Subject: RE: [Sip] SCTP and TLS

From: "Amit Bhadoria" <[email-masked]>
Date: Fri, 21 Nov 2003 12:47:55 -0800

Isn't it "sips:user@domain;transport=sctp"?

--
Amit Bhadoria
Software Engineer
http://www.cisco.com 

-----Original Message-----
From: Cullen Jennings [mailto:[email-masked]] 
Sent: Thursday, November 20, 2003 9:10 PM
To: [email-masked]
Subject: [Sip] SCTP and TLS

How do you indicate that you want to use SCTP and TLS (assuming a TLS
profile for SCTP ...)

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: Cullen Jennings <[email-masked]>
Date: Fri, 21 Nov 2003 14:08:30 -0800

This will work in some cases where you want to insist that all hops use TLS
but if you don't care about that you need something like

transport=sctp+tls

---

From: "Vijay K. Gurbani" <[email-masked]>
Date: Fri, 21 Nov 2003 16:59:31 -0600

Cullen Jennings wrote:

> This will work in some cases where you want to insist that all hops 
> use TLS but if you don't care about that you need something like
> 
> transport=sctp+tls

Cullen:

Where are you heading with this...?  Do you forsee cases
where the SIP message travels encrypted over portions of the
network and in clear over others?  I would presume that once
a user specifically chose a sips URI, all hops in between need
to be secure.  No?

- vijay
-- 
Vijay K. Gurbani  vkg@{lucent.com,research.bell-labs.com,acm.org}
Wireless Networks Group/Internet Software and Services
Lucent Technologies/Bell Labs Innovations, 2000 Lucent Lane, Rm 6G-440
Naperville, Illinois 60566     Voice: +1 630 224 0216

---

From: Cullen Jennings <[email-masked]>
Date: Fri, 21 Nov 2003 16:14:52 -0800

> a user specifically chose a sips URI, all hops in between need

Well I very well might phone you with a sip URL because I am not sure you
support TLS, however, my preference is TLS and I use TLS over TCP from my UA
to my proxy. My proxy does SCTP with TLS to your proxy. And your proxy does
UDP over IPSEC to you. A sips would have failed but a sip works and still
allows TLS to be used for much of the network.

The whole topic is not a big deal, we just need something with the semantic
meeting of transport=sctp+tls in the draft. I don't care what the sysntax
is. It could be transport=sctps.

---

From: "Vijay K. Gurbani" <[email-masked]>
Date: Mon, 24 Nov 2003 09:49:04 -0600

Cullen Jennings wrote:
> Well I very well might phone you with a sip URL because I am not sure
> you support TLS, however, my preference is TLS and I use TLS over TCP
> from my UA to my proxy. My proxy does SCTP with TLS to your proxy.
> And your proxy does UDP over IPSEC to you. A sips would have failed
> but a sip works and still allows TLS to be used for much of the
> network.
> 
> The whole topic is not a big deal, we just need something with the
> semantic meeting of transport=sctp+tls in the draft. I don't care
> what the sysntax is. It could be transport=sctps.

OK, I see.

However, couple of observations.  I seem to recall that
"transport=tls" was deprecated in favor of the sips URI which
implies it.  Second, from your description, is seems to me that
the caller is indicating a preference that says "even though the
R-URI is a sip URI, use TLS over any transport {SCTP, TCP}
wherever possible".

Logically, this could be qualified as a caller pref
since it gives guidance to intermediaries on how to handle
the request.  But since draft-ietf-sip-callerpref-10 is in
last call, I don't think it has any chance of being included
in it.

I am unsure where is the best place to indicate these
semantics: in the transport parameter of the R-URI or a new
header.  I lean towards the latter.

- vijay