Subject: [Simple] MSRP Security Review Recommendation 7

From: Ben Campbell <[email-masked]>
Date: Thu, 9 Sep 2004 20:39:23 -0500

Hi,

In Sam's security review (Thanks Sam!), his recommendation 7 was, and I 
paraphrase, that we should discuss what it means to have messages 
attributed to the same sender that arrive via different paths that may 
have different security properties. I interpret that to mean that the 
messages arrive on different MSRP sessions.

So, here is some proposed text for discussion:

-------------------------------------------------------------
It is possible that a recipient might receive messages that are 
attributed to the same sender via different MSRP sessions. For example, 
Alice might be in a conversation with Bob via an MSRP session over a  
TLS protected channel. Alice might then receive a different message 
from Bob over a different session, perhaps with a conference focus that 
asserts Bob's identity in a message/cpim envelope signed by the focus.

MSRP does not in any way prohibit multiple simultaneous sessions 
between the same pair of identities. Nor does it prohibit an endpoint 
sending a message on behalf of another identity, such as may be the 
case for a conference focus. The recipient's endpoint should determine 
its level of trust of the authenticity of the sender independently for 
each session. The fact that an endpoint trusts the authenticity of the 
sender on any given session should not affect the level of trust it 
assigns for apparently the same sender on a different session.

_______________________________________________
Simple mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/simple

---

From: [email-masked]
Date: Fri, 10 Sep 2004 10:53:28 +0300

Sounds good, although I would not use the term "focus" (unless you want to start referencing conferencing documents in sipping).

Regards,
Hisham

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]]On Behalf
> Of ext Ben Campbell
> Sent: 10.September.2004 04:39
> To: Simple WG
> Subject: [Simple] MSRP Security Review Recommendation 7
> 
> 
> Hi,
>