Subject: [Sip] SIPS vs TLS

From: "Bourne Li" <[email-masked]>
Date: Fri, 27 Jan 2006 21:37:41 +0800

Hi All,

I have one question regarding to TLS and SIPS.

Per RFC 3261, if SIPS URI is used as the R-URI, it indicates all the 
signaling hop (except the last one to the UAS) must be secured by TLS.  
I'm doubting if the converse is true. If transport protocol is TLS, does 
thisimply R-URI and/or topmost route is SIPS?

RFC 3263 (locating SIP server) has one requirement:
    RFC 3263 Section 4.1, 1st paragraph on page 7.
    First, a client resolving a SIPS URI MUST discard any services that
    do not contain "SIPS" as the protocol in the service field.  *The
    converse is not true, however.  A client resolving a SIP URI SHOULD
    retain records with "SIPS" as the protocol, if the client supports
    TLS.
*
If the client retain the DNS records with "SIPS" even when the input to 
DNS is SIP URI, it may use the TLS for the transport if the client 
supports TLS. My question is -- will UE promote the R-URI (or topmost 
route) from SIP URI to SIPS URI after selecting TLS as the transport 
protocol. Result of DNS query shall not modify the DNS input (R-URI or 
topmost URI), but do the promotion or not is not clearly specified in 
either 3263 and 3261 and client behavior may be different.

One potential approach of using SIP URI over TLS is using the security 
negotiation.

    RFC 3329. Section 2.4 "security mechanism initiation" specified:
    If "tls" is chosen, the client uses the procedures of Section 8.1.2
    of rfc 3261 to determine the URI to be used as an input to the DNS
    procedures of rfc3263.  However, if the URI is a SIP URI, it MUST
    treat the scheme as if it were sips, not sip.  If the URI scheme is
    not sip, the request MUST be sent using TLS.
   
    The example in section 4.1 shows SIP URI is used after TLS is 
established as the result of security negotiation.
   
   And, RFC 3329 section 2.3.1 specified
   If a client ends up using TLS to contact the server because it has
   followed the rules specified in [5], the client MUST NOT use the
   security agreement procedure of this specification.  If a client ends
   up using non-TLS connections because of the rules in [5], the client
   MAY use the security agreement of this specification to detect DNS
   spoofing, or to negotiate some other security than TLS.

So, SIPS URI shall not allow security negotiation, and SIP URI may use 
the TLS after security negotiation. Can we assume that SIP URI not SIPS 
URI shall be used for security negotiation (even when TLS is selected as 
the result of negotiation)? And, there is a similar question, will the 
UE promote the R-URI from SIP to SIPS URI, once TLS is selected.

Thanks,
Bourne

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip