Subject: [Sip] Example call flows using S/MIME and TLS

From: Cullen Jennings <[email-masked]>
Date: Sun, 19 Oct 2003 21:19:42 -0700

I have submitted an ID with example call flows that use TLS and S/MIME.
Until it shows up in the drafts directory, you can find it at:

http://www.employees.org/~fluffy/ietf/draft-jennings-sip-sec-flows-00.html

Or

http://www.employees.org/~fluffy/ietf/draft-jennings-sip-sec-flows-00.txt

Cullen

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: "Udi Tirosh (Weintrob)" <[email-masked]>
Date: Mon, 20 Oct 2003 10:03:52 +0200

Hi,
I have looked at the examples with great interest, I think some more
clarifications are needed in the area of a) connection breaking and b) the
usage of mutual authentication and post connection assertions. I will try
and describe the difficulties I am seeing:

A. connection breaking:
Lets assume that UA a.example.com (A) is connecting to it's proxy
p.example.com (P) over TLS. the certificate mechanism combined with post
connection assertion does prove to the A that P is "ok". but TCP, on which
TLS is build might be broken. in RFC 3261 (18.2.2) it is stated that:
        "If that
         connection is no longer open, the server SHOULD open a
         connection to the IP address in the "received" parameter, if
         present, using the port in the "sent-by" value, or the default
         port for that transport, if no port is specified.  If that
         connection attempt fails, the server SHOULD use the procedures
         in [4] for servers in order to determine the IP address and
         port to open the connection and send the response to."
So P should open a new TLS connection to send the response to the A. Now,
for that to work over TLS, A must have a certificate. More over, as I
understand it the client will have no means to "post connection assert"  the
connection and the responses will arrive unverified. 

B. mutual authentication between proxies.
What is the best way for two proxies to use a bi directional TLS
communication?
Option 1: the proxies will open  a TLS connection using mutual
authentication, but this way only one of the proxies (the one that initiated
the connection) will be able to post connection assert.

Option 2: each proxy will open a TLS connection to the other proxy. and post
connect assert on this connection. but now we have 2 open connection rather
than 1.

I will appreciate some more input on those matters.
Regards,
Udi.

-----Original Message-----
From: Cullen Jennings [mailto:[email-masked]]
Sent: Monday, October 20, 2003 6:20 AM
To: [email-masked]
Cc: Cullen Jennings
Subject: [Sip] Example call flows using S/MIME and TLS
Importance: High

Or

Cullen