Subject: RE: [Sip] Bis-5: TLS as secure transport for SIP

From: Jonathan Rosenberg <[email-masked]>
Date: Tue, 6 Nov 2001 01:08:11 -0500

> -----Original Message-----
> From: Michael Thomas [mailto:[email-masked]]
> Sent: Monday, November 05, 2001 7:04 PM
> To: Jonathan Rosenberg
> Cc: 'Shieh, Hugh'; 'Peterson, Jon'; [email-masked]'
> Subject: RE: [Sip] Bis-5: TLS as secure transport for SIP
> 
> 
> Jonathan Rosenberg writes:
>  > In the case of secured interconnects between proxies that 
> have some kind of
>  > administratively agreed upon security relationship, I 
> don't see a whole lot
>  > of reason for UDP as opposed to TCP. The connections can 
> be set up ahead of
>  > time, or on the first call, and then reused as needed. I 
> am sure people will
>  > dredge up the old HOL blocking issues with TCP. I still am 
> waiting for
>  > specific analysis on the impact on sip call set up time 
> distributions. That
>  > said, TLS over SCTP would be another option, but is not 
> specified as far as
>  > I know.
> 
>    TLS requires 4 messages, and TCP requires 3
>    so it's 7 messages before an application can
>    send data. With KINK, the application starts
>    sending data after the second message is
>    received, eliminating 5 messages or so. If
>    you require TCP or SCTP, it goes up to 5.

Since these are effectively pre-established and "nailed-up" connections
(re-established under failure cases, of course), the amount of messages to
set them up does not seem important.

-Jonathan R.

---
Jonathan D. Rosenberg, Ph.D.                72 Eagle Rock Ave.
Chief Scientist                             First Floor
dynamicsoft                                 East Hanover, NJ 07936
[email-masked]                     FAX:   (973) 952-5050
http://www.jdrosen.net                      PHONE: (973) 952-5000
http://www.dynamicsoft.com

_______________________________________________
Sip mailing list  http://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: Michael Thomas <[email-masked]>
Date: Tue, 6 Nov 2001 06:41:25 -0800 (PST)

> set them up does not seem important.

   I don't know why we should make any such assumption.
   That's fine for talking to your proxy, but what if
   I just look them up with DNS? What if it's proxy
   routed for the initial invite, but direct afterward?
   Also: even with your proxy, given the number of SA's,
   you might want to make the space/time tradeoff of
   using short lived SA's to save state on a large proxy.

	       Mike

---

From: Jari Arkko <[email-masked]>
Date: Tue, 06 Nov 2001 16:59:50 +0200

> set them up does not seem important.

Could be fine in a fixed LAN environment, but think
mobile! If I roam under a different proxy, I need
to establish a new connection.

Jari