Subject: RE: [Sip] Bis-5: TLS as secure transport for SIP

From: Jonathan Rosenberg <[email-masked]>
Date: Fri, 9 Nov 2001 00:45:46 -0500

> -----Original Message-----
> From: Michael Thomas [mailto:[email-masked]]
> Sent: Thursday, November 08, 2001 12:53 PM
> To: Jonathan Rosenberg
> Cc: 'Tuexen Michael'; [email-masked]'; [email-masked];
> [email-masked]; [email-masked]
> Subject: RE: [Sip] Bis-5: TLS as secure transport for SIP 
> 
> 
> Jonathan Rosenberg writes:
>  > One thing on this draft... you run TLS over each stream 
> separately. Whilst
>  > it makes sense, it is really awful for applications that 
> use lots of
>  > streams. It would be nice to be able to protect the entire 
> association with
>  > a single TLS connection.
> 
>    You strive for IPsec, Grasshopper. :-)

Well, I'm not a big fan as folks are aware, but this mode of operation of
TLS over SCTP is not useful, so I guess there isn't much other choice
besides IPSec. One of the big benefits of streams, IMHO, is that you don't
need to signal to use them. But, now I do if tls is used. 

-Jonathan R.

---
Jonathan D. Rosenberg, Ph.D.                72 Eagle Rock Ave.
Chief Scientist                             First Floor
dynamicsoft                                 East Hanover, NJ 07936
[email-masked]                     FAX:   (973) 952-5050
http://www.jdrosen.net                      PHONE: (973) 952-5000
http://www.dynamicsoft.com

_______________________________________________
Sip mailing list  http://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: Michael Thomas <[email-masked]>
Date: Fri, 9 Nov 2001 08:54:15 -0800 (PST)

> need to signal to use them. But, now I do if tls is used. 

   I think that your outlook depends a great deal
   on where you stand on the setup latency axis.
   If you don't think that's a problem at all, then
   just about anything secure would be adequate (modulo
   UDP). If you do care -- as I do -- there's a
   continuum of more and less heinous possibilities:

   IPsec/IKE
   TLS
   IPsec/KINK
   Per-message authenticated SIP (app layer)

   The last doesn't exist in any real usable form,
   though there's nothing in principle from us
   doing the engineering. 

   Another axis is the necessity for public
   operations. IKE and TLS pretty much force
   you to do initial DH's (RFC 2712 aside) 
   which are always a consideration. PDD could
   be severely affected, which cause a lot of
   people heartburn.

	  Mike