Subject: Fw: [P2PSIP] New draft on security threats in P2PSIP

From: "Eric Cooper" <[email-masked]>
Date: Thu, 8 Mar 2007 13:28:23 -0500

Forwarding to the list, 'cuz I think it's interesting/important...

Best Regards,

Eric.

----- Original Message ----- 
From: <[email-masked]>
To: <[email-masked]>; <[email-masked]>
Cc: <[email-masked]>
Sent: Thursday, March 08, 2007 1:07 PM
Subject: RE: [P2PSIP] New draft on security threats in P2PSIP

Hello
 
I think this is a good insight. In my opinion user credentials matter for the actual communication between real persons. Device credentials are typically used where the device has some security of its own (say a DRM capability). In P2PSIP one of the purposes of enrollment (I guess) is to protect the peers (the "database" of registrations) against malicious nodes - so the purpose is close to what typically is achieved by device certificates. However, the process of enrollment is user-centric by definition, and we can assume very little of the devices and their capabilities (regarding security or trustworthiness). One of the conceptual challenges is to bridge this gap - we need to treat the user enrollment as a base for device "reliability", either one-to-one (as you seem to indicate) or using some other mechanism. 
 
In other words, at least I feel that the distinction between the two is fundamental, but unfortunately
the specification seems to have little choice than to end up with some form of equivalence between these two. Actually it is worse, since even the trust root of the user credential seems hard to pinpoint in any more specific terms than something related to the enrollment (server). If different P2PSIP systems have different enrollment processes, thus user trust roots, and they would also have different user identities (i.e. SIP addresses - names, whatever one wishes to call them). From this perspective, it seems that privacy would come to dominate over security and easy user name resolving. And in combination with low cost, this, as we all know is the perfect breeding ground for spam and other involuntary side-effects.  
 
Reg.
 
    Jan-Erik Ekberg
 
(I do not how the mailing lists are used, so I do not reply there. Feel free to forward if it is appropriate).

________________________________

From: ext Eric Cooper [mailto:[email-masked]]
Sent: Thu 8.3.2007 18:57
To: Matuszewski Marcin (Nokia-NRC/Helsinki); [email-masked]
Cc: Ekberg Jan-Erik (Nokia-NRC/Helsinki); Laitinen Pekka (Nokia-NRC/Helsinki)
Subject: Re: [P2PSIP] New draft on security threats in P2PSIP

Hi Marcin,

In reading your draft, I started to wonder about the connection between user credentials and device credentials.

Do you see the need to make a distinction between the two? Or is it sufficient for a user to authorize devices to act on his/her behalf?

I guess there can be tricky interaction here.  Just because I trust my PC for the purposes of making P2PSIP calls, does that mean that you should trust my PC to hold your AoR->contact bindings?

Best Regards,

Eric.

----- Original Message -----
From: <[email-masked]>
To: <[email-masked]>
Cc: <[email-masked]>; <[email-masked]>
Sent: Thursday, March 01, 2007 4:22 AM
Subject: [P2PSIP] New draft on security threats in P2PSIP

Hi all,

We recently submitted a new draft that describes security threats in
P2PSIP.

Title : Security requirements in P2PSIP
Author(s) : M. Matuszewski, et al.
Filename :
draft-matuszewski-p2psip-security-requirements-00.txt
Pages : 16
Date : 2007-2-28

   This document is an analysis of security threats in the Peer-to-Peer
   SIP reference model proposed in the P2PSIP concepts and terminology
   for P2PSIP document.  Typical security ontology is used as
   classification for the threats.  The main security goals for the
   architecture and its components are presented.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-matuszewski-p2psip-security-re
quirements-00.txt

Looking forward to your comments,

Marcin

--------------------------------------------------------------------------------

> _______________________________________________
> P2PSIP mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/p2psip
> 

_______________________________________________
P2PSIP mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/p2psip