[Sip] SIPS: why not S/MIME instead?

[Michael Thomas <mat at cisco.com>]

As an alternative of my previous proposal, there seems to be quite a bit of
unhappiness of the general bogosity of the last hop (UAS) exception of SIPS.
If we remove that restriction, I guess I have to ask the question if you
want integrity/confidentiality along the path where you ultimately have no
real control over the transport chosen by middle proxies -- why don't 
you just
get/learn the cert of the intended party and use S/MIME which actually give
you the security properties that you're most likely hoping for with SIPS?

It seems to me that either S/MIME directly to the UAS or to some trusted
upstream agent for the UAS would be a *lot* better than hoping that you'll
get TLS the whole path, not least  of which is that it eliminates the lying
middle proxy problem. And if you're going to insist on TLS, you need
certs in all of those things anyway, so why not just ignore the TLS aspect
and use S/MIME?

Which isn't to say that TLS is not useful, but SIPS is trying to approximate
what S/MIME gets you, so it's not clear why you shouldn't we shouldn't
be promoting it instead of the obvious hack that SIPS is.

      Mike

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use sip-implementors at cs.columbia.edu for questions on current sip
Use sipping at ietf.org for new developments on the application of sip