Subject: Re: [Sip] Comment on sip-tls-use draft

From: [email-masked]
Date: Mon, 20 Mar 2006 15:23:03 -0500 (EST)

I believe the automatic promotion only applied to the contact of the UAC;
it could be scoped to REGISTER.  Promotion shouldn't be applied to
request-uris.

If a UAC is making an emergency call, SIP vs SIPS is under the UAC's control.

-----Original Message-----
From: "Thejeswara Reddy" <[email-masked]>
Sent: Mon, March 20, 2006 2:38 pm
To: [email-masked], [email-masked]
Cc: [email-masked]
Subject: Re: [Sip] Comment on sip-tls-use draft

HI,

           Is it possible to  convert  sips (tls) to TCP (as proxy does
from UDP to TCP), if the  UAS wont support TLS, and the call is
emrgency............ (dont want  drop the call because of sips
uri)

  Thanks.
  theja

[email-masked] wrote:
I've given this a fairly detailed read.  Its good that the issue of more
explicit rules on certificate name matching is (finally) being addressed.
It will be really nice to nail down what the certificate for a server farm
looks like.

A few Comments:

* In the introduction, why would Alice's possession of a certificate
determine whether sip or sips is used in the registration? If Alice pins a
TLS connection to a server(Alice might implement sip-outbound, but pinned
TLS w/ server certs only is already deployed) a sips uri would be
appropriate.

* In section 4, there is an assertion that:

    When endpoints use TLS, there aren't any checks at the SIP layer
    correlating the contents of the TLS certificate with the SIP headers.

AFAIK, there is a requirement that endpoints match the request URI against
the certificate name.

Also in section 4 there is an DNS poisoning attack where example.net
hijacks example.com.  This is not an effective attack unless a cert. has
been compromised as the name presented in the certificate will not match
the request uri.

* using the via trail to see if a message has been compromised does not
seem worthwhile, as there is nothing preventing the attacker from
inserting a valid-looking via trail.

* promoting a SIP URI to a SIPS uri seems like a nice thing for registrars
to do as clients will not have to have knowledge of whether the
registrar/proxy has correctly implemented sips.  Admittedly, this is only
an issue w/ bad registrar/proxy implementations.

Thanks,

Derek

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---------------------------------
 Jiyo cricket on Yahoo! India cricket
Yahoo! Messenger Mobile Stay in touch with your buddies all the time.

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip