Subject: [SIP] Need for encrypted VoIP and Conferencing communications

From: "Fleischman, Eric W" <[email-masked]>
Date: Thu, 22 Feb 2001 13:53:17 -0800

Draft-ietf-sip-privacy-00.txt states that for SIP to be a viable alternative to the current PSTN, SIP must support certain popular telephony services offering privacy. However, the draft does not address a SIP privacy need having a substantially more compelling business case (for many industries) than the services identified by this draft.

Specifically, if Internet-based collaboration, including VoIP, is to replace traditional telephony alternatives, including H.323-based conferencing, it is imperative that sessions initiated by SIP be optionally encrypted to ensure privacy protection. The requirement is that the parties participating in a session must be known to the other session participants, but that it be physically impossible for non-participants to eavesdrop upon that session, including thwarting all "man in the middle" exploits. The obvious approach by which this can be done is to define a "session encryption" alternative within SDP and a standard mechanism for encrypting traffic carried by RTP. It isn't clear to me whether SIP needs to be aware of the encrypted nature of this traffic or not, hence this query to this mail list: Does SIP need visibility into whether the session transports encrypt their data or not? 

A related question is: where should the encryption be done? Should it be done at the IPSec layer in a manner potentially transparent to the higher level protocols or should it be done at data level being conveyed by RTP -- or at some other layer? I would be very appreciative to learn what work, if any, members of this list have done to investigate these types of issues.

_______________________________________________
This list is for continuing development of the SIP protocol.
The sip-implementor's list is the place to discuss implementation,
and to receive advice on understanding existing sip.
To subscribe to it, send mail to 
[email-masked] with "subscribe" in the body.