Subject: [Sip] Comment on draft-gurbani-sip-tls-use-00

From: "Walker, Charles" <[email-masked]>
Date: Thu, 23 Mar 2006 12:44:56 -0500

I have worked on an implementation of SIP over TLS, so I'm glad that you
are working on this draft.  I could have used something like this back
when I was implementing SIP over TLS.

When I read section 5.2, I really did not like P2 doing a reverse DNS
lookup to get P1's host name.  I thought it unnecessary since P1 is
proving that it has the private key when it does the CERTIFICATE VERIFY.

However, on reflection, I recant my objection.  Just because somebody
has a certificate and the associated private key, does not mean that the
certificate/key pair is for the meant for the host that it is actually
installed on.  P2 does need to somehow match the host name of P1 against
the host name in the certificate.  The reverse DNS lookup is not
perfect, but it's better than nothing.

Regards,
Charles Walker

VeriSign, Inc.

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip