3 Sep 2008 09:35
Further proceeding with draft-ietf-sipping-update-pai--05
Elwell, John <john.elwell <at> siemens.com>
2008-09-03 07:35:40 GMT
2008-09-03 07:35:40 GMT
I received no feedback in the changes made in draft-05 concerning the forward compatibility mechanism, nor on the particular issue I asked for comments on: http://www.ietf.org/mail-archive/web/sipping/current/msg16105.html Therefore I assume these changes are acceptable. So we have the one remaining issue concerning response authentication. We had some list discussion on this, the last one being on 20th August: http://www.ietf.org/mail-archive/web/sipping/current/msg16121.html The use of PAI in responses is something that needs clarifying, because RFC 3325 is ambiguous (sometimes it talks about SIP messages, other times it specifically talks about requests). In one place it actually states "message (request or response)". So I think we have the following options: 1. Say nothing about responses at all, thereby leaving us with the ambiguity that exists in RFC 3325. I don't think this is a sensible option. A lot of the value of updating RFC 3325 is lost if we don't tackle the response ambiguity issue. 2. Clarify the situation by stating that PAI (and PPI) MUST NOT be used in responses. I would be very reluctant to go down this path, since I know there is a lot of use of PAI in responses (e.g., in 3GPP). 3. Devise a mechanism that exploits TLS to achieve authenticated response identity and use this in the update-pai draft. As Cullen pointed out, this needs to be a separate and non-trivial piece of work, probably done in the SIP WG. Waiting for this would hold up update-pai(Continue reading)
RSS Feed