Subject: [siprec] proposal for new security requirement

From: "Ken Rehor (krehor)" <[email-masked]>
Date: Thu, 9 Dec 2010 07:49:59 -0800

The following is a proposal for a new requirement to cover the security
of a Recording Session in relation to the Communication Session:

REQ-xxx               If the CS is secured, the RS MUST NOT be less
secure than the CS.

Ken

For corporate legal information go to:
http://www.cisco.com/web/about/doing_business/legal/cri/index.html

---

From: Leon Portman <[email-masked]>
Date: Thu, 9 Dec 2010 17:57:56 +0200

+1

Yes, it is important requirement. We don't want that Recording Session will create a security hole in Communication Session protection.

Leon

From: [email-masked] [mailto:[email-masked]] On Behalf Of Ken Rehor (krehor)
Sent: Thursday, December 09, 2010 5:50 PM
To: [email-masked]
Subject: [siprec] proposal for new security requirement

The following is a proposal for a new requirement to cover the security of a Recording Session in relation to the Communication Session:

REQ-xxx               If the CS is secured, the RS MUST NOT be less secure than the CS.

Ken

---

From: Paul Kyzivat <[email-masked]>
Date: Thu, 09 Dec 2010 11:13:59 -0500

> REQ-xxx If the CS is secured, the RS MUST NOT be less secure than the CS.

Good as far as it goes.
But what does "less secure" mean in this context?

We can probably leave the details to the mechanism specs, but I think a 
few sentences describing what is meant would be helpful.

For instance, if the CS is e2e encrypted so no intermediaries can 
decrypt it (and hence the SRC must be one of the ends) then perhaps the 
RS also needs to be encrypted so that only the SRC and SRS can decrypt it.

OTOH, if the media stream is encrypted via keys exchanged in the CS 
signaling, and the signaling is only encrypted hop by hop, so that 
everything on the signaling path is trusted, then that same lesser 
degree of security may be permitted on the RS.

I'm not a security guy, so I think we need somebody who is to craft the 
right set of words.

	Thanks,
	Paul

---

From: "Parthasarathi R (partr)" <[email-masked]>
Date: Fri, 10 Dec 2010 07:20:16 +0530

Adding to Paul points, RS and CS are two different dialogs and there is no need of security relationship between CS and RS. For example: UA1 + SRC, SRS are located within Enterprise and (remote)  UA2 is located in Service provider network, then UA1 to UA2 (CS) has to be secured whereas SRC to SRS (RS) is not required to be secured as SRC and SRS are within trusted Enterprise network.
 
Thanks
Partha

________________________________

From: [email-masked] on behalf of Paul Kyzivat (pkyzivat)
Sent: Thu 12/9/2010 9:43 PM
To: [email-masked]
Subject: Re: [siprec] proposal for new security requirement

Good as far as it goes.

        Thanks,
        Paul
_______________________________________________
siprec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/siprec

---

From: "Elwell, John" <[email-masked]>
Date: Fri, 10 Dec 2010 11:39:47 +0100

I am inclined to agree with Partha. The means of securing the CS and the means of security the RS might be entirely different, and therefore the meaning of "less secure" is difficult to quantify. Giving some examples:
- CS is secured e2e with SIPS and SRTP, but RS remains within enterprise where all links are secured by IPsec.
- CS is secured e2e with SIPS and SRTP, but RS remains within enterprise where all links and nodes are physically secured.
- CS is secured outside the enterprise domain with SRTP but not within the enterprise domain, SRTP being terminated at an SBC. RS, which stays within the enterprise domain, is not secured with SRTP.
- CS has SRTP with 256 bit encryption, but RS, which remains within enterprise domain, has only 128 bit encryption.
- CS is secured with DTLS-SRTP, RS is secured with TLS+SDES.

Therefore I am not convinced the proposed new requirement is a good idea. I think it is a deployment matter.

John (as individual)

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Parthasarathi R (partr)
> Sent: 10 December 2010 01:50
> To: Paul Kyzivat (pkyzivat); [email-masked]
> Adding to Paul points, RS and CS are two different dialogs 
> and there is no need of security relationship between CS and 
> RS. For example: UA1 + SRC, SRS are located within Enterprise 
> and (remote)  UA2 is located in Service provider network, 
> then UA1 to UA2 (CS) has to be secured whereas SRC to SRS 
> (RS) is not required to be secured as SRC and SRS are within 
> trusted Enterprise network.
>  
> Thanks
> Partha
>

---

From: Leon Portman <[email-masked]>
Date: Mon, 13 Dec 2010 01:42:58 +0200

These are good examples. I agree that RS security level is very dependent on the implementation use cases.

The main reason why we added this requirement was for the draft security review, we did not wanted to open any potential security holes by downgrading communication protection on the wire both for media and signaling. At least now we have list of reasons why RS can be less secure (again either for SIP and media encryption) then CS.

May be we should add this as recommendation?

Any security expert opinions if physical or transport level security can allow us drop SIP and Media level protection for RS comparing to CS?

Leon

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Elwell, John
Sent: Friday, December 10, 2010 12:40 PM
To: Parthasarathi R (partr); Paul Kyzivat (pkyzivat); [email-masked]
Subject: Re: [siprec] proposal for new security requirement

John (as individual)

---

From: "Elwell, John" <[email-masked]>
Date: Mon, 13 Dec 2010 08:19:04 +0100

I think we only need to place requirements on the mechanism to allow the RS to be at least as secure as the CS. However, the individual requirements on authentication, integrity and confidentiality (and on any other aspects we might identify) should achieve this. I don't see a need for the proposed new requirement.

What you actually deploy is out of scope, unless we see a need for the solution document to mandate or recommend something. 

John (as individual) 

> From: Leon Portman [mailto:[email-masked]] 
> Sent: 12 December 2010 23:43
> To: Elwell, John; Parthasarathi R (partr); Paul Kyzivat 
> (pkyzivat); [email-masked]
> Subject: RE: [siprec] proposal for new security requirement
> 
> These are good examples. I agree that RS security level is 
> very dependent on the implementation use cases.
> 
> The main reason why we added this requirement was for the 
> draft security review, we did not wanted to open any 
> potential security holes by downgrading communication 
> protection on the wire both for media and signaling. At least 
> now we have list of reasons why RS can be less secure (again 
> either for SIP and media encryption) then CS.
> 
> Any security expert opinions if physical or transport level 
> security can allow us drop SIP and Media level protection for 
> RS comparing to CS?
> 
> Leon
> 
> [mailto:[email-masked]] On Behalf Of Elwell, John
> I am inclined to agree with Partha. The means of securing the 
> CS and the means of security the RS might be entirely 
> different, and therefore the meaning of "less secure" is 
> difficult to quantify. Giving some examples:
> - CS is secured e2e with SIPS and SRTP, but RS remains within 
> enterprise where all links are secured by IPsec.
> - CS is secured e2e with SIPS and SRTP, but RS remains within 
> enterprise where all links and nodes are physically secured.
> - CS is secured outside the enterprise domain with SRTP but 
> not within the enterprise domain, SRTP being terminated at an 
> SBC. RS, which stays within the enterprise domain, is not 
> secured with SRTP.
> - CS has SRTP with 256 bit encryption, but RS, which remains 
> within enterprise domain, has only 128 bit encryption.
> Therefore I am not convinced the proposed new requirement is 
> a good idea. I think it is a deployment matter.
> 
> John (as individual)
>  
>

---

From: Leon Portman <[email-masked]>
Date: Mon, 13 Dec 2010 10:43:33 +0200

Agree, I am ok without this requirement

Leon

---

From: "De Villiers de Wet" <[email-masked]>
Date: Mon, 13 Dec 2010 12:26:03 +0200

Agree - remove.  Good arguments from Partha and John.

De Villiers

From: Leon Portman [mailto:[email-masked]] 
Sent: 13 December 2010 10:44
To: Elwell, John
Cc: [email-masked]; Leon Portman
Subject: Re: [siprec] proposal for new security requirement

Leon

	
	
	John (as individual) 

	-----Original Message-----

		RS comparing to CS?

		Leon

		-----Original Message-----

		secured with SRTP.

		John (as individual)

			-----Original Message-----

			[mailto:[email-masked]] On Behalf Of Parthasarathi 

		R (partr)

			Thanks

			Partha

			To: [email-masked]

			 

				The following is a proposal for a new requirement to cover 

			the security

			secure than the CS.

			Good as far as it goes.

			We can probably leave the details to the mechanism specs, but 

			I think a

			decrypt it (and hence the SRC must be one of the ends) then 

			perhaps the

			RS also needs to be encrypted so that only the SRC and SRS 

			can decrypt it.

			I'm not a security guy, so I think we need somebody who is to 

			craft the

			right set of words.

			       Thanks,

			       Paul

			siprec mailing list

			[email-masked]

			 

		siprec mailing list

		[email-masked]