Subject: Re: [Sip] Media vs Signaling identity (was Re: francois' comments andwhy RFC4474 not used in the field)

From: "Elwell, John" <[email-masked]>
Date: Wed, 01 Apr 2009 11:33:43 +0100

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On 
> Behalf Of Victor Pascual Ávila
> Sent: 31 March 2009 11:07
> To: Jonathan Rosenberg
> Cc: SIP List
> Subject: [Sip] Media vs Signaling identity (was Re: francois' 
> comments andwhy RFC4474 not used in the field)
> 
> On Tue, Mar 31, 2009 at 4:12 AM, Jonathan Rosenberg 
> <[email-masked]> wrote:
> > inline:
> >
> > Jiri Kuthan wrote:
> >
> >
> >>>  From an end user perspective, I would assert that the 
> most important
> >>> thing is probably the media. If the callerID says, "this 
> is bob", what is
> >>> important to the user, is that when I pick up the phone 
> and start talking,
> >>> it will be Bob who hears me, and Bob that I hear.
> >>>
> >>> Consider this litmus test:
> >>>
> >>> If the signaling actually came from Mary (perhaps as a 
> third party), but
> >>> the media goes/comes to/from Bob, who should appear on 
> the caller ID? I say
> >>> - Bob.
> >>
> >> There is a timing aspect in favor of placing identity in 
> signaling --
> >> I would like to know whose call is ringing before I answer 
> (if I do).
> >
> > You can still have that. Just don't ring the phone until 
> early media has
> > been exchanged and verified. Indeed if you were doing an 
> ICE-style thing per
> > Dan's draft, you'd get that for free.
> 
> Are we restricting the identity assertion to telephony-like sessions?
> 
> IMHO, identity assertion should also work for the following scenarios
> (among others):
> 
> -rfc3725, figure 1, message 1 (INVITE no SDP): Upon receipt of the
> initial INVITE (note there's no session description at all), "A"
> decides to authorize or reject the call based on the delivered
> identifier.
> 
> -rfc3428, figure 1, message 2 (F2): "user2" decides to answer or
> ignore the message based on the delivered identifier.
> 
> -rfc3515, example 4.1, message 1 (F1): "agent B" decides to accept or
> reject the refer based on the delivered identifier
> 
> -Any other application based on white/black lists (where the identity
> verification must happen before accepting a request).
> 
> 
> While "signaling identity" seems to be a common denominator, I'm not
> sure about the role of "media identity" in the above listed scenarios.
> Any clarification will be appreciated.
[JRE] These too are valid situations where the identity needs to be authenticated. Where media is involved, however, there is an additional problem of authenticating the media, and if the media is bound to the signalling, a solution for authenticating the signalling would also authenticate the media. So we either need a solution for authenticating both signalling and media together (e.g., by authenticating the signalling, the media too gets authenticated) or we need separate mechanisms. Clearly the former would be preferable.

John

> 
> Cheers,
> -- 
> Victor Pascual Ávila
> _______________________________________________
> Sip mailing list  https://www.ietf.org/mailman/listinfo/sip
> This list is for NEW development of the core SIP Protocol
> Use [email-masked] for questions on current sip
> Use [email-masked] for new developments on the application of sip
>

---

From: Victor Pascual Ávila <[email-masked]>
Date: Wed, 1 Apr 2009 15:20:46 +0200

On Wed, Apr 1, 2009 at 12:33 PM, Elwell, John
<[email-masked]> wrote:
(snip)
> [JRE] These too are valid situations where the identity needs to be authenticated. Where media is involved, however, there is an additional problem of authenticating the media, and if the media is…

I guess we all agree that the following scenarios are possible (please
correct me if I'm wrong):

+ Only Signaling (e.g. sender-to-receiver MESSAGE ): we need to
authenticate the signaling itself. Here we are including scenarios
where user content is embedded into the signaling plane.
+ Signaling and media: we need to authenticate both signaling and media planes
-+ Media is bound to the signaling (e.g. caller-to-callee
INVITE-transaction + caller-to-callee rtp stream(s)): we may need to
authenticate both signaling and media together. (BTW, I fail to see
the benefits of coupling media and control plane identities; specially
when considering Lawful Interception)
-+ Media is not bound to the signaling (e.g. 3PCC): we may need
separate mechanisms

Which scenarios are we trying to cover here?
Is the receiver identity (media or signaling) as important as the
sender identity?

Just trying to find some rough consensus and narrow the "identity problem",
-- 
Victor Pascual Ávila

---

From: "Elwell, John" <[email-masked]>
Date: Thu, 02 Apr 2009 21:08:09 +0100

> From: Victor Pascual Ávila [mailto:[email-masked]] 
> Sent: 01 April 2009 14:21
> To: Elwell, John
> Cc: Jonathan Rosenberg; SIP List
> Subject: Re: [Sip] Media vs Signaling identity (was Re: 
> francois' comments andwhy RFC4474 not used in the field)
> 
> > [JRE] These too are valid situations where the identity 
> needs to be authenticated. Where media is involved, however, 
> there is an additional problem of authenticating the media, 
> and if the media is bound to the signalling, a solution for 
> authenticating the signalling would also authenticate the 
> media. So we either need a solution for authenticating both 
> signalling and media together (e.g., by authenticating the 
> signalling, the media too gets authenticated) or we need 
> separate mechanisms. Clearly the former would be preferable.
> 
[JRE] This I am not so sure about. With DTLS-SRTP, authentication of the media is bound to authentication of the signalling (unless you use CA-signed certs in the endpoints for DTLS). So it seems with DTLS-SRTP we did not consider the media originating/terminating at a different device from signalling.

> Is the receiver identity (media or signaling) as important as the
[JRE] Yes, probably even more important in some situations. If I am going to disclose sensitive information, I need to be sure where it will end up.

John