Subject: [Sip] I-D ACTION:draft-ietf-sip-identity-06.txt

From: [email-masked]
Date: Wed, 26 Oct 2005 18:50:02 -0400

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Session Initiation Protocol Working Group of the IETF.

	Title		: Enhancements for Authenticated Identity Management in the Session Initiation Protocol (SIP)
	Author(s)	: J. Peterson, C. Jennings
	Filename	: draft-ietf-sip-identity-06.txt
	Pages		: 42
	Date		: 2005-10-26
	
The existing security mechanisms in the Session Initiation Protocol
   are inadequate for cryptographically assuring the identity of the end
   users that originate SIP requests, especially in an interdomain
   context.  This document defines a mechanism for securely identifying
   originators of SIP messages.  It does so by defining two new SIP
   header fields, Identity, for conveying a signature used for
   validating the identity, and Identity-Info, for conveying a reference
   to the certificate of the signer.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-sip-identity-06.txt

To remove yourself from the I-D Announcement list, send a message to 
[email-masked] with the word unsubscribe in the body of the message.  
You can also visit https://www1.ietf.org/mailman/listinfo/I-D-announce 
to change your subscription settings.

Internet-Drafts are also available by anonymous FTP. Login with the username
"anonymous" and a password of your e-mail address. After logging in,
type "cd internet-drafts" and then
	"get draft-ietf-sip-identity-06.txt".

A list of Internet-Drafts directories can be found in
http://www.ietf.org/shadow.html 
or ftp://ftp.ietf.org/ietf/1shadow-sites.txt

Internet-Drafts can also be obtained by e-mail.

Send a message to:
	[email-masked].
In the body type:
	"FILE /internet-drafts/draft-ietf-sip-identity-06.txt".
	
NOTE:	The mail server at ietf.org can return the document in
	MIME-encoded form by using the "mpack" utility.  To use this
	feature, insert the command "ENCODING mime" before the "FILE"
	command.  To decode the response(s), you will need "munpack" or
	a MIME-compliant mail reader.  Different MIME-compliant mail readers
	exhibit different behavior, especially when dealing with
	"multipart" MIME messages (i.e. documents which have been split
	up into multiple messages), so check your local documentation on
	how to manipulate these messages.

Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.
_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: Hans Persson <[email-masked]>
Date: Fri, 28 Oct 2005 15:05:08 +0200

> http://www.ietf.org/internet-drafts/draft-ietf-sip-identity-06.txt

A couple of nits on the -06 version:

[Section 4]
>    When Bob's domain receives the request, it verifies the signature
>    provided in the Identity header, and thus can validates that the
>    domain indicated by the host portion of the AoR in the From header
>    field authenticated the user, and permitted them to assert that From
>    header field value.  This same validation operation may be performed
>    by Bob's UAS.

"validates" on line 2 should be "validate".

[Section 9]
>    This document specifies two new SIP headers: Identity and Identity-
>    Info.  Each of these headers can appear only once in a SIP message.
>    The grammar for these two headers is (following the ABNF [6] in s):
>    (following the ABNF [6] in RFC3261 [1]):

Remove the entire first parenthesis.

[Section 13.3]
>       Without TLS, the various header field values and the body of the
>       request will not have integrity protection with the request
>       arrives at an authentication service.  Accordingly, a prior
>       legitimate or illegitimate intermediary could modify the message
>       arbitrarily.

"with" on line 2 should be "when" (as it actually was in -05).

[Section 13.4]
>    A verifier MUST evaluate the correspondence between the user's
>    identity and the signing certificate by following the procedures
>    defined in RFC 2818 [11] Section 3.1.  While RFC2818 deals with the
>    use of HTTP in TLS, the procedures described are applicable to
>    verifying identity if one subtitutes the "hostname of the server" in
>    HTTP for the domain portion of the user's identity in the From header
>    field of a SIP request with an Identity header.

"subtitutes" should be "substitutes".

[Appendix D]
>    Changes from draft-ietf-sip-identity-06:

This *is* -06.

Also, a general note. The draft is very inconsistent about whether
references should be written "RFCxxxx" or "RFC xxxx". Please decide on
one format.

Hans

-- 
Hans Persson <[email-masked]>    Ingate - Firewalls with SIP & NAT
Ingate Systems AB  +46 13 210877   http://www.ingate.com/

Private: <[email-masked]>  http://www.lysator.liu.se/~unicorn/