Subject: [Sip-security] New drafts for SIP security

From: Jari Arkko <[email-masked]>
Date: Thu, 02 Aug 2001 14:00:52 +0300

Hi,

Who is updating the team page
(http://www.softarmor.com/sipwg/teams/sipsec/)?
It is missing at least three directly relevant
ones:

  HTTP Authentication with EAP
  http://www.arkko.com/draft-torvinen-http-eap-00.txt

  Diameter support for Basic and Digest authentication
  http://www.ietf.org/internet-drafts/draft-srinivas-aaa-basic-digest-00.txt

  Request Header Integrity in SIP and HTTP Digest using Predictive Nonces
  http://www.ietf.org/internet-drafts/draft-rosenberg-sip-http-pnonce-00.txt

Also, when do we discuss these in IETF-51? There
is a slot under the AAA group to discuss some
drafts, but what about the rest? See the link
http://www.ietf.org/ietf/01aug/aaa.txt Then
the SIP WG agenda contains the discussion of
two of the drafts (http://www.ietf.org/ietf/01aug/sip.txt)
Finally, some of the 3GPP presentation will
briefly discuss one of the drafts
(http://www.ietf.org/ietf/01aug/sipping.txt).

Seems like a place for a real SIP Security
BOF, but that's too late now to reserve...

Looking at the list of drafts, I'll try to summarize
their content and where they are handled in the upcoming
meeting. (It seems that much of the related work
is spread over in different places. Can we do
something about this? Is everything covered?)

[Ste] draft-sterman-sip-radius-00.txt
[Tor] draft-torvinen-http-eap-00.txt
[Sri] draft-srinivas-aaa-basic-digest-00.txt
[Ros] draft-rosenberg-sip-http-pnonce-00.txt
[Tho] draft-thomas-sip-sec-framework-00.txt
[Und] draft-undery-sip-digest-00.txt
[Bye] draft-byerly-sip-radius-00.txt

DRAFT  WG            AREA
---------------------------------------------------------------------------
[Ste]  AAA           Using RADIUS to implement Digest
[Tor]  AAA, SIPPING  Generic auth via EAP in SIP/HTTP, and DIAMETER
[Sri]  AAA           Using DIAMETER NASREQ to implement Digest
[Ros]  SIP           Digest to support more headers
[Tho]  -             New headers to select right external security protocol
[Und]  SIP           Digest to support more headers
[Bye]  (old)         CHAP auth to SIP/HTTP

There are also additional items such as draft-carrara-mm-kmgt-sol-00.txt
which are not directly related to SIP security, but use SIP to
establish security for the media sessions.

Jari Arkko
Ericsson

_______________________________________________
Sip-security mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/sip-security

---

From: Michael Thomas <[email-masked]>
Date: Thu, 2 Aug 2001 07:17:34 -0700 (PDT)

Jari,

Thanks for compiling this list. There is clearly a
lot of common ground amongst many of these drafts,
and it seems clear that some of us feel that
taking a neutral/extensible approach to the
various authentication mechanisms may be the
right overall approach (myself, HTTP EAP, the
carrara draft). 

It seems to me that we may well have a critical
mass of drafts which define the various
requirements and make first pass attempts to solve
various pieces of the overall solution.  If we can
manage to agree upon a clear set of priorities and
a baseline for interoperability, I think we can
merge many of these drafts together into a more
coherent whole. I personally am attracted to the
HTTP EAP draft as well as the Carrara draft as
they provide what my draft did not attempt to
solve other than some handwaving for example's
sake. 

Henning has drafted an initial note on relative
prioritization which I think we can use as the
basis to flesh out what we need to deliver and at
what priority; this could be used as a
determination of, say, what needs to be modified
in 2543bis vs. what should go into a formalized
SIP security draft.

I think it would be extremely productive if we
could carve out 3-4 hours this coming week to come
to consensus of what goes where, priorities, and
trying to consolidate the concepts in these
drafts.

Anybody want to suggest a time? Also: Dean/Bryan
it may be useful to discuss some of the high level
requirements/prioritization in one of the general
meetings.

		Mike

---

From: Jari Arkko <[email-masked]>
Date: Fri, 03 Aug 2001 14:36:10 +0300

>Anybody want to suggest a time? 

In the meetings of course, but if we are also
going to meet inofficially then I'll just list
some possible times for me below:

Wednesday 09:00-13:00 (other times better though)
Wednesday 17:30-
Thursday  09:00-13:00
Thursday  17:30-
Friday    12:00-15:00 (other times better though)

How about Wednesday after the SIPPING meeting
i.e. 17:30 onwards?

An agenda for such a meeting? Maybe like this:

 1. Short presentations on various pieces of work
 2. Identification of commonalities, holes, etc
 3. Priority order discussion
 4. Way forward

Jari

---

From: "Dean Willis" <[email-masked]>
Date: Sun, 5 Aug 2001 14:10:49 -0500

Actually, the page is generated programattically from the same source that
generates the "drafts" page. If you look at the "drafts" page, you'll notice
that there is no subteam listed for the rosenberg draft. This is an
oversight, and I will attempt to correct it.

The other drafts mentioned do not, at least to my knowledge, fall explicitly
within the scope of the SIP working group and are therefore not referenced
in the drafts page, do not have an associated deliverable on the SIP
charter, and as a consequence are not assigned to the SIP security subteam.

Question: Should the rosenberg draft be moved to SIPPING?

--
Dean

----- Original Message -----
From: "Jari Arkko" <[email-masked]>
To: <[email-masked]>; <[email-masked]>; <[email-masked]>;
<[email-masked]>; <[email-masked]>;
<[email-masked]>; <[email-masked]>
Cc: <[email-masked]>
Sent: Thursday, August 02, 2001 6:00 AM
Subject: [Sip-security] New drafts for SIP security

---

From: "Dean Willis" <[email-masked]>
Date: Sun, 5 Aug 2001 16:50:52 -0500

More followup:

The pnonce topic is under discussion in the Tuesday morning session. The
agenda item reads:

0910 Message Integrity via Digest
    draft-undery-sip-digest-00.txt -- James Undery
    draft-rosenberg-sip-http-pnonce-00.txt -- Jonathan Rosenberg

The other drafts you mention are not on the SIP or SIPPING agendas to the
best of my knoweldge. There is some thought on holding a SIP Security BOF,
and I suspect that the these drafts and their implications to SIP would be a
worthwhile topic. Scheduling of BOFS will be discussed during the agenda
bash in the first SIP session.

--
Dean

---

From: "Dean Willis" <[email-masked]>
Date: Sun, 5 Aug 2001 17:56:44 -0500

Whoops, I meant to say a SIP Security Bar BOF -- that is, an unofficial
meeting of interested parties occurring after-hours at an IETF meeting.
There are several bar BOF topics under discussion for IETF 51 -- see the
posted agenda for more.

My apologies.

--
Dean

----- Original Message -----
From: "Dean Willis" <[email-masked]>
To: "Jari Arkko" <[email-masked]>; <[email-masked]>;
<[email-masked]>; <[email-masked]>; <[email-masked]>;
<[email-masked]>; <[email-masked]>; <[email-masked]>
Cc: <[email-masked]>
Sent: Sunday, August 05, 2001 4:50 PM
Subject: Re: [Sip-security] New drafts for SIP security

---

From: Michael Thomas <[email-masked]>
Date: Tue, 7 Aug 2001 07:45:02 -0700 (PDT)

> Question: Should the rosenberg draft be moved to SIPPING?

   It seems that if Jonathan's doesn't actually require
   any bits on the wire guidance (or just sanity shouldn'ts)
   it would be more of a BCP kind of thing. In fact, I think
   that the SIP state blobs could use similar guidance so
   that implementors are aware of the attacks they need to
   guard against even though they it's an implementation issue.

		 Mike

_______________________________________________
Sip-security mailing list
[email-masked]
http://www1.ietf.org/mailman/listinfo/sip-security

---

From: Michael Thomas <[email-masked]>
Date: Wed, 8 Aug 2001 09:36:43 -0700 (PDT)

where is today's security meeting? I'm in the front lobby if
people want to meet there if the place hasn't been
set.

		Mike