Subject: [Ecrit] ECRIT Framework: Security

From: Hannes Tschofenig <[email-masked]>
Date: Sun, 30 Mar 2008 17:06:26 +0300

You write:

"
IPSEC [RFC2401] is an
   acceptable alternative to TLS when used with an equivalent crypto
   suite.
"

I guess you mean that IPsec **between proxies** provides equivalent 
security compared to TLS.
I don't think you suggest to run IPsec from the end host to the proxy

You write:
"
   Location may be used for routing by multiple proxy servers on the
   path.  Confidentiality mechanisms such as S/MIME encryption of SIP
   signaling [RFC3261] cannot be used because they obscure location.
   Only hop-by-hop mechanisms such as TLS should be used.  Many SIP
   devices do not support TLS.  Implementing location conveyance in SIP
   mandates inclusion of TLS support.
"

You might want to be a bit more specific. S/MIME encryption of PIDF-LOs 
must not be used when
proxies are supposed to perform location based routing. They need to be 
able to inspect the PIDF-LO in order todo their job.

Delete " Many SIP devices do not support TLS." since it does not add too 
much value here.

_______________________________________________
Ecrit mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ecrit

---

From: "Brian Rosen" <[email-masked]>
Date: Sun, 30 Mar 2008 14:25:34 -0400

I certainly wouldn't think it was all that common, but IPsec would work
between a proxy and a UA, right?

With regard to "Many SIP devices...", despite the fact that 3261 says they
should, many UAs don't.  That's a fact.  We need them to in order to handle
location privacy.  I think it's worth pointing that out.  This is requesting
a change in implementations.

Brian

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of
Hannes Tschofenig
Sent: Sunday, March 30, 2008 10:06 AM
To: [email-masked]
Subject: [Ecrit] ECRIT Framework: Security

You write:

"
IPSEC [RFC2401] is an

You write:
"

---

From: "Stark, Barbara" <[email-masked]>
Date: Mon, 31 Mar 2008 09:07:38 -0400

Most proposals I've seen for future "dual mode" phones with Wi-Fi
connectivity are that the phone establishes an IPsec session to the
cellular carrier. I want to make sure that we don't in any way reject or
restrict this solution by mandating that TLS is the only way to achieve
secure signaling. IPsec meets the real requirement of providing
encrypted signaling. And, unlike the TLS proposal, it also provides
encryption of the RTP stream.
Barbara

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf
Of Brian Rosen
Sent: Sunday, March 30, 2008 2:26 PM
To: 'Hannes Tschofenig'; [email-masked]
Subject: Re: [Ecrit] ECRIT Framework: Security

With regard to "Many SIP devices...", despite the fact that 3261 says
they
should, many UAs don't.  That's a fact.  We need them to in order to
handle
location privacy.  I think it's worth pointing that out.  This is
requesting
a change in implementations.

Brian

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf
Of
Hannes Tschofenig
Sent: Sunday, March 30, 2008 10:06 AM
To: [email-masked]
Subject: [Ecrit] ECRIT Framework: Security

You write:

"
IPSEC [RFC2401] is an

You write:
"

much value here.

*****

The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential, proprietary, and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete the material from all computers. GA623