Re: [Sip] comments on draft-kupwade-sip-iba-00

[Michael Thomas <mat at cisco.com>]

Dean Willis wrote:
> [] The enrollment
> process could include a KG interaction. 

This to my mind is the _actual_ problem hindering deployment. Does
this scheme help that problem or just rearrange the deck chairs? Something
that posits yet another trust anchor would strike me as the latter.

 From the conclusion:

  The advantages with the proposed methods are:

   1.  Key size: Elliptic-curve cryptography arguably provides
       equivalent security with smaller operands than the RSA technique
       typically used with [7 <http://tools.ietf.org/html/draft-kupwade-sip-iba-00#ref-7>].  This provides some advantage for
       resource-constrained environments such as mobile telephones.  It
       also reduces the cryptographic load on large-scale devices doing
       frequent authentication checks.

You can do this with PKI or key-centric schemes too.

   2.  Key discovery: Callers can generate the public key of the callee
       from the identity (SIP URI) of the callee and vice versa.  This
       eliminates a requirement for a key discovery mechanism using
       external sources, making deployment significantly easier.

Or you can ship the key or cert in the signaling too.

   3.  Certificate validation: As a result caller or callee need not go
       through the complex path construction process to retrieve the
       public keys of a chain of CAs from the public key depositories
       which are controlled by the respective CAs.  This allows
       deployment in a peer-to-per modality without a need to route SIP
       messages through a centralized identity service or trust peer
       nodes to operate as identity services.

What is the KG if not a centralized entity? I guess I don't
understand this part.

   4.  Revocation: The ease of minting new identities and discovering
       keys allows short-lived identities, reducing the need for
       certificate revocation lists and the checking thereof.  This
       offers very large operational advantages in resource constrained
       environments.

I don't understand why this is "easy". Enrollment is 
"hard" unless there's something really new here. And 
if I wanted a short-lived identity, I could just gin 
up a new public key pair and use that as the identity
too. But I thought that the real problem was dealing with
long term identities like, oh say, mat at cisco.com.

		Mike

_______________________________________________
Sip mailing list  https://www.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use sip-implementors at cs.columbia.edu for questions on current sip
Use sipping at ietf.org for new developments on the application of sip