Subject: [P2PSIP] New draft on security threats in P2PSIP

From: <[email-masked]>
Date: Thu, 1 Mar 2007 11:22:57 +0200

Hi all,

We recently submitted a new draft that describes security threats in
P2PSIP. 

Title		: Security requirements in P2PSIP
	Author(s)	: M. Matuszewski, et al.
	Filename	:
draft-matuszewski-p2psip-security-requirements-00.txt
	Pages		: 16
	Date		: 2007-2-28
	
   This document is an analysis of security threats in the Peer-to-Peer
   SIP reference model proposed in the P2PSIP concepts and terminology
   for P2PSIP document.  Typical security ontology is used as
   classification for the threats.  The main security goals for the
   architecture and its components are presented.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-matuszewski-p2psip-security-re
quirements-00.txt

Looking forward to your comments,

Marcin

_______________________________________________
P2PSIP mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/p2psip

---

From: "Eric Cooper" <[email-masked]>
Date: Thu, 8 Mar 2007 11:57:17 -0500

SGkgTWFyY2luLA0KDQpJbiByZWFkaW5nIHlvdXIgZHJhZnQsIEkgc3RhcnRlZCB0byB3b25kZXIgYWJvdXQgdGhlIGNvbm5lY3Rpb24gYmV0d2VlbiB1c2VyIGNyZWRlbnRpYWxzIGFuZCBkZXZpY2UgYSA6IFguIEppYW5nDQo+PiBGaWxlbmFtZSA6IGRyYWZ0LWppYW5nLXAycHNpcC1wZWVyLXByb3RvY29sLXJlcXVpcmVtZW50LTAwLnR4dA0KPj4gUGFnZXMgOiAxOA0KPj4gRGF0ZSA6IDIwMDctMi0yNg0KPj4gDQo+PiAgIEluIHRoaXMgZHJhZnQsIHdlIHByZXNlbnQgd2hhdCBQMlBTSVAgc2hvdWxkIGFjaGlldmUgLSBhIGRpc3RyaWJ1dGVkDQo+PiAgIGxvY2F0aW9uIHNlcnZpY2UuICBUaGVuIHdlIGNvbXBhcmUgdGhlIGRpZmZlcmVuY2VzIGJldHdlZW4gQy9TIFNJUA0KPj4gICBhbmQgUDJQIFNJUCBhbmQgcG9pbnQgb3V0IHRoYXQgc29tZSBmZWF0dXJlcyB3aGljaCBhcmUgbm90DQo+PiAgIHN0YW5kYXJkaXplZCBpbiBDL1MgU0lQIHNob3VsZCBiZSBhZGRyZXNzZWQgaW4gdGhlIFAyUCBTSVAgY2FzZS4NCj4+ICAgQWZ0ZXIgYW5hbHl6aW5nIHNvbWUgcHJvYmxlbXMsIHNvbWUgcmVxdWlyZW1lbnRzIG9mIFBlZXIgcHJvdG9jb2wgYXJlDQo+PiAgIHByb3Bvc2VkLg0KPj4gDQo+PiANCj4+IA0KPj4gQSBVUkwgZm9yIHRoaXMgSW50ZXJuZXQtRHJhZnQgaXM6DQo+Pg0KPiBodHRwOi8vd3d3LmlldGYub3JnL2ludGVybmV0LWRyYWZ0cy9kcmFmdC1qaWFuZy1wMnBzaXAtcGVlci1wcm90b2NvbC1yZXF1aXJlDQo+IG1lbnQtMDAudHh0DQo+IC0tDQo+IEppYW5nIFhpbmdGZW5nDQo+IA0KPiANCj4gDQo+IF9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQo+IFAyUFNJUCBtYWlsaW5nIGxpc3QNCj4gUDJQU0lQQGlldGYub3JnDQo+IGh0dHBzOi8vd3d3MS5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3AycHNpcA0KPg==--===============1454688779==Content-Type: text/plain; charset="us-ascii"MIME-Version: 1.0Content-Transfer-Encoding: 7bitContent-Disposition: inline_______________________________________________P2PSIP mailing [email-masked]://www1.ietf.org/mailman/listinfo/p2psip--===============1454688779==--

---

From: "Eric Cooper" <[email-masked]>
Date: Thu, 8 Mar 2007 11:57:17 -0500

Hi Marcin,

In reading your draft, I started to wonder about the connection between user credentials and device credentials.

Do you see the need to make a distinction between the two? Or is it sufficient for a user to authorize devices to act on his/her behalf?

I guess there can be tricky interaction here.  Just because I trust my PC for the purposes of making P2PSIP calls, does that mean that you should trust my PC to hold your AoR->contact bindings?

Best Regards,

Eric.

----- Original Message ----- 
From: <[email-masked]>
To: <[email-masked]>
Cc: <[email-masked]>; <[email-masked]>
Sent: Thursday, March 01, 2007 4:22 AM
Subject: [P2PSIP] New draft on security threats in P2PSIP

Hi all,

Marcin

--------------------------------------------------------------------------------