Subject: Security and SIP

From: "Jerry Teahan" <[email-masked]>
Date: Mon, 1 Nov 1999 11:30:05 -0000

Where can I find out more about security and SIP.
H.323 uses 235 but what does SIP use ?
thanks
Jerry

---

From: Jonathan Rosenberg <[email-masked]>
Date: Mon, 01 Nov 1999 09:55:47 -0500

SIP security is specified within the SIP spec itself, RFC2543. The
security mechanisms include basic and digest authentication (based 
on http) and PGP for both encryption, authentication, and proxy
authentication.

-Jonathan R.

> Jerry Teahan wrote:

-- 
Jonathan D. Rosenberg                       200 Executive Drive
Chief Scientist                             Suite 210 
dynamicsoft                                 West Orange, NJ 07052
[email-masked]                     FAX:   (732) 741-4778
http://www.cs.columbia.edu/~jdrosen         PHONE: (732) 741-7244
http://www.dynamicsoft.com

---

From: Michael Thomas <[email-masked]>
Date: Wed, 3 Nov 1999 06:04:10 -0800 (PST)

I am skeptical that the current SIP spec will be
sufficient for a carrier class solution. There are
at least two big problems:

1) Restart avalanches at proxy's
2) PDD using DH-like schemes in the call path

(1) Probably ought to look at the packetcable
solution using PKINIT Kerberos.

(2) somewhat implies that in order to improve the
PDD, the proxy must broker e-2-e key distribution
if the flows is:

SIP->SIPProxy-o->SIPProxy-t->SIP 

which later leads to 

SIP->SIP 

to complete the call. The later is problematic
because you cannot have a fully meshed topology of
SA's for the SIP endpoints, even though you can
have a star topology with the SIP's to their
proxy's (well, that's the theory in very high
fanout at least).

Naively,  SIP->SIP would probably want to do some
sort of ephemeral-ephemeral DH exchange, and
maybe a certificate exchange which is pretty
slow. If we take advantage of the transitive
trust relationship between the SIP's and their
proxy's, we can broker a shared secret for the
e-2-e signaling.

This isn't to say that you'd *always* want to
make that tradeoff -- we certainly shouldn't
preclude the SIP's paying the PDD penalty if
they want to keep their service provider out
of their business (and by extention, LEA's).
However, this is probably a reasonable extention
in cases where PDD (and, perhaps CALEA) are
concerns.

			Mike