Certificates

1
Certificates

• Cullen Jennings
• Jon Peterson

2
Key Property - Detect Interception

• Need to trust domain of your AOR
• Media protected with SRTP
• Keys for SRTP protected with S/MIME
• Know that sender talked to correct domain via SIP
  Identity
• Trust domain delivered public certificate for
  user_at_domain because it owns this namespace

3
Fetching Certs

• Currently say SUBSCRIBE
• Old version said HTTPS GET
• Must pick one of these as MUST implement
• SUBSCRIBE provides some revocation
• Only as good as liveness
• Frequent change probably better than revocation

4
Multipart Support

• When a request forks to some devices that do
  multipart and some that dont.
• The devices that dont do multipart will not be
  able to report an error.
• 2nd rule of protocol design
• Ignore the forward compatibility rules till
  version 2
• SIP needs a way to upgrade body types in the
  presence of forking
• Many things are running into it E911, Crypto,
  SDPng would need it
• Recommendation move to assuming multipart will
  deploy
• note not assuming S/MIME will deploy

5
Missing Items

• Liveness checking on subscriptions
• Need way to stop attacker from blocking
  terminations of the subscription
• Tighten up some of the language
• Fix some mistakes - many thanks Paul Kyzivat
• Complete examples