Subject: AW: [Sip-security] New drafts for SIP security

From: Kroeselberg Dirk <[email-masked]>
Date: Thu, 2 Aug 2001 17:47:05 +0200

Hi,

it looks like this list finally comes back
into live, so I think it is a very good idea to 
spend some time in London on this topic,
and get some understanding of what a common
solution should look like. Or at least to 
figure out what state can be reached in the near
future.

The framework draft and the drafts listed in 
Jari's mail seem to form a good basis for this.

Dirk

> -----Ursprüngliche Nachricht-----
> Von: Michael Thomas [mailto:[email-masked]]
> Gesendet am: Donnerstag, 2. August 2001 16:18
> An: Jari Arkko
> Cc: [email-masked]; [email-masked]; [email-masked];
> [email-masked]; [email-masked];
> [email-masked]; [email-masked]; [email-masked]
> Betreff: [Sip-security] New drafts for SIP security
> 
> 
> Jari,
> 
> Thanks for compiling this list. There is clearly a
> lot of common ground amongst many of these drafts,
> and it seems clear that some of us feel that
> taking a neutral/extensible approach to the
> various authentication mechanisms may be the
> right overall approach (myself, HTTP EAP, the
> carrara draft). 
> 
> It seems to me that we may well have a critical
> mass of drafts which define the various
> requirements and make first pass attempts to solve
> various pieces of the overall solution.  If we can
> manage to agree upon a clear set of priorities and
> a baseline for interoperability, I think we can
> merge many of these drafts together into a more
> coherent whole. I personally am attracted to the
> HTTP EAP draft as well as the Carrara draft as
> they provide what my draft did not attempt to
> solve other than some handwaving for example's
> sake. 
> 
> Henning has drafted an initial note on relative
> prioritization which I think we can use as the
> basis to flesh out what we need to deliver and at
> what priority; this could be used as a
> determination of, say, what needs to be modified
> in 2543bis vs. what should go into a formalized
> SIP security draft.
> 
> I think it would be extremely productive if we
> could carve out 3-4 hours this coming week to come
> to consensus of what goes where, priorities, and
> trying to consolidate the concepts in these
> drafts.
> 
> Anybody want to suggest a time? Also: Dean/Bryan
> it may be useful to discuss some of the high level
> requirements/prioritization in one of the general
> meetings.
> 
> 		Mike
> 
> Jari Arkko writes:
>  > Hi,
>  > 
>  > Who is updating the team page
>  > (http://www.softarmor.com/sipwg/teams/sipsec/)?
>  > It is missing at least three directly relevant
>  > ones:
>  > 
>  >   HTTP Authentication with EAP
>  >   http://www.arkko.com/draft-torvinen-http-eap-00.txt
>  > 
>  >   Diameter support for Basic and Digest authentication
>  >   
> http://www.ietf.org/internet-drafts/draft-srinivas-aaa-basic-d
> igest-00.txt
>  > 
>  >   Request Header Integrity in SIP and HTTP Digest using 
> Predictive Nonces
>  >   
> http://www.ietf.org/internet-drafts/draft-rosenberg-sip-http-p
> nonce-00.txt
>  > 
>  > Also, when do we discuss these in IETF-51? There
>  > is a slot under the AAA group to discuss some
>  > drafts, but what about the rest? See the link
>  > http://www.ietf.org/ietf/01aug/aaa.txt Then
>  > the SIP WG agenda contains the discussion of
>  > two of the drafts (http://www.ietf.org/ietf/01aug/sip.txt)
>  > Finally, some of the 3GPP presentation will
>  > briefly discuss one of the drafts
>  > (http://www.ietf.org/ietf/01aug/sipping.txt).
>  > 
>  > Seems like a place for a real SIP Security
>  > BOF, but that's too late now to reserve...
>  > 
>  > Looking at the list of drafts, I'll try to summarize
>  > their content and where they are handled in the upcoming
>  > meeting. (It seems that much of the related work
>  > is spread over in different places. Can we do
>  > something about this? Is everything covered?)
>  > 
>  > [Ste] draft-sterman-sip-radius-00.txt
>  > [Tor] draft-torvinen-http-eap-00.txt
>  > [Sri] draft-srinivas-aaa-basic-digest-00.txt
>  > [Ros] draft-rosenberg-sip-http-pnonce-00.txt
>  > [Tho] draft-thomas-sip-sec-framework-00.txt
>  > [Und] draft-undery-sip-digest-00.txt
>  > [Bye] draft-byerly-sip-radius-00.txt
>  > 
>  > DRAFT  WG            AREA
>  > 
> --------------------------------------------------------------
> -------------
>  > [Ste]  AAA           Using RADIUS to implement Digest
>  > [Tor]  AAA, SIPPING  Generic auth via EAP in SIP/HTTP, and DIAMETER
>  > [Sri]  AAA           Using DIAMETER NASREQ to implement Digest
>  > [Ros]  SIP           Digest to support more headers
>  > [Tho]  -             New headers to select right external 
> security protocol
>  > [Und]  SIP           Digest to support more headers
>  > [Bye]  (old)         CHAP auth to SIP/HTTP
>  > 
>  > There are also additional items such as 
> draft-carrara-mm-kmgt-sol-00.txt
>  > which are not directly related to SIP security, but use SIP to
>  > establish security for the media sessions.
>  > 
>  > Jari Arkko
>  > Ericsson
> 
> _______________________________________________
> Sip-security mailing list
> [email-masked]
> http://www.ietf.org/mailman/listinfo/sip-security
> 

_______________________________________________
Sip-security mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/sip-security

---

From: Euchner Martin <[email-masked]>
Date: Thu, 2 Aug 2001 17:51:32 +0200

Michael and all,

yes I'm glad to see that SIP security is really lifting off. There are quite a couple of SIP security related drafts around; thanks to Jari for compiling and updating the list.

While I've already seen the SIP Security Framework, the SRTP and associated key management drafts which look quite good in my eyes. There are several other items which I have to look into.

I found mm-kmgt requirements especially useful and I believe that such basic foundation really helps in progressing work and facilitates technical work later on.

Certainly, there are many pieces already on the table now. Now we should consider the overall picture and look where and how the current pieces fit in, where some white spots remain and how we can complete the landscape. It might help to approach this by thinking of requirements and it could turn out that there might be real reasons to have complementary security solutions in certain cases.

Thus, I would like to join this kind of discussion with all of you. I feel we can produce some good results on this. I'm looking forward to meeting you in London.

Kind Regards

Martin Euchner.
-----------------------------------------------------------------------
| Dipl.-Inf.                     Phone: +49 89 722 55790
| Martin Euchner                 Fax  : +49 89 722 46841
| Siemens AG
| ICN M SR 3                     mailto:[email-masked] <mailto:[email-masked]> 
|                                mailto:[email-masked] <mailto:[email-masked]> 
| Hofmannstr. 51                 Intranet: http://intranet.icn.siemens.de/marketing/cs27/ <http://intranet.icn.siemens.de/marketing/cs27/> 
| D-81359 Muenchen               Internet: http://www.siemens.de <http://www.siemens.de> 
| __________________
| Germany     
-----------------------------------------------------------------------

	-----Ursprüngliche Nachricht-----
	Von:	Michael Thomas [SMTP:[email-masked]]
	Gesendet am:	Donnerstag, 2. August 2001 16:18
	An:	Jari Arkko
	Cc:	[email-masked]; [email-masked]; [email-masked]; [email-masked]; [email-masked]; [email-masked]; [email-masked]; [email-masked]
	Betreff:	[Sip-security] New drafts for SIP security

	Jari,

			Mike

	Jari Arkko writes:
	 >   http://www.ietf.org/internet-drafts/draft-srinivas-aaa-basic-digest-00.txt
	 > 
	 >   Request Header Integrity in SIP and HTTP Digest using Predictive Nonces
	 >   http://www.ietf.org/internet-drafts/draft-rosenberg-sip-http-pnonce-00.txt
	 > _
	 > ---------------------------------------------------------------------------
	 > [Tho]  -             New headers to select right external security protocol
	 > There are also additional items such as draft-carrara-mm-kmgt-sol-00.txt