content-transfer-encoding: 7bit X-OriginalArrivalTime: 22 Apr 2005 22:13:04.0361 (UTC) FILETIME=[7461AD90:01C54788] X-Spam-Score: 1.1 (+) X-Scan-Signature: 4d87d2aa806f79fed918a62e834505ca Content-Transfer-Encoding: 7bit Cc: "sip@ietf.org" , Francois Audet , Jon Peterson X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org The best practices around handling namespaces are pretty ugly. For example, if you left your current employer, people sending you email might suddenly find that their personal email to you was being delivered to HR. We have a change in the person receiving the message over the same protocol for the same name - this is nasty but more or less a requirement of enterprise email. Trying to enforce how domains manage the names is pretty hard. On 4/21/05 6:02 AM, "Paul Kyzivat" wrote: > Mike & Jon, > > I don't know much about the mechanics of this, but I'm learning a lot > and having fun watching the two of you go at it. If the two of you don't > kill each other then I think we may get a good outcome. I want to > comment on one point from a requirements point of view: > > Michael Thomas wrote: > >> The point here is that you're forcing a particular shape of the >> namespace to accommodate the ability to delegate authorization. What >> disturbs me is that you're not doing this by shunting the authorization >> information into a backwater of the namespace (which is what both >> IIM and DK do), but instead forcing the real life *users* of the >> namespace to be shunted over there too. That is, I'd have to be known >> as mat@sip.example.com and mat@prtp.example.com, and so forth. That >> strikes me as really, really ugly and mostly likely administratively >> infeasible for large existing domains. Preserving a single name for >> end identities across different services seems like it should be a >> *requirement* to me. As in, a first principle. > > I think this is really important. Its not sufficient that the email > service at example.com may have a user mat@example.com and the sip > service may have a user mat@example.com. Its important that those two be > assigned to the same "entity". > > I don't want to get into a situation where, after having talked with > > "Miles Anderson Thomas" > > I send email to mat@example.com only to discover that it goes to > > "Mary Alice Taylor" > > Paul > > _______________________________________________ > Sip mailing list https://www1.ietf.org/mailman/listinfo/sip > This list is for NEW development of the core SIP Protocol > Use sip-implementors@cs.columbia.edu for questions on current sip > Use sipping@ietf.org for new developments on the application of sip _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Fri Apr 22 18:17:45 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DP6T3-0001q6-DR; Fri, 22 Apr 2005 18:17:45 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DP6T1-0001pw-L6 for sip@megatron.ietf.org; Fri, 22 Apr 2005 18:17:43 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA09091 for ; Fri, 22 Apr 2005 18:17:41 -0400 (EDT) Received: from sj-iport-5.cisco.com ([171.68.10.87]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DP6ej-00029K-UU for sip@ietf.org; Fri, 22 Apr 2005 18:29:50 -0400 Received: from sj-core-4.cisco.com (171.68.223.138) by sj-iport-5.cisco.com with ESMTP; 22 Apr 2005 15:17:35 -0700 Received: from vtg-um-e2k4.sj21ad.cisco.com (vtg-um-e2k4.cisco.com [171.70.93.57]) by sj-core-4.cisco.com (8.12.10/8.12.6) with ESMTP id j3MMHVpR029498; Fri, 22 Apr 2005 15:17:32 -0700 (PDT) Received: from [127.0.0.1] ([171.68.225.134]) by vtg-um-e2k4.sj21ad.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Fri, 22 Apr 2005 15:18:30 -0700 User-Agent: Microsoft-Entourage/11.1.0.040913 Date: Fri, 22 Apr 2005 15:17:31 -0700 From: Cullen Jennings To: Jonathan Rosenberg , Jon Peterson Message-ID: In-Reply-To: <422B5A6C.8060505@cisco.com> Mime-version: 1.0 Content-type: text/plain; charset="US-ASCII" Content-transfer-encoding: 7bit X-OriginalArrivalTime: 22 Apr 2005 22:18:30.0833 (UTC) FILETIME=[36F95A10:01C54789] X-Spam-Score: 1.1 (+) X-Scan-Signature: 8abaac9e10c826e8252866cbe6766464 Content-Transfer-Encoding: 7bit Cc: "sip@ietf.org" Subject: [Sip] Is Domain X using Identity problem X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org On 3/6/05 1:30 PM, "Jonathan Rosenberg" wrote: > > As such, I think some kind of companion technique for "checking if > domain X is using sip-identity" is needed. It need not be defined here, > but it seems crucial to successful deployment of this. > > Imagine we had this. Consider the two cases: a) domain supports identity but I just got a message with no Identity headers b) domain does not support it and I just got a message with no Identity headers The type of authorization I might do for these two case are somewhat different so I can see that this has some value. However, many of the attacks and problems that you might hope to stop with having this can still be done by the attacker just using a domain that does not support identity. Anyways, I can imagine a few ways to query this flag. 1) DNS - keep the flag in DNS 2) SIP - send an OPTIONS over TLS to the domain and get the flag 3) HTTP - send a HTTP request to some well known location Option 2 has the advantage of an attacker not being able to spoof the result. _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Fri Apr 22 18:27:15 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DP6cF-0003yE-Nd; Fri, 22 Apr 2005 18:27:15 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DP6cD-0003y8-0l for sip@megatron.ietf.org; Fri, 22 Apr 2005 18:27:13 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA09981 for ; Fri, 22 Apr 2005 18:27:10 -0400 (EDT) Received: from oak.neustar.com ([209.173.53.70]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DP6nu-0002O5-Qr for sip@ietf.org; Fri, 22 Apr 2005 18:39:19 -0400 Received: from stntsmtp1.cis.neustar.com (smartexch.neustar.com [10.31.13.79]) by oak.neustar.com (8.12.8/8.11.0) with ESMTP id j3MMQ1KD001540; Fri, 22 Apr 2005 22:26:01 GMT Received: from stntexch03.cis.neustar.com ([10.31.13.45]) by stntsmtp1.cis.neustar.com with Microsoft SMTPSVC(6.0.3790.211); Fri, 22 Apr 2005 18:26:00 -0400 X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Subject: RE: authority for a domain (was RE:[Sip]sip-identity-05:display-name woes) Date: Fri, 22 Apr 2005 18:26:00 -0400 Message-ID: <24EAE5D4448B9D4592C6D234CBEBD59701502E5A@stntexch03.cis.neustar.com> Thread-Topic: authority for a domain (was RE:[Sip]sip-identity-05:display-name woes) Thread-Index: AcVGzs6iTU1fsR1dRbWn/z4p9ncNfAAAe7vg From: "Peterson, Jon" To: "Michael Thomas" X-OriginalArrivalTime: 22 Apr 2005 22:26:00.0904 (UTC) FILETIME=[433CBC80:01C5478A] X-Spam-Score: 0.0 (/) X-Scan-Signature: d437399464e10b52abe9a34ed7e712d0 Content-Transfer-Encoding: quoted-printable Cc: sip@ietf.org, Francois Audet , Paul Kyzivat X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org Well, I think we are actually homing in on a bit of common ground. More below. =20 > > - You don't believe that existing CAs which issue=20 > certificates for web sites (i.e., for domain names) have=20 > enrollment policies that restrict the issuance of=20 > certificates to the owners of the domain names in question;=20 > instead, you believe these CAs issue you a certificate "for=20 > whatever reason they wanted to", >=20 > No. The CA vendors merely issue the cert to a properly authorized > entity for a given *name* which they are authorized to assert. Of course. But here I think we're splitting hairs a bit. You say "a = properly authorized entity for a given name", I say, "owners of the = domain names in question". I'm not sure there's a material distinction, = or least, for the purposes of my argument I wouldn't distinguish between = the two. I think the entity meeting either of those descriptions would = have authority over how the DNS is populated for the name in question, = and that's all that matters to me. > This says nothing about the *role* that cert plays within the > organization. It is Out Of Scope from the CA vendor's standpoint. True. Unless it's some kind of attribute cert, or something, neither the = cert itself, nor the circumstances under which it is issued, should have = any bearing on how it is used by the organization. > If you want to bind authz/role information to an identity which > is provable via a cert, that is up to the users/protocols not > the CA vendors.=20 Of course. A cert just authenticates the entity to whom it is issued. = The way the cert is used, the information the cert is used to sign, is = what gives its usage semantics in the context of any interaction, = including SIP. Using a particular cert to sign a particular piece of = information is said, for SIP, to have a particular semantic that can be = verified by recipients of messages. Nothing about that "role" is = inherent in the cert. It just so happens that the cert authenticates an = entity that is the proper entity to provide a certain judgment for the = purpose of the SIP identity mechanism. > What I specifically have a lot of problem with is saying as > you do that there is something inherently significant about > a cert that doesn't have a xxx@ in the subjectAltName. That > is an invention/expectation of sip-identity. And since it is > not, we need to be careful about overloading those semantics > for SIP onto a more general purpose name binding system.=20 I've tried to clean up this language a bit for -05, and hopefully it = will be an improvement. In the first place, I now talk about domains = appearing in the CN field of the subject of the cert as well as the = subjectAltName. Our aim here is to correspond exactly with the = conventions for identifying web servers in the existing e-commerce = field, so, using the CN field of the subject is actually more accurate = (though I understand subjectAltName is used as well when multiple hosts = are subjects of the same certificate, as is the case in some web hosting = architectures). Of course, that really doesn't so much answer the implied questions = above. I do not want to invent anything about the certificate business = for sip-identity, nor change existing practices, if I can help it, for = issuing certificates. I agree that the implication that the = subjectAltName is special, and that if there's a domain name in it, that = domain name is reserved for SIP, or something, would be totally = inappropriate and self-defeating. We're not trying to do anything like = that, here. Hopefully, as the new text it written, we won't be. > > - You don't believe that a signature generated with the=20 > private key corresponding to a certificate serves to=20 > authenticate the entity to which the certificate was issued=20 > ("Sorry this is just fundamentally wrong", you say), >=20 > No, that's not what you said:=20 >=20 > > > Consequently, when a certificate is used to secure=20 > > communications, it signifies to you (the recipient) that you=20 > > are receiving this information from the administrator of the=20 > ^^^^^^^^^^^^^^^^^ > > namespace=20 >=20 > That is, you are saying that it implies role and/or authorization. > It does not.=20 Well, if there's a distinction here, it is very fine. A certificate = authenticates some entity. That entity is the one to whom the = certificate was issued. In the case of a certificate whose subject is a = domain name, that entity is, you said above, the "properly authorized = entity for a given name". You may mean something different by that than = "administrator of the namespace", but that's a very fine distinction. = Does "administrator of the namespace" imply some role or authorization = that "properly auhthorized entity for a given name" doesn't imply? Can = you flush this out a bit? > People *conflate* this all the time, but that is > because there is exactly one service that uses certs right now: > the web. But that conflation all falls apart when you need to > delegate that name to some entities for service X and other > entities for service Y.=20 I think I heard Mr. Kyzviat say this was specifically a non-requirement, = something we should require the system to avoid, but... > Otherwise your SIP proxy will be authorized to trade my Prized = Roosters again. I know that you cringe when I tranpose talk of delegation to name = subordination, but I really think it is unavoidable. When Amazon runs a web service, they don't run it on 'amazon.com', they = run it on 'www.amazon.com'. When you acquire a TLS certificate from = Amazon, you don't get a cert from 'amazon.com', you get one from = 'www.amazon.com'. The one service that uses certs right now uses them in = this fashion. So Amazon, it would appear, didn't fall into any trap = about this. They needed to delegate to a service, and they decided to do = so using the DNS. Of course 'www.amazon.com' could run a mail server, or = PRTS, but that wouldn't be 'amazon.com' running those services, it would = be 'www.amazon.com'. Amazon can create a mail.example.com with very = different users than www.amazon.com, and one that uses a different = certificate. Now, this is not to say that every service needs its own host, or more = importantly, it's own domain name - that is a just a human convention = that evolved for the web. However, these human conventions have security = implications, because it is that domain, 'www.amazon.com', that a user = types into their browser, and which they expect to reach. If they get = back some other domain in a certificate, that should be a problem. Email is, of course, very different. We use identifiers of the form = @example.com, rather than @mail.example.com, when we send people mail = (usually - there are still some holdouts). But we all know that behind = the scenes, there are subordinate hosts that run these mail functions, = and that they have their own domain names (NeuStar has a bunch, all = named after trees). From an interface perspective, it is desirable to = hide the existence of these hosts from users. Thus the MX record was = born. Without the MX record, we would not be hiding the existence of all = the mail.example.com's. Once again, it is what the entity that controls = the DNS for 'example.com' populates in their node in the hierarchy that = makes email work this way. SIP has chosen a path similar to email. There are procedures in RFC3263 = that define ways to hide these proxy servers from end users so that they = only have to remember @example.com, not @sip.example.com. You can even = use RFC3263 to send tell users that for SIP services in 'example.com', = you need to contact a SIP server over at 'example.org'. The big security = problem with these sorts of practices is that the orginator of a = connection to 'example.org' need to have some assurance they are = connecting to the right guy, especially in the face of the insecurity of = the DNS. So I do think that name delegation and subordination is the key issue = here. But I'm not sure I agree with, or perhaps even understand, the = conflation you're describing above. It seems me that the way the web = uses certs doesn't rule out other services in the same domain using = certs at all. > > - You assert that sip-identity is not useful unless it has=20 > a mechanism that will prevent any need for namespace=20 > "shunting"; that is, being forced to take users with AoRs of=20 > form 'sip:jon@example.com' and move them to the namespace=20 > 'sip:jon@sip.example.com', in order to accommodate the=20 > architecture of sip-identity ("the rest of your argument=20 > falls apart if that requirement is accepted", you say,=20 > apparently neglecting that the "argument" of the paragraphs=20 > after the one you are commenting on accept and discuss the=20 > solution for this requirement). > >=20 > > To which I will reply, in order: > >=20 > > - I believe that existing CAs which offer certs to web=20 > sites have an enrollment process which verifies ownership of=20 > the requested domain name. If you disagree, please go to=20 > Verisign, GoDaddy or GeoTrust and procure a certificate for=20 > 'www.amazon.com' and post it to this list. I'll pay you back=20 > for the certificate later. >=20 > That's not what is at issue. It's whether there's any implied > connection of www.amazon.com to the https service. There isn't. > You can use a www.amazon.com cert for the Prized Rooster Trading > Protocol just as well. Well, sure. I might drop that in Amazon's suggestion box, actually. But I do understand that nothing about having a cert for a domain name = links that cert to any particular service, sure. It is how the cert is = used that provides that linkage. The holder of the cert, after all, gets = to choose when and how to use it. Using it to sign particular pieces of = information is an act that can have meaning to a protocol. As in HTTP, = so in SIP. > > - I believe that when I form a TLS connection to=20 > www.amazon.com, I download a certificate which allows me to=20 > verify that integrity-protected content sent over the TLS=20 > connection actually comes from the organization authoritative=20 > for the name 'www.amazon.com'. I believe that if we don't=20 > understand certificates this way, e-commerce security is nonsensical. >=20 > Suffice it to say that there is much less to web server based > authentication than meets the eye. The little lock icon is, > uh, not a complete fiction, but it's not really as much as > a safety net as people might think. Let's not go here though. I think we have to go there a little bit, at least so far to say that = thwarting the kinds of trivial From-header forgeries we're targetting = with SIP identity is a function that I am very comfortable having about = as much security as e-commerce security does. Cert enrollment ain't = perfect, client handling of certs and so on ain't perfect, but for our = purposes, it looks like a fine level of security to me. > > - In my previous mail, and in the draft, I acknowledged=20 > that this is a limitation of sip-identity, though I don't=20 > share your apocalyptic feelings about it. I agree it is a=20 > requirement, and it is, as I said, a subject for future work [].=20 >=20 > I'm sorry, but how can something be a requirement and a subject > for future work at the same time? Doesn't the Pauli exclusion > principle apply? It is a requirement for the identity system to instantiate the quality = in question - for it to be possible for users to have identities of the = form 'sip:jon@example.com' even if their identity services are provided = by a different host, i.e., for us not to require shunting. For some = deployments, it is possible to do this with sip-identity as written. I = agree that it does not work for Jon if some other domain, like = 'example.org' or 'prizeroosters.trading.example.com', uses their = certificate to sign the Identity header. Cullen and I had a good talk about this requirement today, and a number = of important points emerged (from him). Let's flip this around for a moment. If I am sending a request to = 'sip:jon@example.com' over TLS, regardless of where the RFC3263 = procedures tell me go (including discovering SRV records for = 'example.org' or 'prizerooster.trading.example.com'), I expect the = entity on the other end of the TLS connection to provide me with a = certificate for 'example.com'. Why is that? Once again, we're following = the model of HTTP in order to overcome the inherent insecurity of the = DNS. It is the string in the user interface, the URI the human that is = attempting to contact, that needs to have reference integrity with the = certificate provided by TLS, regardless of what any intermediate = (insecure) system like the DNS tells you. One could argue that because this doesn't allow for certain kinds of = hosting cases, it is broken. But it is the security architecture on = record for SIP. So that's the way inbound requests to a domain work. What does this have = to do with have requests outbound from 'sip:jon@example.com' work? = Everything. sip-identity makes a number of strong assumptions about the = relationship between registration (how you express that you are eligible = to receive a request for a given AoR) and identity. In fact, it suggests = that if you are eligible to register under an AoR, you are eligible to = claim that AoR as an identity - that the credentials that allow you to = prove the first should also be presented to prove the second. This = assumption is based on the usage of the From header field to provide a = 'return address', an AoR for the request's originator. Consequently, I = really feel strongly that the entity that has authority over validating = >From header fields for identity is in fact the same entity that manages = the location service. If there were separate entities for these = functions who, say, disagreed about whether or not I was = 'sip:jon@example.com', that would be extremely problematic. And, of = course, the entity that manages the location service is the guy who = provides the credential for 'example.com' when you send an inbound = request.=20 [As an aside, note that the above does not entail that every URI that = can appear in a From header field is an AoR, or even routable. Anonymous = URIs (sip:anonymous@example.com) would be an example of a URI that isn't = necessarily an AoR. But But that certainly doesn't argue that the system = should work for normal 'AoR' URIs] I think there are a few strong conclusions that fall out of this. I = think it would be unwise to revisit a decision about what certificate = should be used by an authentication service if we do not revisit the = certificates expected for inbound requests going to a domain. If we = changed this unilaterally for sip-identity, the sorts of architectures = that would be enabled by letting the cert 'sip.example.com' sign for = users of the form 'sip:jon@example.com' would not work for inbound calls = (the host 'sip.example.com' would still need to have the 'example.com' = cert for that). Is it possible to revisit how inbound call routing works? Sure. But = we're not going to do it in passing in sip-identity. It is also = conceivable that there is some really clever solution to all of this = that we don't know today. Whichever it is, it is future work. > And fwiw, I don't feel apocalyptic about it, I just don't > want you to have the accidental authority to trade my=20 > prized roosters in the mean time. Understandable. > > Incidentally, I have been aware of the various MASS drafts=20 > for some time, and I continue to believe that there are far=20 > more similarities than differences between sip-identity and=20 > the MASS efforts. However, SIP and email are slightly=20 > different problem spaces for identity , and I don't think=20 > that there is a lot to be gained from importing from IIM or=20 > DK into sip-identity. I did make the check, at one point,=20 > though, to see if there was anything we could glean there.=20 > One major distinction is that SIP has not yet enjoyed the=20 > universal deployment of email, and accordingly, we have a bit=20 > of wiggle-room still in making surgical changes to the=20 > protocol and deployment environment. >=20 > I've been trying very hard to stay on the fence about that > subject. But I do have to ask: do you think there are things > that dk/iim can't do for sip that sip-identity can? I've been > struggling to come up with any differences in the problem > spaces they are attempting to address. This isn't a rhetorical > question.=20 No, it is an important question. My answer to it is this: http://www.ietf.org/internet-drafts/draft-peterson-message-identity-00.tx= t For those that would prefer the short answer (well, at least shorter = than that draft), this is a design space with a number of trade-offs. = Some of those trade-offs weigh differently for a real-time messaging = system like SIP than they do for a non-real-time system like email. They = weigh differently if you can expect, as you can with SIP, that = intermediaries are required to support certificates. They weigh = differently if you can have different expectations about what = intermediaries are allowed to change in a message. They weigh = differently if you don't need to worry about distinctions like Sender v. = From. They weigh differently if you have a different architecture for = exploders. They weigh differently if you can agree on a fixed set of = pieces of a message that need to be protected by the signed hash, as = opposed to selecting a set on a per-message on per-implementation basis. In the lingo of message-identity, I would describe IIM as a identity = mechanism that uses uncertified assymetric user-based keys, variable = replicated reference indicators (including content), intermediary = identity providers and verifiers (including verification assertions), = user-based assertions placed in the envelope, and which distributes keys = by-value (with a network lookup to authorize those uncertified keys). = This is, ironically enough, very similar to sip-identity-00, which = allowed uncertified user-based keys which are shared by-value and used = variable replicated reference indicators (though admittedly, it also put = assertions in the body, not the envelope). sip-identity-04, by way of = contrast, distributes keys only by-reference, uses only certified keys, = has static reference indicators, and employs only domain-based keys. = Since it hasn't really been relevant to this thread, I'll skip the bit = about reference indicators. The use of certified vs. uncertified keys has, really, been the = substance of our thread up until now. You've been questioning whether = the certified keys described in sip-identity-04 really do the job that = we think they do. Section 6 of peterson-message-identity (in particular = 6.1.1 and 6.1.2) represents my thinking about the overall trade-off. I = think it is a lot easier to assume certificates for auth services when = you envision those auth services MUST support TLS and will have = certificates anyway. If you are interested in user-based keying, = clearly, getting certified keys is laughable; sip-identity is only = concerned with domain-based keying, where certification is reasonable. As for user-based keys, clearly there are some security problems that = cannot be solved with domain-based keys. However, I feel that the = particular threat of impersonation is not one of those. Clearly, = sip-identity doesn't help you at all with, say, confidentiality - it = just helps with impersonation. We've evolved a related mechanism in SIP = (sipping-certs) that is all about user-based keying and specifically = targets confidentiality, and so on. We just felt that sip-identity and = sipping-certs had different applicability, and that you might want to = prevent impersonation even if you didn't care about confidentiality, and = so on. The cert stores in sipping-certs have a lot in common with a KRS. As I understand it, the difference between the key distribution systems = of IIM and sip-identity is as follows: sip-identity provides an HTTP URL = to a place where a copy of the certified key can be found, and IIM = provides uncertified keys by-value, but allows a network lookup to = authorize the key which, ultimately, relies on the DNS. Clearly, = dereferencing an HTTP URL involves a DNS lookup, so it isn't that = sip-identity doesn't rely on the DNS. However, it doesn't -trust- the = DNS, because the key acquired via HTTP is a certified key, not an = uncertified key. The exact level of trust one is willing to have in the = DNS is, of course, proportional to the threats against the DNS, and must = be weighed against the likely powers and perseverance of impersonators. So in summary, I think these are all points on which intelligent people = can disagree, and that comparatively subtle differences between SIP and = email can lead you in very different design directions. While you might = not be comfortable with our use of certificates, I note that the MASS = security review asked some pointed questions about why IIM doesn't use = certificates, and about reliance on the DNS. Jon Peterson NeuStar, Inc. > Mike >=20 _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Fri Apr 22 18:32:50 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DP6he-0004nT-FE; Fri, 22 Apr 2005 18:32:50 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DP6hc-0004nO-Q4 for sip@megatron.ietf.org; Fri, 22 Apr 2005 18:32:48 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA10426 for ; Fri, 22 Apr 2005 18:32:46 -0400 (EDT) Received: from rtp-iport-1.cisco.com ([64.102.122.148]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DP6tL-0002Xd-7N for sip@ietf.org; Fri, 22 Apr 2005 18:44:55 -0400 Received: from rtp-core-1.cisco.com (64.102.124.12) by rtp-iport-1.cisco.com with ESMTP; 22 Apr 2005 18:44:07 -0400 X-IronPort-AV: i="3.92,125,1112587200"; d="scan'208"; a="45793432:sNHT29784468" Received: from xbh-rtp-201.amer.cisco.com (xbh-rtp-201.cisco.com [64.102.31.12]) by rtp-core-1.cisco.com (8.12.10/8.12.6) with ESMTP id j3MMWaRQ005972; Fri, 22 Apr 2005 18:32:36 -0400 (EDT) Received: from xfe-rtp-212.amer.cisco.com ([64.102.31.100]) by xbh-rtp-201.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Fri, 22 Apr 2005 18:32:36 -0400 Received: from cisco.com ([161.44.79.173]) by xfe-rtp-212.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Fri, 22 Apr 2005 18:32:35 -0400 Message-ID: <42697B83.8070600@cisco.com> Date: Fri, 22 Apr 2005 18:32:35 -0400 From: Paul Kyzivat User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.1) Gecko/20020826 X-Accept-Language: en-us, en MIME-Version: 1.0 To: Cullen Jennings Subject: Re: authority for a domain (was RE: [Sip] sip-identity-05:display-name woes) References: Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-OriginalArrivalTime: 22 Apr 2005 22:32:35.0511 (UTC) FILETIME=[2E70FC70:01C5478B] X-Spam-Score: 0.0 (/) X-Scan-Signature: 25620135586de10c627e3628c432b04a Content-Transfer-Encoding: 7bit Cc: "sip@ietf.org" , Francois Audet , Michael Thomas , Jon Peterson X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org Cullen Jennings wrote: > The best practices around handling namespaces are pretty ugly. For example, > if you left your current employer, people sending you email might suddenly > find that their personal email to you was being delivered to HR. I don't have a huge problem with that. (I shouldn't have been getting my personal mail at my business address.) "pkyzivat@cisco.com" is me the cisco lacky. "pkyzivat@alum.mit.edu" is me the human with a private life. (Well, it would be if I *had* a private life.) > We have a > change in the person receiving the message over the same protocol for the > same name - this is nasty but more or less a requirement of enterprise > email. Trying to enforce how domains manage the names is pretty hard. *Enforce* is probably to much to expect. But that doesn't mean there can't be best practices. Both the sip and mailto can be attached to the "same" destination, whether that is an employee or the HR department. Paul > On 4/21/05 6:02 AM, "Paul Kyzivat" wrote: > > >>Mike & Jon, >> >>I don't know much about the mechanics of this, but I'm learning a lot >>and having fun watching the two of you go at it. If the two of you don't >>kill each other then I think we may get a good outcome. I want to >>comment on one point from a requirements point of view: >> >>Michael Thomas wrote: >> >> >>>The point here is that you're forcing a particular shape of the >>>namespace to accommodate the ability to delegate authorization. What >>>disturbs me is that you're not doing this by shunting the authorization >>>information into a backwater of the namespace (which is what both >>>IIM and DK do), but instead forcing the real life *users* of the >>>namespace to be shunted over there too. That is, I'd have to be known >>>as mat@sip.example.com and mat@prtp.example.com, and so forth. That >>>strikes me as really, really ugly and mostly likely administratively >>>infeasible for large existing domains. Preserving a single name for >>>end identities across different services seems like it should be a >>>*requirement* to me. As in, a first principle. >> >>I think this is really important. Its not sufficient that the email >>service at example.com may have a user mat@example.com and the sip >>service may have a user mat@example.com. Its important that those two be >>assigned to the same "entity". >> >>I don't want to get into a situation where, after having talked with >> >>"Miles Anderson Thomas" >> >>I send email to mat@example.com only to discover that it goes to >> >>"Mary Alice Taylor" >> >>Paul >> >>_______________________________________________ >>Sip mailing list https://www1.ietf.org/mailman/listinfo/sip >>This list is for NEW development of the core SIP Protocol >>Use sip-implementors@cs.columbia.edu for questions on current sip >>Use sipping@ietf.org for new developments on the application of sip > > > _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Fri Apr 22 18:51:57 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DP709-0000DD-AW; Fri, 22 Apr 2005 18:51:57 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DP707-0000D8-9a for sip@megatron.ietf.org; Fri, 22 Apr 2005 18:51:55 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA11626 for ; Fri, 22 Apr 2005 18:51:52 -0400 (EDT) Received: from sj-iport-4.cisco.com ([171.68.10.86]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DP7Bo-0002zp-T2 for sip@ietf.org; Fri, 22 Apr 2005 19:04:02 -0400 Received: from sj-core-3.cisco.com (171.68.223.137) by sj-iport-4.cisco.com with ESMTP; 22 Apr 2005 15:51:45 -0700 Received: from vtg-um-e2k4.sj21ad.cisco.com (vtg-um-e2k4.cisco.com [171.70.93.57]) by sj-core-3.cisco.com (8.12.10/8.12.6) with ESMTP id j3MMpgb4014527; Fri, 22 Apr 2005 15:51:42 -0700 (PDT) Received: from [127.0.0.1] ([171.68.225.134]) by vtg-um-e2k4.sj21ad.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Fri, 22 Apr 2005 15:52:41 -0700 User-Agent: Microsoft-Entourage/11.1.0.040913 Date: Fri, 22 Apr 2005 15:51:42 -0700 From: Cullen Jennings To: Jonathan Rosenberg , "sip@ietf.org" Message-ID: In-Reply-To: <422B5A6C.8060505@cisco.com> Mime-version: 1.0 Content-type: text/plain; charset="US-ASCII" Content-transfer-encoding: 7bit X-OriginalArrivalTime: 22 Apr 2005 22:52:41.0521 (UTC) FILETIME=[FD478210:01C5478D] X-Spam-Score: 1.1 (+) X-Scan-Signature: 7baded97d9887f7a0c7e8a33c2e3ea1b Content-Transfer-Encoding: 7bit Cc: Jon Peterson Subject: [Sip] UA and Display Names X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org I'm somewhat dubious on the harm that is stopped by including the Display Name in the hash. It leads to a false sense of security that it is somehow OK. I guess I don't really know what I think on this yet but let me propose one thing. Imagine that a UA was implemented along the following lines. When it got and incoming call, it looked for the URI in the address book and if it found one, displayed the Nick Name that user had for this caller in their address book. If nothing was found in the address book, it just displayed the URI. If the user when to add an entry to the phone booked based on the current caller, the Display Name information could be used to pre populate the fields for the Nick Name. If the device had access to some sort of trusted corporate directory it could also use that as part of the address book. It might be good to try and figure out what are the cases where including the Display Name in the hash helps. On 3/6/05 1:30 PM, "Jonathan Rosenberg" wrote: > * display name handling > > I'm concerned that the treatment of the From display name. The current > spec allows an authentication service to verify it (at MAY strength), > and it can reject it if it doesnt like it. But, there is no signature > that covers it, and no way for a verifier to know if the authentication > service allowed it to pass. > > I'm worried that, although we believe that the URI is the important form > of identity to worry about, real people will be more concerned with the > display name. The mechanism may, as a result, be extremely misleading, > because users are still free to completely spoof the display name. > > I'd like to consider adding the display name to the signature, under the > constraints that, if done, it require the domain to tell the client the > display names it can insert, so as to avoid all of these equivalence > nightmares for internationalized names. _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Fri Apr 22 19:01:29 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DP79N-0002Jn-ND; Fri, 22 Apr 2005 19:01:29 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DP79M-0002Hl-55 for sip@megatron.ietf.org; Fri, 22 Apr 2005 19:01:28 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA12481 for ; Fri, 22 Apr 2005 19:01:25 -0400 (EDT) Received: from sj-iport-4.cisco.com ([171.68.10.86]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DP7L3-0003Go-OC for sip@ietf.org; Fri, 22 Apr 2005 19:13:35 -0400 Received: from sj-core-4.cisco.com (171.68.223.138) by sj-iport-4.cisco.com with ESMTP; 22 Apr 2005 16:01:18 -0700 Received: from vtg-um-e2k4.sj21ad.cisco.com (vtg-um-e2k4.cisco.com [171.70.93.57]) by sj-core-4.cisco.com (8.12.10/8.12.6) with ESMTP id j3MN1FpR015459; Fri, 22 Apr 2005 16:01:15 -0700 (PDT) Received: from [127.0.0.1] ([171.68.225.134]) by vtg-um-e2k4.sj21ad.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Fri, 22 Apr 2005 16:02:13 -0700 User-Agent: Microsoft-Entourage/11.1.0.040913 Date: Fri, 22 Apr 2005 16:01:14 -0700 Subject: Re: authority for a domain (was RE:[Sip]sip-identity-05:display-name woes) From: Cullen Jennings To: Jon Peterson , Michael Thomas Message-ID: In-Reply-To: <24EAE5D4448B9D4592C6D234CBEBD59701502E5A@stntexch03.cis.neustar.com> Mime-version: 1.0 Content-type: text/plain; charset="US-ASCII" Content-transfer-encoding: 7bit X-OriginalArrivalTime: 22 Apr 2005 23:02:13.0791 (UTC) FILETIME=[5260FAF0:01C5478F] X-Spam-Score: 1.9 (+) X-Scan-Signature: 79899194edc4f33a41f49410777972f8 Content-Transfer-Encoding: 7bit Cc: "sip@ietf.org" , Francois Audet , Paul H Kyzivat X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org On 4/22/05 3:26 PM, "Peterson, Jon" wrote: > I've tried to clean up this language a bit for -05, and hopefully it will be > an improvement. In the first place, I now talk about domains appearing in the > CN field of the subject of the cert as well as the subjectAltName. Our aim > here is to correspond exactly with the conventions for identifying web servers > in the existing e-commerce field, so, using the CN field of the subject is > actually more accurate (though I understand subjectAltName is used as well > when multiple hosts are subjects of the same certificate, as is the case in > some web hosting architectures). Not sure I agree here. SN was horribly underspecified and caused all sort of complicated problems. SubjectAlntName (SAN) corrects these and we don't have a backwards compatibility problem here. 3261 is very clear that the certs used for SIP have to have a SAN - this allows SIP to avoid a ton of problems is is not really a big deal for implementers or CA. I think we should continue using the same sort of certificates for SIP identity that we use for 3261. _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Fri Apr 22 19:03:16 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DP7B6-0002gd-AM; Fri, 22 Apr 2005 19:03:16 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DP7B3-0002gH-Pz for sip@megatron.ietf.org; Fri, 22 Apr 2005 19:03:13 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA12800 for ; Fri, 22 Apr 2005 19:03:10 -0400 (EDT) Received: from sj-iport-4.cisco.com ([171.68.10.86]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DP7Mm-0003LJ-Bn for sip@ietf.org; Fri, 22 Apr 2005 19:15:20 -0400 Received: from sj-core-3.cisco.com (171.68.223.137) by sj-iport-4.cisco.com with ESMTP; 22 Apr 2005 16:03:05 -0700 Received: from vtg-um-e2k4.sj21ad.cisco.com (vtg-um-e2k4.cisco.com [171.70.93.57]) by sj-core-3.cisco.com (8.12.10/8.12.6) with ESMTP id j3MN31b4018712; Fri, 22 Apr 2005 16:03:01 -0700 (PDT) Received: from [127.0.0.1] ([171.68.225.134]) by vtg-um-e2k4.sj21ad.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Fri, 22 Apr 2005 16:04:00 -0700 User-Agent: Microsoft-Entourage/11.1.0.040913 Date: Fri, 22 Apr 2005 16:03:01 -0700 Subject: Re: authority for a domain (was RE: [Sip] sip-identity-05:display-name woes) From: Cullen Jennings To: Paul H Kyzivat Message-ID: In-Reply-To: <42697B83.8070600@cisco.com> Mime-version: 1.0 Content-type: text/plain; charset="US-ASCII" Content-transfer-encoding: 7bit X-OriginalArrivalTime: 22 Apr 2005 23:04:00.0729 (UTC) FILETIME=[921E6C90:01C5478F] X-Spam-Score: 1.1 (+) X-Scan-Signature: 31247fb3be228bb596db9127becad0bc Content-Transfer-Encoding: 7bit Cc: "sip@ietf.org" , Francois Audet , Michael Thomas , Jon Peterson X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org Fair enough, I understand that enterprises using different address for the same person for email, voip, and IM would be pretty weird and confusing but I don't think it is really an issue we have to tackle. On 4/22/05 3:32 PM, "Paul Kyzivat" wrote: > > > Cullen Jennings wrote: >> The best practices around handling namespaces are pretty ugly. For example, >> if you left your current employer, people sending you email might suddenly >> find that their personal email to you was being delivered to HR. > > I don't have a huge problem with that. (I shouldn't have been getting my > personal mail at my business address.) > > "pkyzivat@cisco.com" is me the cisco lacky. > > "pkyzivat@alum.mit.edu" is me the human with a private life. (Well, it > would be if I *had* a private life.) > >> We have a >> change in the person receiving the message over the same protocol for the >> same name - this is nasty but more or less a requirement of enterprise >> email. Trying to enforce how domains manage the names is pretty hard. > > *Enforce* is probably to much to expect. But that doesn't mean there > can't be best practices. Both the sip and mailto can be attached to the > "same" destination, whether that is an employee or the HR department. > > Paul > >> On 4/21/05 6:02 AM, "Paul Kyzivat" wrote: >> >> >>> Mike & Jon, >>> >>> I don't know much about the mechanics of this, but I'm learning a lot >>> and having fun watching the two of you go at it. If the two of you don't >>> kill each other then I think we may get a good outcome. I want to >>> comment on one point from a requirements point of view: >>> >>> Michael Thomas wrote: >>> >>> >>>> The point here is that you're forcing a particular shape of the >>>> namespace to accommodate the ability to delegate authorization. What >>>> disturbs me is that you're not doing this by shunting the authorization >>>> information into a backwater of the namespace (which is what both >>>> IIM and DK do), but instead forcing the real life *users* of the >>>> namespace to be shunted over there too. That is, I'd have to be known >>>> as mat@sip.example.com and mat@prtp.example.com, and so forth. That >>>> strikes me as really, really ugly and mostly likely administratively >>>> infeasible for large existing domains. Preserving a single name for >>>> end identities across different services seems like it should be a >>>> *requirement* to me. As in, a first principle. >>> >>> I think this is really important. Its not sufficient that the email >>> service at example.com may have a user mat@example.com and the sip >>> service may have a user mat@example.com. Its important that those two be >>> assigned to the same "entity". >>> >>> I don't want to get into a situation where, after having talked with >>> >>> "Miles Anderson Thomas" >>> >>> I send email to mat@example.com only to discover that it goes to >>> >>> "Mary Alice Taylor" >>> >>> Paul >>> >>> _______________________________________________ >>> Sip mailing list https://www1.ietf.org/mailman/listinfo/sip >>> This list is for NEW development of the core SIP Protocol >>> Use sip-implementors@cs.columbia.edu for questions on current sip >>> Use sipping@ietf.org for new developments on the application of sip >> >> >> _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Fri Apr 22 19:05:01 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DP7Cn-0002yR-Ms; Fri, 22 Apr 2005 19:05:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DP7Cl-0002wG-Dj for sip@megatron.ietf.org; Fri, 22 Apr 2005 19:04:59 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA12983 for ; Fri, 22 Apr 2005 19:04:56 -0400 (EDT) Received: from rtp-iport-1.cisco.com ([64.102.122.148]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DP7OS-0003PU-MF for sip@ietf.org; Fri, 22 Apr 2005 19:17:05 -0400 Received: from rtp-core-1.cisco.com (64.102.124.12) by rtp-iport-1.cisco.com with ESMTP; 22 Apr 2005 19:16:17 -0400 X-IronPort-AV: i="3.92,125,1112587200"; d="scan'208"; a="45796013:sNHT28946666" Received: from xbh-rtp-201.amer.cisco.com (xbh-rtp-201.cisco.com [64.102.31.12]) by rtp-core-1.cisco.com (8.12.10/8.12.6) with ESMTP id j3MN4jRQ010729; Fri, 22 Apr 2005 19:04:46 -0400 (EDT) Received: from xfe-rtp-212.amer.cisco.com ([64.102.31.100]) by xbh-rtp-201.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Fri, 22 Apr 2005 19:04:45 -0400 Received: from cisco.com ([161.44.79.173]) by xfe-rtp-212.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Fri, 22 Apr 2005 19:04:44 -0400 Message-ID: <4269830C.4060207@cisco.com> Date: Fri, 22 Apr 2005 19:04:44 -0400 From: Paul Kyzivat User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.1) Gecko/20020826 X-Accept-Language: en-us, en MIME-Version: 1.0 To: "Peterson, Jon" Subject: Re: authority for a domain (was RE:[Sip]sip-identity-05:display-name woes) References: <24EAE5D4448B9D4592C6D234CBEBD59701502E5A@stntexch03.cis.neustar.com> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-OriginalArrivalTime: 22 Apr 2005 23:04:44.0677 (UTC) FILETIME=[AC505B50:01C5478F] X-Spam-Score: 0.0 (/) X-Scan-Signature: 0bc60ec82efc80c84b8d02f4b0e4de22 Content-Transfer-Encoding: 7bit Cc: sip@ietf.org, Francois Audet , Michael Thomas X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org Peterson, Jon wrote: > Well, I think we are actually homing in on a bit of common ground. > > More below. Great discussion! But I'm going to snip it all away to comment on one trivial point. >>People *conflate* this all the time, but that is >>because there is exactly one service that uses certs right now: >>the web. But that conflation all falls apart when you need to >>delegate that name to some entities for service X and other >>entities for service Y. > > I think I heard Mr. Kyzviat say this was specifically a > non-requirement, something we should require the system > to avoid, but... If I understand all the nuances then that isn't quite what I meant to say. You may indeed need to delegate that name to some entities for service X and others for service Y: namely pkyzivat@cisco.com may be delegated to both the cisco mail server and the cisco sip proxy. Whats important is that they were both delegated for purposes of use by the single entity me. Paul _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Fri Apr 22 19:12:18 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DP7Jq-0004Q4-Dj; Fri, 22 Apr 2005 19:12:18 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DP7Jn-0004Pu-J5 for sip@megatron.ietf.org; Fri, 22 Apr 2005 19:12:15 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA13823 for ; Fri, 22 Apr 2005 19:12:12 -0400 (EDT) Received: from rtp-iport-1.cisco.com ([64.102.122.148]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DP7VW-0003gr-BA for sip@ietf.org; Fri, 22 Apr 2005 19:24:22 -0400 Received: from rtp-core-2.cisco.com (64.102.124.13) by rtp-iport-1.cisco.com with ESMTP; 22 Apr 2005 19:23:35 -0400 X-IronPort-AV: i="3.92,125,1112587200"; d="scan'208"; a="45796563:sNHT29451292" Received: from xbh-rtp-201.amer.cisco.com (xbh-rtp-201.cisco.com [64.102.31.12]) by rtp-core-2.cisco.com (8.12.10/8.12.6) with ESMTP id j3MNBwdv003545; Fri, 22 Apr 2005 19:12:04 -0400 (EDT) Received: from xfe-rtp-211.amer.cisco.com ([64.102.31.113]) by xbh-rtp-201.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Fri, 22 Apr 2005 19:11:18 -0400 Received: from cisco.com ([161.44.79.173]) by xfe-rtp-211.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Fri, 22 Apr 2005 19:11:18 -0400 Message-ID: <42698496.20307@cisco.com> Date: Fri, 22 Apr 2005 19:11:18 -0400 From: Paul Kyzivat User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.1) Gecko/20020826 X-Accept-Language: en-us, en MIME-Version: 1.0 To: Cullen Jennings Subject: Re: [Sip] UA and Display Names References: Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-OriginalArrivalTime: 22 Apr 2005 23:11:18.0236 (UTC) FILETIME=[96E4B1C0:01C54790] X-Spam-Score: 0.0 (/) X-Scan-Signature: b4a0a5f5992e2a4954405484e7717d8c Content-Transfer-Encoding: 7bit Cc: "sip@ietf.org" , Jon Peterson X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org Cullen, What you describe sounds like a good policy. If I believed that would be followed most of the time then I would agree that signing the display name is unimportant and maybe undesirable. But I am inclined to think that won't be the case - that (just like many mail readers) the display name will be the main or only displayed identity of the caller most of the time, and that the actual url will be something that only geeks know how to get. In that environment I would prefer the display name to be signed. But perhaps the kind of approach you suggest has a chance to become ubiquitous. Convince me. Paul Cullen Jennings wrote: > I'm somewhat dubious on the harm that is stopped by including the Display > Name in the hash. It leads to a false sense of security that it is somehow > OK. I guess I don't really know what I think on this yet but let me propose > one thing. > > Imagine that a UA was implemented along the following lines. When it got and > incoming call, it looked for the URI in the address book and if it found > one, displayed the Nick Name that user had for this caller in their address > book. If nothing was found in the address book, it just displayed the URI. > If the user when to add an entry to the phone booked based on the current > caller, the Display Name information could be used to pre populate the > fields for the Nick Name. If the device had access to some sort of trusted > corporate directory it could also use that as part of the address book. > > It might be good to try and figure out what are the cases where including > the Display Name in the hash helps. > > > > On 3/6/05 1:30 PM, "Jonathan Rosenberg" wrote: > > >>* display name handling >> >>I'm concerned that the treatment of the From display name. The current >>spec allows an authentication service to verify it (at MAY strength), >>and it can reject it if it doesnt like it. But, there is no signature >>that covers it, and no way for a verifier to know if the authentication >>service allowed it to pass. >> >>I'm worried that, although we believe that the URI is the important form >>of identity to worry about, real people will be more concerned with the >>display name. The mechanism may, as a result, be extremely misleading, >>because users are still free to completely spoof the display name. >> >>I'd like to consider adding the display name to the signature, under the >>constraints that, if done, it require the domain to tell the client the >>display names it can insert, so as to avoid all of these equivalence >>nightmares for internationalized names. > > > > _______________________________________________ > Sip mailing list https://www1.ietf.org/mailman/listinfo/sip > This list is for NEW development of the core SIP Protocol > Use sip-implementors@cs.columbia.edu for questions on current sip > Use sipping@ietf.org for new developments on the application of sip > _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Fri Apr 22 19:40:39 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DP7lH-0002Kk-OB; Fri, 22 Apr 2005 19:40:39 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DP7lF-0002Kf-Ab for sip@megatron.ietf.org; Fri, 22 Apr 2005 19:40:37 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA15181 for ; Fri, 22 Apr 2005 19:40:34 -0400 (EDT) Received: from ckmso1.att.com ([12.20.58.69] helo=ckmso1.proxy.att.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DP7wx-0004Jg-7h for sip@ietf.org; Fri, 22 Apr 2005 19:52:44 -0400 Received: from attrh5i.attrh.att.com ([135.38.62.12]) by ckmso1.proxy.att.com (AT&T IPNS/MSO-5.5) with ESMTP id j3MNeKSL005330 for ; Fri, 22 Apr 2005 19:40:23 -0400 Received: from OCCLUST04EVS1.ugd.att.com (135.38.164.13) by attrh5i.attrh.att.com (7.2.052) id 426289720019F3E8 for sip@ietf.org; Fri, 22 Apr 2005 19:40:22 -0400 X-MimeOLE: Produced By Microsoft Exchange V6.0.6603.0 content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Subject: RE: [Sip] sip-identity-05 Date: Fri, 22 Apr 2005 18:40:22 -0500 Message-ID: <28F05913385EAC43AF019413F674A0170A412E1F@OCCLUST04EVS1.ugd.att.com> Thread-Topic: [Sip] sip-identity-05 Thread-Index: AcVHSlZpUcQQ+yr2TMiLXamfQNNxOwASfSpg From: "Dolly, Martin C, ALABS" To: X-Spam-Score: 0.0 (/) X-Scan-Signature: 9182cfff02fae4f1b6e9349e01d62f32 Content-Transfer-Encoding: quoted-printable X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org Is this a vendor or service provider issue? Why are only vendors responding? -----Original Message----- From: sip-bounces@ietf.org [mailto:sip-bounces@ietf.org]On Behalf Of Derenale Corrado-ACD101 Sent: Friday, April 22, 2005 10:43 AM To: sip@ietf.org Subject: [Sip] sip-identity-05 Sorry for bothering you all, but where can I find the 5th version of the sip identity draft? On the WG site I only found the sip-identity-04. Thank you, \cdr _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Fri Apr 22 19:50:45 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DP7v3-0004Eg-L5; Fri, 22 Apr 2005 19:50:45 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DP7v1-0004EY-8E for sip@megatron.ietf.org; Fri, 22 Apr 2005 19:50:43 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA15862 for ; Fri, 22 Apr 2005 19:50:40 -0400 (EDT) Received: from oak.neustar.com ([209.173.53.70]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DP86k-0004aE-AS for sip@ietf.org; Fri, 22 Apr 2005 20:02:50 -0400 Received: from stntsmtp1.cis.neustar.com (smartexch.neustar.com [10.31.13.79]) by oak.neustar.com (8.12.8/8.11.0) with ESMTP id j3MNoXKD004642; Fri, 22 Apr 2005 23:50:33 GMT Received: from stntexch03.cis.neustar.com ([10.31.13.45]) by stntsmtp1.cis.neustar.com with Microsoft SMTPSVC(6.0.3790.211); Fri, 22 Apr 2005 19:50:33 -0400 X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Subject: RE: authority for a domain (was RE:[Sip]sip-identity-05:display-name woes) Date: Fri, 22 Apr 2005 19:50:32 -0400 Message-ID: <24EAE5D4448B9D4592C6D234CBEBD59701502E5E@stntexch03.cis.neustar.com> Thread-Topic: authority for a domain (was RE:[Sip]sip-identity-05:display-name woes) Thread-Index: AcVHjzH7OLj8Lu0wRjCAFTG+i6UORQABYgiQ From: "Peterson, Jon" To: "Cullen Jennings" , "Michael Thomas" X-OriginalArrivalTime: 22 Apr 2005 23:50:33.0024 (UTC) FILETIME=[1274D400:01C54796] X-Spam-Score: 0.8 (/) X-Scan-Signature: 5a9a1bd6c2d06a21d748b7d0070ddcb8 Content-Transfer-Encoding: quoted-printable Cc: sip@ietf.org, Francois Audet , Paul H Kyzivat X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org My goal here is to require nothing other than what is commonly used by = certificate authorities today for web server certs. Go look at the = certificate you get from a TLS connection to Amazon, eBay, Paypal, take = your pick. The domain is in the CN field. If we specify only SAN, and people cannot get certificates from existing = common CAs that put the domain in the SAN, we have a problem. Anyway, the text in sip-identity-05 does not restrict the presence of a = domain name to the CN - it also talks about checking the SAN. Jon Peterson NeuStar, Inc.=20 > -----Original Message----- > From: Cullen Jennings [mailto:fluffy@cisco.com] > Sent: Friday, April 22, 2005 4:01 PM > To: Peterson, Jon; Michael Thomas > Cc: sip@ietf.org; Francois Audet; Paul H Kyzivat > Subject: Re: authority for a domain (was > RE:[Sip]sip-identity-05:display-name woes) >=20 >=20 > On 4/22/05 3:26 PM, "Peterson, Jon" wrote: >=20 > > I've tried to clean up this language a bit for -05, and=20 > hopefully it will be > > an improvement. In the first place, I now talk about=20 > domains appearing in the > > CN field of the subject of the cert as well as the=20 > subjectAltName. Our aim > > here is to correspond exactly with the conventions for=20 > identifying web servers > > in the existing e-commerce field, so, using the CN field of=20 > the subject is > > actually more accurate (though I understand subjectAltName=20 > is used as well > > when multiple hosts are subjects of the same certificate,=20 > as is the case in > > some web hosting architectures). >=20 > Not sure I agree here. SN was horribly underspecified and=20 > caused all sort of > complicated problems. SubjectAlntName (SAN) corrects these=20 > and we don't have > a backwards compatibility problem here. 3261 is very clear=20 > that the certs > used for SIP have to have a SAN - this allows SIP to avoid a=20 > ton of problems > is is not really a big deal for implementers or CA. I think we should > continue using the same sort of certificates for SIP identity=20 > that we use > for 3261.=20 >=20 >=20 >=20 _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Fri Apr 22 20:12:45 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DP8EZ-00080c-HE; Fri, 22 Apr 2005 20:10:55 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DP8EW-00080L-At for sip@megatron.ietf.org; Fri, 22 Apr 2005 20:10:52 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA16966 for ; Fri, 22 Apr 2005 20:10:49 -0400 (EDT) Received: from oak.neustar.com ([209.173.53.70]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DP8QF-00050N-KF for sip@ietf.org; Fri, 22 Apr 2005 20:22:59 -0400 Received: from stntsmtp1.cis.neustar.com (smartexch.neustar.com [10.31.13.79]) by oak.neustar.com (8.12.8/8.11.0) with ESMTP id j3N0AgKD005484; Sat, 23 Apr 2005 00:10:42 GMT Received: from stntexch03.cis.neustar.com ([10.31.13.45]) by stntsmtp1.cis.neustar.com with Microsoft SMTPSVC(6.0.3790.211); Fri, 22 Apr 2005 20:10:42 -0400 X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Subject: RE: [Sip] UA and Display Names Date: Fri, 22 Apr 2005 20:10:41 -0400 Message-ID: <24EAE5D4448B9D4592C6D234CBEBD59701502E5F@stntexch03.cis.neustar.com> Thread-Topic: [Sip] UA and Display Names Thread-Index: AcVHkLRtyzHgUMKbSHqbc+5G6BMfWgABUYIw From: "Peterson, Jon" To: "Paul Kyzivat" , "Cullen Jennings" X-OriginalArrivalTime: 23 Apr 2005 00:10:42.0383 (UTC) FILETIME=[E34A5DF0:01C54798] X-Spam-Score: 0.0 (/) X-Scan-Signature: 0ff9c467ad7f19c2a6d058acd7faaec8 Content-Transfer-Encoding: quoted-printable Cc: sip@ietf.org X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org As I've argued previously on the list, whether or not the display-name = is 'signed' isn't the issue, I think. The issue is whether or not any = policies were applied to by the originating domain when it inspected the = display-name. There are a number of senses in which signing the = display-name doesn't solve any problem. - Signing the display-name doesn't prevent people from impersonating = your display-name. So what if cisco.com will sign the display name when = you make a call? I can go to fwd.net and get a new account and assign it = the display-name "Paul Kyzviat" and call whomever I want. fwd.net will = sign the request, and if all receiving user agents care about is the = display name, I will be perfectly impersonating you. If you think that = signing the display-name is somehow going to prevent this, well, it = doesn't. - Signing the display-name doesn't prevent replay attacks. If the = display-name were unsigned, then presumably, someone could try to = capture an INVITE and replay it with a different display-name. Perhaps = even the original caller, who wants to masquerade as someone else, and = thus captures their own INVITE and replays it. That would work just fine = if there were not other provisions in sip-identity for preventing = replays that would cause this to be detected by a verifier. Signing the = display-name does change how this replay protection would work. - Signing the display-name doesn't prevent man-in-the-middle attacks. = Even if you're not worried about replay, you could be worried about some = man-in-the-middle changing the display-name of the request while it's in = transit. It's true, if the display-name is unsigned, a man-in-the-middle = could do that. The problem is that sip-identity doesn't prevent = man-in-the-middle attacks at all. A man-in-the-middle could just strip = the Identity and Identity-Info headers, if it wanted. sip-identity only = prevents impersonation. So, I don't think signing the display-name helps. I think there are = reasons why it makes sense for domains to have policies about domain = names, and ways to enforce them. But it can enforce those policies = whether the display-name is signed or not. The signature is for the = benefit of verifiers, not the originating domain. Jon Peterson NeuStar, Inc. > -----Original Message----- > From: Paul Kyzivat [mailto:pkyzivat@cisco.com] > Sent: Friday, April 22, 2005 4:11 PM > To: Cullen Jennings > Cc: Jonathan Rosenberg; sip@ietf.org; Peterson, Jon > Subject: Re: [Sip] UA and Display Names >=20 >=20 > Cullen, >=20 > What you describe sounds like a good policy. If I believed that would = be=20 > followed most of the time then I would agree that signing the display=20 > name is unimportant and maybe undesirable. >=20 > But I am inclined to think that won't be the case - that (just like = many=20 > mail readers) the display name will be the main or only displayed=20 > identity of the caller most of the time, and that the actual url will = be=20 > something that only geeks know how to get. In that environment I would = > prefer the display name to be signed. >=20 > But perhaps the kind of approach you suggest has a chance to become=20 > ubiquitous. Convince me. >=20 > Paul >=20 > Cullen Jennings wrote: > > I'm somewhat dubious on the harm that is stopped by=20 > including the Display > > Name in the hash. It leads to a false sense of security=20 > that it is somehow > > OK. I guess I don't really know what I think on this yet=20 > but let me propose > > one thing.=20 > >=20 > > Imagine that a UA was implemented along the following=20 > lines. When it got and > > incoming call, it looked for the URI in the address book=20 > and if it found > > one, displayed the Nick Name that user had for this caller=20 > in their address > > book. If nothing was found in the address book, it just=20 > displayed the URI. > > If the user when to add an entry to the phone booked based=20 > on the current > > caller, the Display Name information could be used to pre=20 > populate the > > fields for the Nick Name. If the device had access to some=20 > sort of trusted > > corporate directory it could also use that as part of the=20 > address book. > >=20 > > It might be good to try and figure out what are the cases=20 > where including > > the Display Name in the hash helps. > >=20 > >=20 > >=20 > > On 3/6/05 1:30 PM, "Jonathan Rosenberg" wrote: > >=20 > >=20 > >>* display name handling > >> > >>I'm concerned that the treatment of the From display name.=20 > The current > >>spec allows an authentication service to verify it (at MAY=20 > strength), > >>and it can reject it if it doesnt like it. But, there is no=20 > signature > >>that covers it, and no way for a verifier to know if the=20 > authentication > >>service allowed it to pass. > >> > >>I'm worried that, although we believe that the URI is the=20 > important form > >>of identity to worry about, real people will be more=20 > concerned with the > >>display name. The mechanism may, as a result, be extremely=20 > misleading, > >>because users are still free to completely spoof the display name. > >> > >>I'd like to consider adding the display name to the=20 > signature, under the > >>constraints that, if done, it require the domain to tell=20 > the client the > >>display names it can insert, so as to avoid all of these equivalence > >>nightmares for internationalized names. > >=20 > >=20 > >=20 > > _______________________________________________ > > Sip mailing list https://www1.ietf.org/mailman/listinfo/sip > > This list is for NEW development of the core SIP Protocol > > Use sip-implementors@cs.columbia.edu for questions on current sip > > Use sipping@ietf.org for new developments on the application of sip > >=20 >=20 _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Fri Apr 22 20:12:56 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DP8GW-0008KH-5P; Fri, 22 Apr 2005 20:12:56 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DP8GU-0008Jo-OS for sip@megatron.ietf.org; Fri, 22 Apr 2005 20:12:54 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA17116 for ; Fri, 22 Apr 2005 20:12:51 -0400 (EDT) Received: from sj-iport-4.cisco.com ([171.68.10.86]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DP8SD-00053e-Py for sip@ietf.org; Fri, 22 Apr 2005 20:25:02 -0400 Received: from sj-core-3.cisco.com (171.68.223.137) by sj-iport-4.cisco.com with ESMTP; 22 Apr 2005 17:12:45 -0700 Received: from vtg-um-e2k4.sj21ad.cisco.com (vtg-um-e2k4.cisco.com [171.70.93.57]) by sj-core-3.cisco.com (8.12.10/8.12.6) with ESMTP id j3N0Cgb4007203; Fri, 22 Apr 2005 17:12:42 -0700 (PDT) Received: from [127.0.0.1] ([171.68.225.134]) by vtg-um-e2k4.sj21ad.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Fri, 22 Apr 2005 17:13:41 -0700 User-Agent: Microsoft-Entourage/11.1.0.040913 Date: Fri, 22 Apr 2005 17:12:41 -0700 Subject: Re: [Sip] UA and Display Names From: Cullen Jennings To: Paul H Kyzivat Message-ID: In-Reply-To: <42698496.20307@cisco.com> Mime-version: 1.0 Content-type: text/plain; charset="US-ASCII" Content-transfer-encoding: 7bit X-OriginalArrivalTime: 23 Apr 2005 00:13:41.0760 (UTC) FILETIME=[4E352000:01C54799] X-Spam-Score: 1.1 (+) X-Scan-Signature: a7d2e37451f7f22841e3b6f40c67db0f Content-Transfer-Encoding: 7bit Cc: "sip@ietf.org" , Jon Peterson X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org Well, let me tease apart what you mean by you want the Display Name to be signed. What you really mean is that you want want to know that you can believe this to decide if you want to answer the call or not. This has one part which is integrity protecting across the network ( this is easy) and it has a part of person asserting it knowing it is right (this is often hard and the rest of the time it is impossible) Let's imagine some various use caser here. Case 1) We include the display name in the hash, byte for byte compare it, and my phone only displays the display name. Now cisco might be able to confirm that you are Paul Kyzivat and might allow you to use that. On the other hand they might make me assert that my name is Fluffy. Whatever they do, I will bet you anything that they make paf assert than his name is something that can represented in US-ASCII so the identity in his email From header matches his identity in his SIP IM. This is going to irritate paf. But just assuming we decide it is ok for force most people to use US-ASCII, lets consider what happens over at yahoo. Yahoo has no way of know peoples names so it let's them assert any name they want. Some evil person goes and gets the an account fluffy@yahoo.com and sets the Display Name to Paul Kyzivat. Now when this person call, everything is valid and the user see the call as being from Paul Kyzivat. Basically, this did nothing for us to help us but id did a bunch to harm us - by "signing" the Display Name we convinced people that this was somehow safe when in reality it was equivalent to being totally unsigned. Case 2) Like above but we include a flag that indicates if the domain has verified the Display Name or not. Presumably yahoo will correctly set this but not the evil person just has to do the same attack from a domain that does not correctly set the flag. Again, nothing was gained. It's true that most email readers just display the Display Name and ignore the aor and don't look the aor up in an address book. This is because it was just as easy to spoof the aor in email as it was to spoof the Display Name so there was no point. If we have a reason to do better in SIP, people might actually do the right thing. On 4/22/05 4:11 PM, "Paul Kyzivat" wrote: > Cullen, > > What you describe sounds like a good policy. If I believed that would be > followed most of the time then I would agree that signing the display > name is unimportant and maybe undesirable. > > But I am inclined to think that won't be the case - that (just like many > mail readers) the display name will be the main or only displayed > identity of the caller most of the time, and that the actual url will be > something that only geeks know how to get. In that environment I would > prefer the display name to be signed. > > But perhaps the kind of approach you suggest has a chance to become > ubiquitous. Convince me. > > Paul > > Cullen Jennings wrote: >> I'm somewhat dubious on the harm that is stopped by including the Display >> Name in the hash. It leads to a false sense of security that it is somehow >> OK. I guess I don't really know what I think on this yet but let me propose >> one thing. >> >> Imagine that a UA was implemented along the following lines. When it got and >> incoming call, it looked for the URI in the address book and if it found >> one, displayed the Nick Name that user had for this caller in their address >> book. If nothing was found in the address book, it just displayed the URI. >> If the user when to add an entry to the phone booked based on the current >> caller, the Display Name information could be used to pre populate the >> fields for the Nick Name. If the device had access to some sort of trusted >> corporate directory it could also use that as part of the address book. >> >> It might be good to try and figure out what are the cases where including >> the Display Name in the hash helps. >> >> >> >> On 3/6/05 1:30 PM, "Jonathan Rosenberg" wrote: >> >> >>> * display name handling >>> >>> I'm concerned that the treatment of the From display name. The current >>> spec allows an authentication service to verify it (at MAY strength), >>> and it can reject it if it doesnt like it. But, there is no signature >>> that covers it, and no way for a verifier to know if the authentication >>> service allowed it to pass. >>> >>> I'm worried that, although we believe that the URI is the important form >>> of identity to worry about, real people will be more concerned with the >>> display name. The mechanism may, as a result, be extremely misleading, >>> because users are still free to completely spoof the display name. >>> >>> I'd like to consider adding the display name to the signature, under the >>> constraints that, if done, it require the domain to tell the client the >>> display names it can insert, so as to avoid all of these equivalence >>> nightmares for internationalized names. >> >> >> >> _______________________________________________ >> Sip mailing list https://www1.ietf.org/mailman/listinfo/sip >> This list is for NEW development of the core SIP Protocol >> Use sip-implementors@cs.columbia.edu for questions on current sip >> Use sipping@ietf.org for new developments on the application of sip >> _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Sat Apr 23 18:04:53 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DPSk8-0002Q7-SA; Sat, 23 Apr 2005 18:04:52 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DPSk4-0002Pz-Kl for sip@megatron.ietf.org; Sat, 23 Apr 2005 18:04:50 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA28063 for ; Sat, 23 Apr 2005 18:04:43 -0400 (EDT) Received: from mail.oefeg.at ([62.47.121.5]) by ietf-mx.ietf.org with smtp (Exim 4.33) id 1DPSvs-0002MP-VQ for sip@ietf.org; Sat, 23 Apr 2005 18:17:04 -0400 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Subject: Re: [Sip] UA and Display Names X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0 Date: Sun, 24 Apr 2005 00:07:25 +0200 Message-ID: <32755D354E6B65498C3BD9FD496C7D4613BE0D@oefeg-s04.oefeg.loc> Thread-Topic: [Sip] UA and Display Names Thread-Index: AcVHmkqQUpDNspiAR3mjOEPR17hgNgAstgyI From: "Stastny Richard" To: "Cullen Jennings" , "Paul H Kyzivat" X-Spam-Score: 0.0 (/) X-Scan-Signature: 76c7db407a166e4c39f35d8215d8dd32 Content-Transfer-Encoding: quoted-printable Cc: sip@ietf.org, Jon Peterson X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org Hi all, =20 I apoligize for jumping into this thead and also that I was not able to follow this dicussion up to now, so I may not be completely up-to-date. =20 As a user, what to I want to get out of a display name? -is it a real name of a person, certified -is it an alias or role name, certified (that means the identity can be = retrieved) -is it an alias, uncertified -is the name suppressed (ala CLIR), but authorities are able to retrieve = the identity -is the name suppressed and cannot be retrieved (anonymous) =20 The last two are required, because it must be possible to make anonymous = calls. =20 I want the name displayed and an indication what status it has, so I = myself or my Personal User Agent (PUA) can make a decision what to do with the call (e.g. reject it). This is basically the ETSI UCI (Universal = Communications Identifier) approach. =20 If I also assume an open end-to-end architecture on the Internet = incl=FAding privately or enterprise owned SIP-servers participating in the = communication, the authentication can only be end-to-end. In addition, the system must also be able to work in P2P networks. =20 I will never trust the signature or certificate of a SIP-server. = Certificates can only be end-to-end (user-to-user). This requires a (network) of = trusted=20 3rd parties issueing the certificates (eg stand-alone AUC for = SIM-cards.)=20 We all know that this is difficult to set-up, but IMHO no other = possibility exists.=20 =20 In the horizontal layers model the identities have also to be = independent from the call control layer and the application layer in a separate = layer and end-to-end. All other approaches are are violating the independance of layers and will fail. =20 regards Richard ________________________________ Von: sip-bounces@ietf.org im Auftrag von Cullen Jennings Gesendet: Sa 23.04.2005 02:12 An: Paul H Kyzivat Cc: sip@ietf.org; Jon Peterson Betreff: Re: [Sip] UA and Display Names Well, let me tease apart what you mean by you want the Display Name to = be signed. What you really mean is that you want want to know that you can believe this to decide if you want to answer the call or not. This has = one part which is integrity protecting across the network ( this is easy) = and it has a part of person asserting it knowing it is right (this is often = hard and the rest of the time it is impossible) Let's imagine some various = use caser here. Case 1) We include the display name in the hash, byte for byte compare = it, and my phone only displays the display name. Now cisco might be able to confirm that you are Paul Kyzivat and might allow you to use that. On = the other hand they might make me assert that my name is Fluffy. Whatever = they do, I will bet you anything that they make paf assert than his name is something that can represented in US-ASCII so the identity in his email = From header matches his identity in his SIP IM. This is going to irritate = paf. But just assuming we decide it is ok for force most people to use = US-ASCII, lets consider what happens over at yahoo. Yahoo has no way of know = peoples names so it let's them assert any name they want. Some evil person goes = and gets the an account fluffy@yahoo.com and sets the Display Name to Paul Kyzivat. Now when this person call, everything is valid and the user see = the call as being from Paul Kyzivat. Basically, this did nothing for us to = help us but id did a bunch to harm us - by "signing" the Display Name we convinced people that this was somehow safe when in reality it was equivalent to being totally unsigned. Case 2) Like above but we include a flag that indicates if the domain = has verified the Display Name or not. Presumably yahoo will correctly set = this but not the evil person just has to do the same attack from a domain = that does not correctly set the flag. Again, nothing was gained. It's true that most email readers just display the Display Name and = ignore the aor and don't look the aor up in an address book. This is because it = was just as easy to spoof the aor in email as it was to spoof the Display = Name so there was no point. If we have a reason to do better in SIP, people = might actually do the right thing. On 4/22/05 4:11 PM, "Paul Kyzivat" wrote: > Cullen, > > What you describe sounds like a good policy. If I believed that would = be > followed most of the time then I would agree that signing the display > name is unimportant and maybe undesirable. > > But I am inclined to think that won't be the case - that (just like = many > mail readers) the display name will be the main or only displayed > identity of the caller most of the time, and that the actual url will = be > something that only geeks know how to get. In that environment I would > prefer the display name to be signed. > > But perhaps the kind of approach you suggest has a chance to become > ubiquitous. Convince me. > > Paul > > Cullen Jennings wrote: >> I'm somewhat dubious on the harm that is stopped by including the = Display >> Name in the hash. It leads to a false sense of security that it is = somehow >> OK. I guess I don't really know what I think on this yet but let me = propose >> one thing. >> >> Imagine that a UA was implemented along the following lines. When it = got and >> incoming call, it looked for the URI in the address book and if it = found >> one, displayed the Nick Name that user had for this caller in their = address >> book. If nothing was found in the address book, it just displayed the = URI. >> If the user when to add an entry to the phone booked based on the = current >> caller, the Display Name information could be used to pre populate = the >> fields for the Nick Name. If the device had access to some sort of = trusted >> corporate directory it could also use that as part of the address = book. >> >> It might be good to try and figure out what are the cases where = including >> the Display Name in the hash helps. >> >> >> >> On 3/6/05 1:30 PM, "Jonathan Rosenberg" wrote: >> >> >>> * display name handling >>> >>> I'm concerned that the treatment of the From display name. The = current >>> spec allows an authentication service to verify it (at MAY = strength), >>> and it can reject it if it doesnt like it. But, there is no = signature >>> that covers it, and no way for a verifier to know if the = authentication >>> service allowed it to pass. >>> >>> I'm worried that, although we believe that the URI is the important = form >>> of identity to worry about, real people will be more concerned with = the >>> display name. The mechanism may, as a result, be extremely = misleading, >>> because users are still free to completely spoof the display name. >>> >>> I'd like to consider adding the display name to the signature, under = the >>> constraints that, if done, it require the domain to tell the client = the >>> display names it can insert, so as to avoid all of these equivalence >>> nightmares for internationalized names. >> >> >> >> _______________________________________________ >> Sip mailing list https://www1.ietf.org/mailman/listinfo/sip >> This list is for NEW development of the core SIP Protocol >> Use sip-implementors@cs.columbia.edu for questions on current sip >> Use sipping@ietf.org for new developments on the application of sip >> _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Mon Apr 25 04:48:03 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DPzG2-0006ej-7q; Mon, 25 Apr 2005 04:47:58 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DPzFz-0006eB-Bh for sip@megatron.ietf.org; Mon, 25 Apr 2005 04:47:55 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id EAA25654 for ; Mon, 25 Apr 2005 04:47:52 -0400 (EDT) Received: from voyager.coretrek.no ([212.33.142.2]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DPzSA-0005C0-LY for sip@ietf.org; Mon, 25 Apr 2005 05:00:32 -0400 Received: from localhost (localhost [127.0.0.1]) by voyager.coretrek.no (Postfix) with ESMTP id DE377A98B7; Mon, 25 Apr 2005 10:47:37 +0200 (CEST) Received: from [192.168.1.78] (unknown [82.196.214.14]) by voyager.coretrek.no (Postfix) with ESMTP id 2FCF6A989C; Mon, 25 Apr 2005 10:47:36 +0200 (CEST) In-Reply-To: <42698496.20307@cisco.com> References: <42698496.20307@cisco.com> Mime-Version: 1.0 (Apple Message framework v622) Content-Type: text/plain; charset=US-ASCII; format=flowed Message-Id: Content-Transfer-Encoding: 7bit From: Hisham Khartabil Subject: Re: [Sip] UA and Display Names Date: Mon, 25 Apr 2005 10:47:35 +0200 To: Paul Kyzivat X-Mailer: Apple Mail (2.622) X-Virus-Scanned: by AMaViS perl-11 (CoreTrek clamav patch 1) X-Spam-Score: 0.0 (/) X-Scan-Signature: cf3becbbd6d1a45acbe2ffd4ab88bdc2 Content-Transfer-Encoding: 7bit Cc: "sip@ietf.org" , Cullen Jennings , Jon Peterson X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org I tried to point out the same facts that Cullen did in a previous thread, so here I am supporting him. Paul is basing his arguments about human behaviour using email as an example. I think a more appropriate comparison is the way people use their phones. If a name is not found in the LOCAL address book, the number is displayed. The same would apply here, if a name is not found in the LOCAL address book, the sip uri is displayed. I don't buy the argument that a uri is only something that geeks have to look at. The uri is the "thing" that people would have to dial if the number is not being pulled from an address book. Regards, Hisham On Apr 23, 2005, at 1:11 AM, Paul Kyzivat wrote: > Cullen, > > What you describe sounds like a good policy. If I believed that would > be followed most of the time then I would agree that signing the > display name is unimportant and maybe undesirable. > > But I am inclined to think that won't be the case - that (just like > many mail readers) the display name will be the main or only displayed > identity of the caller most of the time, and that the actual url will > be something that only geeks know how to get. In that environment I > would prefer the display name to be signed. > > But perhaps the kind of approach you suggest has a chance to become > ubiquitous. Convince me. > > Paul > > Cullen Jennings wrote: >> I'm somewhat dubious on the harm that is stopped by including the >> Display >> Name in the hash. It leads to a false sense of security that it is >> somehow >> OK. I guess I don't really know what I think on this yet but let me >> propose >> one thing. Imagine that a UA was implemented along the following >> lines. When it got and >> incoming call, it looked for the URI in the address book and if it >> found >> one, displayed the Nick Name that user had for this caller in their >> address >> book. If nothing was found in the address book, it just displayed the >> URI. >> If the user when to add an entry to the phone booked based on the >> current >> caller, the Display Name information could be used to pre populate the >> fields for the Nick Name. If the device had access to some sort of >> trusted >> corporate directory it could also use that as part of the address >> book. >> It might be good to try and figure out what are the cases where >> including >> the Display Name in the hash helps. >> On 3/6/05 1:30 PM, "Jonathan Rosenberg" wrote: >>> * display name handling >>> >>> I'm concerned that the treatment of the From display name. The >>> current >>> spec allows an authentication service to verify it (at MAY strength), >>> and it can reject it if it doesnt like it. But, there is no signature >>> that covers it, and no way for a verifier to know if the >>> authentication >>> service allowed it to pass. >>> >>> I'm worried that, although we believe that the URI is the important >>> form >>> of identity to worry about, real people will be more concerned with >>> the >>> display name. The mechanism may, as a result, be extremely >>> misleading, >>> because users are still free to completely spoof the display name. >>> >>> I'd like to consider adding the display name to the signature, under >>> the >>> constraints that, if done, it require the domain to tell the client >>> the >>> display names it can insert, so as to avoid all of these equivalence >>> nightmares for internationalized names. >> _______________________________________________ >> Sip mailing list https://www1.ietf.org/mailman/listinfo/sip >> This list is for NEW development of the core SIP Protocol >> Use sip-implementors@cs.columbia.edu for questions on current sip >> Use sipping@ietf.org for new developments on the application of sip > > _______________________________________________ > Sip mailing list https://www1.ietf.org/mailman/listinfo/sip > This list is for NEW development of the core SIP Protocol > Use sip-implementors@cs.columbia.edu for questions on current sip > Use sipping@ietf.org for new developments on the application of sip > _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Mon Apr 25 06:17:25 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DQ0eY-0004TA-P6; Mon, 25 Apr 2005 06:17:22 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DQ0eX-0004T5-B9 for sip@megatron.ietf.org; Mon, 25 Apr 2005 06:17:21 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id GAA02272 for ; Mon, 25 Apr 2005 06:17:18 -0400 (EDT) Received: from bay9-dav57.bay9.hotmail.com ([64.4.47.57] helo=hotmail.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DQ0qi-0000zX-Eo for sip@ietf.org; Mon, 25 Apr 2005 06:29:59 -0400 Received: from mail pickup service by hotmail.com with Microsoft SMTPSVC; Mon, 25 Apr 2005 03:17:08 -0700 Message-ID: Received: from 4.181.96.124 by BAY9-DAV57.phx.gbl with DAV; Mon, 25 Apr 2005 10:17:08 +0000 X-Originating-IP: [4.181.96.124] X-Originating-Email: [wrmiller12364@hotmail.com] X-Sender: wrmiller12364@hotmail.com From: "English miller" To: Date: Mon, 25 Apr 2005 03:17:06 -0700 MIME-Version: 1.0 X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: MSN 9 Seal-Send-Time: Mon, 25 Apr 2005 03:17:06 -0700 X-MimeOLE: Produced By MSN MimeOLE V9.10.0011.1703 X-OriginalArrivalTime: 25 Apr 2005 10:17:08.0739 (UTC) FILETIME=[F0132D30:01C5497F] X-Spam-Score: 4.1 (++++) X-Scan-Signature: 8abaac9e10c826e8252866cbe6766464 Subject: [Sip] (no subject) X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============1016725535==" Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org This is a multi-part message in MIME format. --===============1016725535== Content-Type: multipart/alternative; boundary="----=_NextPart_000_0105_01C54945.428BDAC0" This is a multi-part message in MIME format. ------=_NextPart_000_0105_01C54945.428BDAC0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable ------=_NextPart_000_0105_01C54945.428BDAC0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
 
------=_NextPart_000_0105_01C54945.428BDAC0-- --===============1016725535== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip --===============1016725535==-- From sip-bounces@ietf.org Mon Apr 25 10:31:53 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DQ4cq-00067A-Vp; Mon, 25 Apr 2005 10:31:52 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DQ4co-000675-RV for sip@megatron.ietf.org; Mon, 25 Apr 2005 10:31:50 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA20344 for ; Mon, 25 Apr 2005 10:31:48 -0400 (EDT) Received: from mxout1.netvision.net.il ([194.90.9.20]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DQ4p3-00034T-9j for sip@ietf.org; Mon, 25 Apr 2005 10:44:31 -0400 Received: from [127.0.0.1] ([212.143.127.195]) by mxout1.netvision.net.il (Sun Java System Messaging Server 6.1 HotFix 0.11 (built Jan 28 2005)) with ESMTPA id <0IFI00JLBB0MYTG0@mxout1.netvision.net.il> for sip@ietf.org; Mon, 25 Apr 2005 17:31:35 +0300 (IDT) Date: Mon, 25 Apr 2005 16:32:06 +0200 From: Diego B To: sip@ietf.org Message-id: <426CFF66.7000805@mailvision.com> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT X-Accept-Language: en-us, en User-Agent: Mozilla Thunderbird 1.0 (Windows/20041206) X-Spam-Score: 0.0 (/) X-Scan-Signature: 7655788c23eb79e336f5f8ba8bce7906 Content-Transfer-Encoding: 7BIT Subject: [Sip] Proxy Server and Record-Route X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org Hi; How a Proxy server behind a Firewall writes the Record-Route ? The Proxy Server serves UAs form within the FW and also UAs from outside the firewall ( public internet ) In the firewall there is a mapping between a public IP:port to the private ip:port of the Proxy. If the proxy puts its private IP in Record-Route, UAs from public internet wont be able to get to that address. If the Proxy puts in Record-Route its public address, UAs from within the firewall wont be able to send to that address. Using FQDN in Record-Route can be a solution ? For this I need to use different DNS servers ( inside and outside the firewall ) with different maps for the FQDN. What is the common solution for this ? Thanks Diego B _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Mon Apr 25 11:47:43 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DQ5oE-0005mu-TU; Mon, 25 Apr 2005 11:47:42 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DQ5oD-0005mm-Jd for sip@megatron.ietf.org; Mon, 25 Apr 2005 11:47:41 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA26539 for ; Mon, 25 Apr 2005 11:47:37 -0400 (EDT) Received: from sj-iport-5.cisco.com ([171.68.10.87]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DQ60T-0005oi-4n for sip@ietf.org; Mon, 25 Apr 2005 12:00:21 -0400 Received: from sj-core-4.cisco.com (171.68.223.138) by sj-iport-5.cisco.com with ESMTP; 25 Apr 2005 08:47:31 -0700 Received: from vtg-um-e2k4.sj21ad.cisco.com (vtg-um-e2k4.cisco.com [171.70.93.57]) by sj-core-4.cisco.com (8.12.10/8.12.6) with ESMTP id j3PFlRpR027407; Mon, 25 Apr 2005 08:47:28 -0700 (PDT) Received: from 10.32.130.175 ([10.32.130.175]) by vtg-um-e2k4.sj21ad.cisco.com ([171.70.93.57]) with Microsoft Exchange Server HTTP-DAV ; Mon, 25 Apr 2005 15:48:31 +0000 User-Agent: Microsoft-Entourage/11.1.0.040913 Date: Mon, 25 Apr 2005 08:47:27 -0700 Subject: Re: authority for a domain (was RE:[Sip]sip-identity-05:display-name woes) From: Cullen Jennings To: Jon Peterson , Michael Thomas Message-ID: In-Reply-To: <24EAE5D4448B9D4592C6D234CBEBD59701502E5E@stntexch03.cis.neustar.com> Mime-version: 1.0 Content-type: text/plain; charset="US-ASCII" Content-transfer-encoding: 7bit X-Spam-Score: 0.8 (/) X-Scan-Signature: 6cca30437e2d04f45110f2ff8dc1b1d5 Content-Transfer-Encoding: 7bit Cc: "sip@ietf.org" , Francois Audet , Paul H Kyzivat X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org I've been working with some of the major CA vendors to make sure they can tell people have to get certificates that have the name in the SubjectAltName. Actually many of them already do it but you have to have to ask for a "Microsoft Small Business Server certificate" - they use Subject Alt Name. Some other ones, when you send them a Certificate Signing Request with a Subject Alt Name they do it fine, some other strip it. I can not imagine why we would go to the effort of making Identity work with certificates that would not work for RFC 3261 TLS. If we want to go back and upgrade 3261 and Identity so they both have all the text so that people can successfully parse the Common Name stuff we could but I think we should both or neither. I some favor the path of getting it so that CA and people know how to provide certs with the Subject Alt Name set correctly is a better path but I can go either way. Cullen On 4/22/05 4:50 PM, "Peterson, Jon" wrote: > > My goal here is to require nothing other than what is commonly used by > certificate authorities today for web server certs. Go look at the certificate > you get from a TLS connection to Amazon, eBay, Paypal, take your pick. The > domain is in the CN field. > > If we specify only SAN, and people cannot get certificates from existing > common CAs that put the domain in the SAN, we have a problem. > > Anyway, the text in sip-identity-05 does not restrict the presence of a domain > name to the CN - it also talks about checking the SAN. > > Jon Peterson > NeuStar, Inc. > >> -----Original Message----- >> From: Cullen Jennings [mailto:fluffy@cisco.com] >> Sent: Friday, April 22, 2005 4:01 PM >> To: Peterson, Jon; Michael Thomas >> Cc: sip@ietf.org; Francois Audet; Paul H Kyzivat >> Subject: Re: authority for a domain (was >> RE:[Sip]sip-identity-05:display-name woes) >> >> >> On 4/22/05 3:26 PM, "Peterson, Jon" wrote: >> >>> I've tried to clean up this language a bit for -05, and >> hopefully it will be >>> an improvement. In the first place, I now talk about >> domains appearing in the >>> CN field of the subject of the cert as well as the >> subjectAltName. Our aim >>> here is to correspond exactly with the conventions for >> identifying web servers >>> in the existing e-commerce field, so, using the CN field of >> the subject is >>> actually more accurate (though I understand subjectAltName >> is used as well >>> when multiple hosts are subjects of the same certificate, >> as is the case in >>> some web hosting architectures). >> >> Not sure I agree here. SN was horribly underspecified and >> caused all sort of >> complicated problems. SubjectAlntName (SAN) corrects these >> and we don't have >> a backwards compatibility problem here. 3261 is very clear >> that the certs >> used for SIP have to have a SAN - this allows SIP to avoid a >> ton of problems >> is is not really a big deal for implementers or CA. I think we should >> continue using the same sort of certificates for SIP identity >> that we use >> for 3261. >> >> >> _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Mon Apr 25 14:05:22 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DQ7xR-0001q4-W4; Mon, 25 Apr 2005 14:05:21 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DQ7xQ-0001pe-Rv for sip@megatron.ietf.org; Mon, 25 Apr 2005 14:05:20 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA06833 for ; Mon, 25 Apr 2005 14:05:18 -0400 (EDT) Received: from bay9-dav51.bay9.hotmail.com ([64.4.47.51] helo=hotmail.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DQ89h-0002Gq-Pk for sip@ietf.org; Mon, 25 Apr 2005 14:18:03 -0400 Received: from mail pickup service by hotmail.com with Microsoft SMTPSVC; Mon, 25 Apr 2005 11:05:09 -0700 Message-ID: Received: from 4.182.57.123 by BAY9-DAV51.phx.gbl with DAV; Mon, 25 Apr 2005 18:05:09 +0000 X-Originating-IP: [4.182.57.123] X-Originating-Email: [wrmiller12364@hotmail.com] X-Sender: wrmiller12364@hotmail.com From: "William R Miller" To: Date: Mon, 25 Apr 2005 11:05:06 -0700 MIME-Version: 1.0 X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.2180 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180 X-OriginalArrivalTime: 25 Apr 2005 18:05:09.0874 (UTC) FILETIME=[51BC5520:01C549C1] X-Spam-Score: 3.4 (+++) X-Scan-Signature: 9182cfff02fae4f1b6e9349e01d62f32 Subject: [Sip] (no subject) X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============0884375964==" Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org This is a multi-part message in MIME format. --===============0884375964== Content-Type: multipart/alternative; boundary="----=_NextPart_000_00AD_01C54986.A3A063D0" This is a multi-part message in MIME format. ------=_NextPart_000_00AD_01C54986.A3A063D0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable can you explain ------=_NextPart_000_00AD_01C54986.A3A063D0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
can you = explain
------=_NextPart_000_00AD_01C54986.A3A063D0-- --===============0884375964== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip --===============0884375964==-- From sip-bounces@ietf.org Mon Apr 25 15:09:01 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DQ8x3-0006xY-FD; Mon, 25 Apr 2005 15:09:01 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DQ8x2-0006xN-8a for sip@megatron.ietf.org; Mon, 25 Apr 2005 15:09:00 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA12608 for ; Mon, 25 Apr 2005 15:08:58 -0400 (EDT) Received: from oak.neustar.com ([209.173.53.70]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DQ99K-0004f2-1n for sip@ietf.org; Mon, 25 Apr 2005 15:21:43 -0400 Received: from stntsmtp1.cis.neustar.com (smartexch.neustar.com [10.31.13.79]) by oak.neustar.com (8.12.8/8.11.0) with ESMTP id j3PJ8nKD024609 for ; Mon, 25 Apr 2005 19:08:49 GMT Received: from stntexch03.cis.neustar.com ([10.31.13.45]) by stntsmtp1.cis.neustar.com with Microsoft SMTPSVC(6.0.3790.211); Mon, 25 Apr 2005 15:08:49 -0400 X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Date: Mon, 25 Apr 2005 15:08:49 -0400 Message-ID: <24EAE5D4448B9D4592C6D234CBEBD59701502E65@stntexch03.cis.neustar.com> Thread-Topic: closure on display-names & sip-identity Thread-Index: AcVJyhN7vG/RUpVvTraunDEIDoVjsA== From: "Peterson, Jon" To: X-OriginalArrivalTime: 25 Apr 2005 19:08:49.0718 (UTC) FILETIME=[368A4560:01C549CA] X-Spam-Score: 0.0 (/) X-Scan-Signature: 0ddefe323dd869ab027dbfff7eff0465 Content-Transfer-Encoding: quoted-printable Subject: [Sip] closure on display-names & sip-identity X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org Well, we've certainly had a lot of discussion of display-names for = sip-identity, but I'm not sure that it has led us to any conclusion. Partly, I think this is because we've had difficulty distinguishing = three issues: - The value of having authentication service policies for display-names - The value of signing the display-name or adding some other indication = that a policy was enforced - The mechanics of actually signing display-names Personally, I think the value of policy is necessarily limited. If a = user agent recipient renders only what it sees in the display-name = field, then authentication service policies necessarily will not prevent = impersonation - impersonators can always create accounts with the = desired display-name in a domain friendly or oblivious to their = interests. What policies can do is prevent a user within a domain from = associating an inappropriate display-name with a particular account. = While this is no doubt helpful for certain kinds of domain, it is of = limited use in preventing the sorts of global impersonation problems = with which sip-identity is concerned. A signature over the display-name has no intrinsic value from an = impersonation-prevention perspective. It could of course serve as an = indication that policy was enforced, but solving the signature problem = is a lot of trouble to go through when a simple parameter of the = Identity-Info header might serve the same purpose. Ultimately, I further = believe that the absence of policy should entail consent in this case, = and that therefore, an indicator is probably ultimately unnecessary. If = the display-name is inappropriate, the authentication service should not = validate the request - that's all the indication that we probably need. To the mechanics of the signing process and related apparatus, I'll just = say that it looks complicated to me. Internationalization concerns, = opertational concerns (provisioning bit-exact correct display-names in = clients), and the like make this potentially a long-term problem. I have not yet heard any compelling argument that we need to this. As = such, I would like to propose that we keep substantially the same = wording that appears in sip-identity-04. Essentially, that would mean = that domains MAY have policies, MAY reject requests that contain = inappropriate display-names, but display-names do NOT appear in the = Identity header hash and no further indication of the presence or = absence of policy is present. If you have substantive objections to this, please air them now. Jon Peterson NeuStar, Inc. _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Mon Apr 25 15:21:49 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DQ99R-0008Hg-AT; Mon, 25 Apr 2005 15:21:49 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DQ99L-0008H3-HN for sip@megatron.ietf.org; Mon, 25 Apr 2005 15:21:47 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA14533 for ; Mon, 25 Apr 2005 15:21:41 -0400 (EDT) Received: from rtp-iport-2.cisco.com ([64.102.122.149]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DQ9Ld-0005A3-93 for sip@ietf.org; Mon, 25 Apr 2005 15:34:26 -0400 Received: from rtp-core-1.cisco.com (64.102.124.12) by rtp-iport-2.cisco.com with ESMTP; 25 Apr 2005 15:21:32 -0400 Received: from xbh-rtp-211.amer.cisco.com (xbh-rtp-211.cisco.com [64.102.31.102]) by rtp-core-1.cisco.com (8.12.10/8.12.6) with ESMTP id j3PJKeS0025717; Mon, 25 Apr 2005 15:21:31 -0400 (EDT) Received: from xfe-rtp-202.amer.cisco.com ([64.102.31.21]) by xbh-rtp-211.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Mon, 25 Apr 2005 15:21:21 -0400 Received: from cisco.com ([161.44.79.173]) by xfe-rtp-202.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Mon, 25 Apr 2005 15:21:20 -0400 Message-ID: <426D4320.9060205@cisco.com> Date: Mon, 25 Apr 2005 15:21:04 -0400 From: Paul Kyzivat User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.1) Gecko/20020826 X-Accept-Language: en-us, en MIME-Version: 1.0 To: "Peterson, Jon" Subject: Re: [Sip] closure on display-names & sip-identity References: <24EAE5D4448B9D4592C6D234CBEBD59701502E65@stntexch03.cis.neustar.com> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-OriginalArrivalTime: 25 Apr 2005 19:21:20.0983 (UTC) FILETIME=[F6543670:01C549CB] X-Spam-Score: 0.0 (/) X-Scan-Signature: 97adf591118a232206bdb5a27b217034 Content-Transfer-Encoding: 7bit Cc: sip@ietf.org X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org Jon, I concede - you have countered the cases I have presented. Paul Peterson, Jon wrote: > Well, we've certainly had a lot of discussion of display-names for sip-identity, but I'm not sure that it has led us to any conclusion. > > Partly, I think this is because we've had difficulty distinguishing three issues: > > - The value of having authentication service policies for display-names > - The value of signing the display-name or adding some other indication that a policy was enforced > - The mechanics of actually signing display-names > > Personally, I think the value of policy is necessarily limited. If a user agent recipient renders only what it sees in the display-name field, then authentication service policies necessarily will not prevent impersonation - impersonators can always create accounts with the desired display-name in a domain friendly or oblivious to their interests. What policies can do is prevent a user within a domain from associating an inappropriate display-name with a particular account. While this is no doubt helpful for certain kinds of domain, it is of limited use in preventing the sorts of global impersonation problems with which sip-identity is concerned. > > A signature over the display-name has no intrinsic value from an impersonation-prevention perspective. It could of course serve as an indication that policy was enforced, but solving the signature problem is a lot of trouble to go through when a simple parameter of the Identity-Info header might serve the same purpose. Ultimately, I further believe that the absence of policy should entail consent in this case, and that therefore, an indicator is probably ultimately unnecessary. If the display-name is inappropriate, the authentication service should not validate the request - that's all the indication that we probably need. > > To the mechanics of the signing process and related apparatus, I'll just say that it looks complicated to me. Internationalization concerns, opertational concerns (provisioning bit-exact correct display-names in clients), and the like make this potentially a long-term problem. > > I have not yet heard any compelling argument that we need to this. As such, I would like to propose that we keep substantially the same wording that appears in sip-identity-04. Essentially, that would mean that domains MAY have policies, MAY reject requests that contain inappropriate display-names, but display-names do NOT appear in the Identity header hash and no further indication of the presence or absence of policy is present. > > If you have substantive objections to this, please air them now. > > Jon Peterson > NeuStar, Inc. > > _______________________________________________ > Sip mailing list https://www1.ietf.org/mailman/listinfo/sip > This list is for NEW development of the core SIP Protocol > Use sip-implementors@cs.columbia.edu for questions on current sip > Use sipping@ietf.org for new developments on the application of sip > _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Mon Apr 25 15:22:45 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DQ9AL-0008R6-Rc; Mon, 25 Apr 2005 15:22:45 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DQ9AH-0008Qr-Qf for sip@megatron.ietf.org; Mon, 25 Apr 2005 15:22:44 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA14640 for ; Mon, 25 Apr 2005 15:22:39 -0400 (EDT) Received: from [206.176.144.210] (helo=kevlar.softarmor.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DQ9MW-0005Bn-VE for sip@ietf.org; Mon, 25 Apr 2005 15:35:24 -0400 Received: from [64.101.149.196] (adahmed-w2k02-1.cisco.com [64.101.149.196] (may be forged)) (authenticated bits=0) by kevlar.softarmor.com (8.13.1/8.13.1) with ESMTP id j3PJZXn6006070 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NO); Mon, 25 Apr 2005 14:35:37 -0500 In-Reply-To: References: Mime-Version: 1.0 (Apple Message framework v622) Content-Type: text/plain; charset=US-ASCII; format=flowed Message-Id: Content-Transfer-Encoding: 7bit From: Dean Willis Subject: Re: [Sip] RE: Question to Identity draft Date: Mon, 25 Apr 2005 14:22:34 -0500 To: Cullen Jennings X-Mailer: Apple Mail (2.622) X-Spam-Score: 0.0 (/) X-Scan-Signature: 2409bba43e9c8d580670fda8b695204a Content-Transfer-Encoding: 7bit Cc: "sip@ietf.org" , Fries Steffen , Jon Peterson X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org On Apr 21, 2005, at 12:12 PM, Cullen Jennings wrote: > > If Alice and Bob both get to use a phone called Device A, do both > Alice and > Bob learn the private key of Device A? > No. Device A acts as an identity authority, and asserts by application of its private key that Alice or Bob is using device A. > If device A calls Bob, and Bob is going to answer on device B, how > does A > know what certificate to use for encrypting. > Two possibilities occur to me: 1). No clue. 2). By noting that Bob's presence document says "I'm using Device A". -- Dean _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Mon Apr 25 16:56:18 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DQAcs-0001s3-N0; Mon, 25 Apr 2005 16:56:18 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DQAco-0001ld-Ru for sip@megatron.ietf.org; Mon, 25 Apr 2005 16:56:16 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA28463 for ; Mon, 25 Apr 2005 16:56:11 -0400 (EDT) Received: from [65.220.123.3] (helo=mail.pingtel.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DQAp7-0002R8-Te for sip@ietf.org; Mon, 25 Apr 2005 17:08:58 -0400 Received: from keywest (hide.pingtel.com [65.220.123.2]) by mail.pingtel.com (Postfix) with SMTP id 6D8BD6C028 for ; Mon, 25 Apr 2005 16:56:08 -0400 (EDT) From: "Dale Worley" To: "Sip (E-mail)" Date: Mon, 25 Apr 2005 16:52:50 -0400 Message-ID: <00eb01c549d8$bf290fb0$6a01010a@keywest> MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook CWS, Build 9.0.2416 (9.0.2910.0) Importance: Normal X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1441 X-Spam-Score: 0.2 (/) X-Scan-Signature: b280b4db656c3ca28dd62e5e0b03daa8 Content-Transfer-Encoding: 7bit Subject: [Sip] Comments on draft-ietf-sip-resource-priority-08 X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org A request went out for people to read draft-ietf-sip-resource-priority-06 with fresh eyes. (I've since updated this against version 08, which fixes a lot of the things I was concerned about.) Since I'm new to the SIP world, I thought I'd try. The disadvantage of my naivete is the terrible fear that I'm going to bring up some issue that was discussed thoroughly in the past. But the old timers can probably recognize and discard such issues a lot faster than I can search to find them, so here goes... - Requests without the Resource-Priority: header are intended to be processed at a lower priority than requests with a Resource-Priority: header. But I don't recall this being stated explicitly anywhere, and certainly not up-front in the document. And there seems to be no fixed terminology for such requests. The phrase "normal, non-prioritized" seems to be used a lot, despite its cumbersomeness, and the fact that it is objectively incorrect. (Any PR actor prioritizes *all* requests; requests without Resource-Priority: are given the lowest priority.) - There seems to be some ambiguity as to whether a request is queued/delayed waiting for the resources needed to process the request *itself*, or waiting for resources (like UA facilities, or bandwidth) needed for the *dialog* containing the request. This is probably not important, as the prioritization for both sorts of resources is the same, but it gets a bit confusing as the draft refers randomly to one situation and then the other. It might help to state up-front that there can be queuing for various sorts of resources, and (absent specific policy rules in the IANA registration) they are handled the same way. - There are many places where the text notes that the generic prioritization behavior can be modified by the specific policies in the IANA registration for the namespace. This seems to be redundant, and perhaps could be replaced by a single up-front statement. This could be augmented by a statement that the operation of a PR actor can also be modified by local administrative policy. - Section 3.2, "Accept-Resource-Priority" is unclear as to the semantics of the header. Usually, "Accept" headers describe "configuration" information about the device which changes very slowly. Within that concept, I would expect that "Accept-Resource-Priority" would list the namespaces that the RP actor understands. But since the definition of the header says that it lists priority values, it must be to indicate the priorities that the actor currently has the resources to handle. If so, this should be made explicit. In this case, it seems like there needs to be an extension of the definition to allow it to specify that "non-prioritized" requests will be accepted. - In section 4.6.4, "Insufficient authorization" seems to presuppose that the RP actor can determine whether the requester is authorized to use any particular priority. But this seems like it is not always true. A better phrasing might be "... but it can determine that the originator is not authorized ...". - Section 4.6.5 contains the sentence fragment "If an RP actor receives an authorized request, has insufficient resources and the request neither preempts another request nor is queued." - In section 4.7.2.1, it might be an improvement to say "MUST terminate or interrupt (as appropriate) a session established". It seems that the range of resources that might be needed to establish a dialog is quite broad (we've already identified signaling processing capacity, media bandwidth, and UA facilities, and there are likely to be more), and so we need to allow a broad range of strategies for RP actors to free resources, with only the overriding constraint that the higher-priority request must not be blocked from being processed by resources consumed by a request of sufficiently lower priority. (See section 4.9 describe how request priorities might be grouped and handled together.) - In section 4.7.2.2, the last sentence might read better as "However, the requirements in [RFC3261] regarding the frequency of provisional messages still apply, in order to keep each session set-up active until successful or rejected." - Given the age of this I-D, there are likely to be implementations of this mechanism in the field. It would enhance the reader's interest of these were briefly mentioned. Dale _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Mon Apr 25 19:04:38 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DQCd4-0005t1-0o; Mon, 25 Apr 2005 19:04:38 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DQCd2-0005sv-6K for sip@megatron.ietf.org; Mon, 25 Apr 2005 19:04:36 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA09462 for ; Mon, 25 Apr 2005 19:04:32 -0400 (EDT) From: Pierre.Lacour@alcatel.fr Received: from smail.alcatel.fr ([64.208.49.165]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DQCpL-00075H-Kb for sip@ietf.org; Mon, 25 Apr 2005 19:17:21 -0400 Received: from frmail15.netfr.alcatel.fr (frmail15.netfr.alcatel.fr [155.132.251.15]) by smail.alcatel.fr (ALCANET/NETFR) with ESMTP id j3PN0tKW031000 for ; Tue, 26 Apr 2005 01:04:26 +0200 To: sip@ietf.org Message-ID: Date: Tue, 26 Apr 2005 01:01:46 +0200 X-MIMETrack: Serialize by Router on FRMAIL15/FR/ALCATEL(Release 5.0.12HF788 | September 23, 2004) at 04/26/2005 01:04:26 MIME-Version: 1.0 Content-type: text/plain; charset=us-ascii X-Alcanet-MTA-scanned-and-authorized: yes X-Spam-Score: 0.3 (/) X-Scan-Signature: 8ac499381112328dd60aea5b1ff596ea Subject: [Sip] Pierre LACOUR/FR/ALCATEL is out of the office. X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org I will be out of the office starting 25/04/2005 and will not return until 02/05/2005. I will respond to your message when I return _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Mon Apr 25 19:26:35 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DQCyJ-0008On-6V; Mon, 25 Apr 2005 19:26:35 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DQCyI-0008Oi-E6 for sip@megatron.ietf.org; Mon, 25 Apr 2005 19:26:34 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA10861 for ; Mon, 25 Apr 2005 19:26:30 -0400 (EDT) Received: from sj-iport-5.cisco.com ([171.68.10.87]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DQDAc-0007pg-Ct for sip@ietf.org; Mon, 25 Apr 2005 19:39:19 -0400 Received: from sj-core-2.cisco.com (171.71.177.254) by sj-iport-5.cisco.com with ESMTP; 25 Apr 2005 16:26:24 -0700 Received: from imail.cisco.com (imail.cisco.com [128.107.200.91]) by sj-core-2.cisco.com (8.12.10/8.12.6) with ESMTP id j3PNQDKx008050; Mon, 25 Apr 2005 16:26:14 -0700 (PDT) Received: from thomasm-lnx.cisco.com (thomasm-lnx.cisco.com [171.71.96.50]) by imail.cisco.com (8.12.11/8.12.10) with ESMTP id j3PNH4HP008698; Mon, 25 Apr 2005 16:17:04 -0700 Subject: Re: [Sip] closure on display-names & sip-identity From: Michael Thomas To: "Peterson, Jon" In-Reply-To: <24EAE5D4448B9D4592C6D234CBEBD59701502E65@stntexch03.cis.neustar.com> References: <24EAE5D4448B9D4592C6D234CBEBD59701502E65@stntexch03.cis.neustar.com> Organization: Cisco Systems Message-Id: <1114471580.24378.12.camel@thomasm-lnx.cisco.com> Mime-Version: 1.0 X-Mailer: Ximian Evolution 1.4.6 Date: Mon, 25 Apr 2005 16:26:20 -0700 IIM-SIG: v:"1.1"; h:"imail.cisco.com"; d:"cisco.com"; z:"home"; m:"krs"; t:"1114471024.196566"; x:"432200"; a:"rsa-sha1"; b:"nofws:2369"; e:"Iw=="; n:"sQYarK2E51MdcTiUqeif3F7cWdxIfoCiXhdfb9vD5ee/j0jXL15gbFxF2p" "XIweAblu0N6XAgK7k+wrbr7bQDJaCDqOmzqpRUBjIRQAXQ7NzadpmR3pUL6wxaRUtW+c43sl9jC" "50Qg1sXHpPjt8Y+Y16ioyQAQAdSunM4YhevURc="; s:"ffu5lY9sGK8V47b4C/1akqX1HAzPgzsvKRbx2fRnkQgGDb0yXOhyFoJ9vOxc1+nzP/MAyAR5" "9NlY9kBFD/YgvuvbbsXSfDiT2iytWzizAe1ZTwHbz20euIUuxgxzJVz2KfNbWm07KgeQPhCe1R0" "IN7bIJ3aa3uUA5daPfb9kCa4="; c:"Subject: Re: [Sip] closure on display-names & sip-identity"; c:"From: Michael Thomas "; c:"Date: Mon, 25 Apr 2005 16:26:20 -0700" IIM-VERIFY: s:"y"; v:"y"; r:"60"; h:"imail.cisco.com"; c:"message from imail.cisco.com verified; " X-Spam-Score: 0.0 (/) X-Scan-Signature: b4a0a5f5992e2a4954405484e7717d8c Cc: sip@ietf.org X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============1005524588==" Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org --===============1005524588== Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="=-1JtzVb2B61NxoEdf4IQS" --=-1JtzVb2B61NxoEdf4IQS Content-Type: text/plain Content-Transfer-Encoding: quoted-printable On Mon, 2005-04-25 at 12:08, Peterson, Jon wrote: > Well, we've certainly had a lot of discussion of display-names for sip-id= entity, but I'm not sure that it has led us to any conclusion. >=20 > Partly, I think this is because we've had difficulty distinguishing three= issues: >=20 > - The value of having authentication service policies for display-names > - The value of signing the display-name or adding some other indication t= hat a policy was enforced > - The mechanics of actually signing display-names >=20 > Personally, I think the value of policy is necessarily limited. If a user= agent recipient renders only what it sees in the display-name field, then = authentication service policies necessarily will not prevent impersonation = - impersonators can always create accounts with the desired display-name in= a domain friendly or oblivious to their interests. What policies can do is= prevent a user within a domain from associating an inappropriate display-n= ame with a particular account. While this is no doubt helpful for certain k= inds of domain, it is of limited use in preventing the sorts of global impe= rsonation problems with which sip-identity is concerned. >=20 > A signature over the display-name has no intrinsic value from an imperson= ation-prevention perspective.=20 I disagree: it says at the very least that that display name is the one that the signer saw as it passed by its stamper. If it is not added to the hash, then you'll never know. As I've said repeatedly: people are whistling in the dark if they think that some sort of proscription in this draft, or withholding of signed bits, or whatever else is going to stop UA's from displaying the display name if it's there. They will, and you can count on that. In the end, not signing the display name so that you could conceivably disavow=20 that name later because you aren't able completely guarantee its veracity is so many angels on a pinhead: it makes no operational difference. We should err on the side of forensics here, not finger wagging at developers or careful parsing of what the meaning of "is" is. So, I disagree with this, and the general philosophy that picks winners and loser for the hash input. The more the merrier. Mike --=-1JtzVb2B61NxoEdf4IQS Content-Type: application/pgp-signature; name=signature.asc Content-Description: This is a digitally signed message part -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.3 (GNU/Linux) iQCVAwUAQm18nLMsDAj/Eq++AQLpJwP/WYUA7/Spvua5TshDP6EMlkOZiQc9FgR8 OSb0mIIthYtaJ5JVDMEqLByZ0U4s29KetYxc+itJGqpwHpi0Qhw3w+LohGC/OP7m 9ArzwbCTMCP6qOI/BowsHdTwmyWe0Y9+xoooi71zE0sc2t6gm72N4gvabnWy6q33 FWsU/vOALM4= =s3fe -----END PGP SIGNATURE----- --=-1JtzVb2B61NxoEdf4IQS-- --===============1005524588== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip --===============1005524588==-- From sip-bounces@ietf.org Mon Apr 25 19:57:55 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DQDSd-0005Df-Bl; Mon, 25 Apr 2005 19:57:55 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DQDSc-0005Da-1J for sip@megatron.ietf.org; Mon, 25 Apr 2005 19:57:54 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA12632 for ; Mon, 25 Apr 2005 19:57:50 -0400 (EDT) Received: from sj-iport-2-in.cisco.com ([171.71.176.71] helo=sj-iport-2.cisco.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DQDew-0000RQ-B0 for sip@ietf.org; Mon, 25 Apr 2005 20:10:39 -0400 Received: from sj-core-1.cisco.com (171.71.177.237) by sj-iport-2.cisco.com with ESMTP; 25 Apr 2005 16:57:44 -0700 Received: from edison.cisco.com (edison.cisco.com [171.71.180.109]) by sj-core-1.cisco.com (8.12.10/8.12.6) with ESMTP id j3PNvf2w012595; Mon, 25 Apr 2005 16:57:41 -0700 (PDT) Received: from dwingwxp ([10.32.131.89] (may be forged)) by edison.cisco.com (8.8.6 (PHNE_14041)/CISCO.SERVER.1.2) with ESMTP id QAA18894; Mon, 25 Apr 2005 16:57:41 -0700 (PDT) Message-Id: <200504252357.QAA18894@edison.cisco.com> From: "Dan Wing" To: "'Cullen Jennings'" , "'Jonathan Rosenberg'" , "'Jon Peterson'" Subject: RE: [Sip] Is Domain X using Identity problem Date: Mon, 25 Apr 2005 16:57:40 -0700 MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Office Outlook, Build 11.0.5510 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1441 Thread-Index: AcVHil/nwzxUFyrcSj6kyYb4ltqQ8wCZ7wLA In-Reply-To: X-Spam-Score: 0.0 (/) X-Scan-Signature: 69a74e02bbee44ab4f8eafdbcedd94a1 Content-Transfer-Encoding: 7bit Cc: sip@ietf.org X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org > On 3/6/05 1:30 PM, "Jonathan Rosenberg" wrote: > > As such, I think some kind of companion technique for "checking if > > domain X is using sip-identity" is needed. It need not be > > defined here, but it seems crucial to successful deployment of > > this. > > Imagine we had this. Consider the two cases: > > a) domain supports identity but I just got a message with no Identity > headers > > b) domain does not support it and I just got a message with > no Identity headers > > The type of authorization I might do for these two case are somewhat > different so I can see that this has some value. However, many of the > attacks and problems that you might hope to stop with having > this can still > be done by the attacker just using a domain that does not > support identity. > > Anyways, I can imagine a few ways to query this flag. > 1) DNS - keep the flag in DNS > 2) SIP - send an OPTIONS over TLS to the domain and get the flag > 3) HTTP - send a HTTP request to some well known location > > Option 2 has the advantage of an attacker not being able to spoof the > result. Option 1 has the advantage that it's quicker, can easily be cached locally, and we're relying on DNS already. The problem, however, with Option 1 is defining a new DNS resource record. I agree - go with 2. -d _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Mon Apr 25 22:03:37 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DQFQH-0006BK-9s; Mon, 25 Apr 2005 22:03:37 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DQFQF-0006B3-OY for sip@megatron.ietf.org; Mon, 25 Apr 2005 22:03:35 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA21567 for ; Mon, 25 Apr 2005 22:03:33 -0400 (EDT) Received: from serrano.cc.columbia.edu ([128.59.29.6] ident=cu41754) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DQFcb-0004lC-5m for sip@ietf.org; Mon, 25 Apr 2005 22:16:22 -0400 Received: from [192.168.0.31] (pool-141-153-174-47.mad.east.verizon.net [141.153.174.47]) (user=hgs10 mech=PLAIN bits=0) by serrano.cc.columbia.edu (8.13.0/8.13.0) with ESMTP id j3Q23Sxd018562 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT); Mon, 25 Apr 2005 22:03:33 -0400 (EDT) Message-ID: <426DA167.4030804@cs.columbia.edu> Date: Mon, 25 Apr 2005 22:03:19 -0400 From: Henning Schulzrinne Organization: Columbia University User-Agent: Mozilla Thunderbird 1.0 (Windows/20041206) X-Accept-Language: en-us, en MIME-Version: 1.0 To: Dale Worley Subject: Re: [Sip] Comments on draft-ietf-sip-resource-priority-08 References: <00eb01c549d8$bf290fb0$6a01010a@keywest> In-Reply-To: <00eb01c549d8$bf290fb0$6a01010a@keywest> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-No-Spam-Score: Local X-Scanned-By: MIMEDefang 2.48 on 128.59.29.6 X-Spam-Score: 3.2 (+++) X-Scan-Signature: 08170828343bcf1325e4a0fb4584481c Content-Transfer-Encoding: 7bit Cc: "Sip \(E-mail\)" X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org Thanks for your comments. James and I will address these when we incorporate the IETF last call comments. Given that the draft has been forwarded to the IESG, it seems procedurally easiest just to treat these and other comments that arrived after the WGLC as IETF LC comments. Dale Worley wrote: > A request went out for people to read > draft-ietf-sip-resource-priority-06 with fresh eyes. (I've since > updated this against version 08, which fixes a lot of the things I was > concerned about.) Since I'm new to the SIP world, I thought I'd try. > The disadvantage of my naivete is the terrible fear that I'm going to > bring up some issue that was discussed thoroughly in the past. But > the old timers can probably recognize and discard such issues a lot > faster than I can search to find them, so here goes... > _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Tue Apr 26 10:50:10 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DQRO6-0006zG-8p; Tue, 26 Apr 2005 10:50:10 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DQRO4-0006z1-M3 for sip@megatron.ietf.org; Tue, 26 Apr 2005 10:50:08 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA14288 for ; Tue, 26 Apr 2005 10:50:06 -0400 (EDT) Received: from [65.220.123.3] (helo=mail.pingtel.com) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DQRaW-0006CY-Tb for sip@ietf.org; Tue, 26 Apr 2005 11:03:02 -0400 Received: from keywest (hide.pingtel.com [65.220.123.2]) by mail.pingtel.com (Postfix) with SMTP id 8E31B6C01D for ; Tue, 26 Apr 2005 10:50:06 -0400 (EDT) From: "Dale Worley" To: "'Sip (E-mail)'" Subject: RE: [Sip] Comments on draft-ietf-sip-resource-priority-08 Date: Tue, 26 Apr 2005 10:46:46 -0400 Message-ID: <004601c54a6e$c5939a50$6a01010a@keywest> MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook CWS, Build 9.0.2416 (9.0.2910.0) In-Reply-To: <426DA167.4030804@cs.columbia.edu> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1441 Importance: Normal X-Spam-Score: 0.2 (/) X-Scan-Signature: 7bac9cb154eb5790ae3b2913587a40de Content-Transfer-Encoding: 7bit X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org > From: Henning Schulzrinne [mailto:hgs@cs.columbia.edu] > > Given that the draft has been > forwarded to the IESG, it seems procedurally easiest just to treat these > and other comments that arrived after the WGLC as IETF LC comments. Ah, thanks. I don't know what the protocol is for these things. Dale _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Tue Apr 26 13:09:10 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DQTYc-0003Dw-BA; Tue, 26 Apr 2005 13:09:10 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DQTYb-0003Dr-41 for sip@megatron.ietf.org; Tue, 26 Apr 2005 13:09:09 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA26944 for ; Tue, 26 Apr 2005 13:09:06 -0400 (EDT) Received: from oak.neustar.com ([209.173.53.70]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DQTl3-0001tN-JK for sip@ietf.org; Tue, 26 Apr 2005 13:22:03 -0400 Received: from stntsmtp1.cis.neustar.com (smartexch.neustar.com [10.31.13.79]) by oak.neustar.com (8.12.8/8.11.0) with ESMTP id j3QH8qKD009454; Tue, 26 Apr 2005 17:08:52 GMT Received: from stntexch03.cis.neustar.com ([10.31.13.45]) by stntsmtp1.cis.neustar.com with Microsoft SMTPSVC(6.0.3790.211); Tue, 26 Apr 2005 13:08:52 -0400 X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Subject: RE: [Sip] closure on display-names & sip-identity Date: Tue, 26 Apr 2005 13:08:52 -0400 Message-ID: <24EAE5D4448B9D4592C6D234CBEBD59701502E6F@stntexch03.cis.neustar.com> Thread-Topic: [Sip] closure on display-names & sip-identity Thread-Index: AcVJ7jL2+wm1fZ+zSTqHKOcYGf5e1wAkv8uQ From: "Peterson, Jon" To: "Michael Thomas" X-OriginalArrivalTime: 26 Apr 2005 17:08:52.0430 (UTC) FILETIME=[9F0906E0:01C54A82] X-Spam-Score: 0.0 (/) X-Scan-Signature: 7aafa0432175920a4b3e118e16c5cb64 Content-Transfer-Encoding: quoted-printable Cc: sip@ietf.org X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org > I disagree: it says at the very least that that display name is the = one > that the signer saw as it passed by its stamper. If it is not added to > the hash, then you'll never know. If man-in-the-middle attacks were the concern of the draft, I would = agree with you - but they are not. This draft sets out to beat trivial = >From header forgery, not attackers with the capability to capture and = modify signaling in passing. There are other SIP mechanisms that address = those sorts of attacks. > As I've said repeatedly: people are whistling in the dark if they = think > that some sort of proscription in this draft, or withholding of signed > bits, or whatever else is going to stop UA's from displaying the = display > name if it's there. They will, and you can count on that. In the end, > not signing the display name so that you could conceivably disavow=20 > that name later because you aren't able completely guarantee its > veracity is so many angels on a pinhead: it makes no operational > difference. We should err on the side of forensics here, not finger > wagging at developers or careful parsing of what the meaning of > "is" is. I don't think anyone believes bits are going to "stop" UAs from = displaying the display-name. I think there has been some reasoned = argument from a number of parties that UAs might not use the = display-name anyway under various circumstances. The important deciding = points about all of this are how useful a display-name is to a verifier = in actually defeating impersonation. I have not seen much by way of = argument as to why signatures over display-names are actually important = to verifiers.=20 > So, I disagree with this, and the general philosophy that picks > winners and loser for the hash input. The more the merrier.=20 Regardless of whether the draft picks winners and losers, discussion of = the security effects of signing one thing or another is warranted and in = my opinion necessary. If you leave it completely to application = developers or deployers/users of the technology to decide what should = and shouldn't be signed, I think it is likely that people will come to = different opinions, and that the mechanism will therefore be used in = ways that have different strength, which are in turn potentially = unacceptable to some recipients, and so on. If we don't at least do the = analysis now, they will have to do it later, and some of them might not = be in a position to do it adequately. I don't think this is a feature. Jon Peterson NeuStar, Inc. >=20 > Mike >=20 _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip From sip-bounces@ietf.org Thu Apr 28 12:16:23 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DRBb8-0007un-9N; Thu, 28 Apr 2005 12:10:42 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DRBb6-0007uf-GK for sip@megatron.ietf.org; Thu, 28 Apr 2005 12:10:40 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA00410 for ; Thu, 28 Apr 2005 12:10:37 -0400 (EDT) From: Udit_Goyal@3com.com Received: from ahmler5.mail.eds.com ([192.85.154.70]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DRBnz-00015V-Eu for sip@ietf.org; Thu, 28 Apr 2005 12:23:59 -0400 Received: from ahmlir1.mail.eds.com (ahmlir1-2.mail.eds.com [192.85.154.131]) by ahmler5.mail.eds.com (8.13.2/8.12.10) with ESMTP id j3SGA9rE004914; Thu, 28 Apr 2005 12:10:10 -0400 Received: from ahmlir1.mail.eds.com (localhost [127.0.0.1]) by ahmlir1.mail.eds.com (8.13.2/8.12.10) with ESMTP id j3SG9TME018040; Thu, 28 Apr 2005 12:09:29 -0400 Received: from usut001.3com.com ([205.142.126.149]) by ahmlir1.mail.eds.com (8.13.2/8.12.10) with ESMTP id j3SG9Tim018035; Thu, 28 Apr 2005 12:09:29 -0400 To: "SIP Implementors" , "SIP IETF" MIME-Version: 1.0 X-Mailer: Lotus Notes Release 6.5.2 June 01, 2004 Message-ID: Date: Thu, 28 Apr 2005 12:15:23 -0400 X-MIMETrack: Serialize by Router on USUT001/US/3Com(Release 6.0.3|September 26, 2003) at 04/28/2005 09:09:29 AM, Serialize complete at 04/28/2005 09:09:29 AM X-Spam-Score: 0.8 (/) X-Scan-Signature: 5a9a1bd6c2d06a21d748b7d0070ddcb8 Cc: Subject: [Sip] Via header X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============1008986305==" Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org This is a multipart message in MIME format. --===============1008986305== Content-Type: multipart/alternative; boundary="=_alternative 0058B31485256FF1_=" This is a multipart message in MIME format. --=_alternative 0058B31485256FF1_= Content-Type: text/plain; charset="US-ASCII" Hi, Conside a case where UAC uses different UDP sockets for listening and sending SIP requests, i.e it is listening on port 5060, but when it sends request, it uses ephemeral UDP port. When this UAC sends INVITE request, it will contain Via header containing the IP address and port number 5060 in sent-by field But the UDP source port number will be different (IP address will be same) as it had used UDP ephemeral port for sending that request. Now when proxy receives this request, it will check for IP address, since it is same it will not add "received" parameter. However, port numbers are different, should it add "rport" parameter ?? but this is not case of firewall.. or proxy only check for port when the IP addresses are different ?? Also, is it necessary for UA to send requests from the same socket ?? Regards, Udit --=_alternative 0058B31485256FF1_= Content-Type: text/html; charset="US-ASCII"
Hi,

Conside a case where UAC uses different UDP sockets for listening and sending SIP requests,
i.e it is listening on port 5060, but when it sends request, it uses ephemeral UDP port.

When this UAC sends INVITE request, it will contain Via header containing the IP address and port number 5060 in sent-by field
But the UDP source port number will be different (IP address will be same) as it had used UDP ephemeral port for sending that request.

Now when proxy receives this request, it will check for IP address, since it is same it will not add "received" parameter. However, port numbers are different, should it add "rport" parameter ?? but this is not case of firewall..
or proxy only check for port when the IP addresses are different ??

Also, is it necessary for UA to send requests from the same socket ??

Regards,
Udit --=_alternative 0058B31485256FF1_=-- --===============1008986305== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip --===============1008986305==-- From sip-bounces@ietf.org Fri Apr 29 12:32:51 2005 Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DRYQ7-0006iT-SI; Fri, 29 Apr 2005 12:32:51 -0400 Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1DRYQ6-0006iO-VY for sip@megatron.ietf.org; Fri, 29 Apr 2005 12:32:50 -0400 Received: from ietf-mx.ietf.org (ietf-mx.ietf.org [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA12461 for ; Fri, 29 Apr 2005 12:32:48 -0400 (EDT) Received: from ausmtp01.au.ibm.com ([202.81.18.186]) by ietf-mx.ietf.org with esmtp (Exim 4.33) id 1DRYdB-0003u0-NS for sip@ietf.org; Fri, 29 Apr 2005 12:46:23 -0400 Received: from sd0112e0.au.ibm.com (d23rh903.au.ibm.com [202.81.18.201]) by ausmtp01.au.ibm.com (8.12.10/8.12.10) with ESMTP id j3TGYu4q246490 for ; Sat, 30 Apr 2005 02:34:56 +1000 Received: from d23av03.au.ibm.com (d23av03.au.ibm.com [9.190.250.244]) by sd0112e0.au.ibm.com (8.12.10/NCO/VER6.6) with ESMTP id j3TGZLjc093416 for ; Sat, 30 Apr 2005 02:35:21 +1000 Received: from d23av03.au.ibm.com (loopback [127.0.0.1]) by d23av03.au.ibm.com (8.12.11/8.13.3) with ESMTP id j3TGWbtl009135 for ; Sat, 30 Apr 2005 02:32:37 +1000 Received: from d23m0037.cn.ibm.com (d23m0037.cn.ibm.com [9.181.2.105]) by d23av03.au.ibm.com (8.12.11/8.12.11) with ESMTP id j3TGWaiQ009123 for ; Sat, 30 Apr 2005 02:32:36 +1000 From: Xiao Peng Chen To: sip@ietf.org Message-ID: Date: Sat, 30 Apr 2005 00:34:07 +0800 X-MIMETrack: Serialize by Router on D23M0037/23/M/IBM(Build V70_M4_01112005 Beta 3|January 11, 2005) at 04/30/2005 00:34:09 MIME-Version: 1.0 X-Spam-Score: 0.0 (/) X-Scan-Signature: de4f315c9369b71d7dd5909b42224370 Subject: [Sip] Xiao Peng Chen is out of the office. X-BeenThere: sip@ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Session Initiation Protocol List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============0256833045==" Sender: sip-bounces@ietf.org Errors-To: sip-bounces@ietf.org --===============0256833045== Content-type: multipart/alternative; Boundary="0__=C7BBE561DFC8854B8f9e8a93df938690918cC7BBE561DFC8854B" Content-Disposition: inline --0__=C7BBE561DFC8854B8f9e8a93df938690918cC7BBE561DFC8854B Content-type: text/plain; charset=US-ASCII I will be out of the office starting 2005-04-29 and will not return until 2005-05-09. I will respond to your message when I return. --0__=C7BBE561DFC8854B8f9e8a93df938690918cC7BBE561DFC8854B Content-type: text/html; charset=US-ASCII Content-Disposition: inline

I will be out of the office starting 2005-04-29 and will not return until 2005-05-09.

I will respond to your message when I return. --0__=C7BBE561DFC8854B8f9e8a93df938690918cC7BBE561DFC8854B-- --===============0256833045== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Sip mailing list https://www1.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use sip-implementors@cs.columbia.edu for questions on current sip Use sipping@ietf.org for new developments on the application of sip --===============0256833045==--