Subject: RE: [Sip] Bis-5: TLS as secure transport for SIP

From: Jonathan Rosenberg <[email-masked]>
Date: Mon, 5 Nov 2001 18:30:54 -0500

-----Original Message-----
From: Shieh, Hugh [mailto:[email-masked]]
Sent: Monday, November 05, 2001 1:21 PM
To: 'Peterson, Jon'; 'Shieh, Hugh'; [email-masked]'
Subject: RE: [Sip] Bis-5: TLS as secure transport for SIP

>See
>The characterization of TLS as a transport protocol "like TCP and UDP"
derives first and 
>foremost from the fact that 'tls' is a valid token that can appear in the
'transport-
>param' parameter of a URL (as can 'udp', 'tcp' or 'sctp') or
'sent-protocol' field of a Via 
>header. SIP-over-TLS has an assigned port (5061). It is assumed in the SIP
standard (as it 
>is elsewhere in Internet standards) that TLS is running over TCP. The
authors of bis are 
>aware that TLS does not run over UDP.
>
>[Shieh, Hugh]  Will the authors of bis recommend a secure transport for
UDP? Or by 
>recommending TLS, the authors recommend TCP instead of UDP as the
recommended SIP transport 
>protocol?

In the case of secured interconnects between proxies that have some kind of
administratively agreed upon security relationship, I don't see a whole lot
of reason for UDP as opposed to TCP. The connections can be set up ahead of
time, or on the first call, and then reused as needed. I am sure people will
dredge up the old HOL blocking issues with TCP. I still am waiting for
specific analysis on the impact on sip call set up time distributions. That
said, TLS over SCTP would be another option, but is not specified as far as
I know.

-Jonathan R.

---
Jonathan D. Rosenberg, Ph.D.                72 Eagle Rock Ave.
Chief Scientist                             First Floor
dynamicsoft                                 East Hanover, NJ 07936
[email-masked]                     FAX:   (973) 952-5050
http://www.jdrosen.net                      PHONE: (973) 952-5000
http://www.dynamicsoft.com

_______________________________________________
Sip mailing list  http://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: Allison Mankin <[email-masked]>
Date: Mon, 05 Nov 2001 18:49:02 -0500

> That said, TLS over SCTP would be another option, but is not specified 
> as far as I know.

draft-tuexen-tsvwg-tls-over-sctp-00.txt

A chartered work item in TSVWG - new draft was expected...

------

---

From: Michael Thomas <[email-masked]>
Date: Mon, 5 Nov 2001 16:03:56 -0800 (PST)

> said, TLS over SCTP would be another option, but is not specified as far as

   TLS requires 4 messages, and TCP requires 3
   so it's 7 messages before an application can
   send data. With KINK, the application starts
   sending data after the second message is
   received, eliminating 5 messages or so. If
   you require TCP or SCTP, it goes up to 5.

	       Mike

---

From: "Henning G. Schulzrinne" <[email-masked]>
Date: Mon, 05 Nov 2001 18:55:32 -0500

Jonathan Rosenberg wrote:

> dredge up the old HOL blocking issues with TCP. I still am waiting for

Gonzalo Camarillo has done a number of simulations on this here at
Columbia; he should summarize the details, but my summary is "you have
to try really, really hard for it to make a difference".

-- 
Henning Schulzrinne   http://www.cs.columbia.edu/~hgs

---

From: Gonzalo Camarillo <[email-masked]>
Date: Wed, 21 Nov 2001 23:03:01 +0200

Hi,

> to try really, really hard for it to make a difference".

Yes, HOL becomes important when your queuing delay is anyway
unacceptable. That is, when you have enough timeouts to make HOL
statistically significant even SCTP cannot manage to provide a
low-enough queuing delay.

Therefore, under moderate packet loss, you do not have a noticeable
difference between TCP and SCTP.

Regards,

Gonzalo

-- 
Gonzalo Camarillo                    Phone :   +1 212 939 71 71
Columbia University                  Mobile:  +358 40 702 35 35
472 Computer Science Building        Fax   :  +358  9 299 30 52
1214 Amsterdam Ave., Mail Code 0401  http://www.hut.fi/~gonzalo
New York, NY 10027                   
USA                              [email-masked]