Subject: [Sip] draft of broad requirements for VoIP security

From: "Eric Nielsen" <[email-masked]>
Date: Sat, 16 Nov 2002 09:57:53 -0800

The draft draft-jacobs-signaling-security-requirements-00.txt 
 
http://www.ietf.org/internet-drafts/draft-jacobs-signaling-security-requirem
ents-00.txt 
attempts to define the body of security requirements 
that must be dealt with in order to carrier-scale VoIP
deployments. The requirements are generic, and are not 
written relative to specific threats. 

We wrote the draft at the suggestion of Jeff Schiller as 
a way to get the IETF community to identify what existing 
security mechanisms exist that can provide the type of 
authentication necessary for using SIP, MGCP and Megaco in
real carrier type deployments. This was a direct result of
our own pursuit a light-weight key distribution mechanism. 

A significant issue for this draft is that the requirements 
do not neatly fit into any one WG charter. I believe this 
is more of a security issue than an application level 
issue. However, the SIP WG has done more to deal with 
security than other application level WGs. Security it is 
an essential part of VoIP, and SIP already includes many of 
the needed features. Thus we are posting this note here.

The goal of this draft is to get agreement on the broader 
requirements, followed by an determining what gaps there 
are between what exists and what is needed. Obviously if 
we could see a full solution, we would not be pursuing this.
For example, common usage of current technology leads to 
poor practices in handling keying material. The technology 
must be defined so that it is possible to define simple and 
secure common practices.

We would like to work to get agreement on the requirements, 
as well as how to best meet them.

Thank you,

Eric Nielsen
Sylantro Systems

Stuart Jacobs CISSP 
Verizon Laboratories 

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip