[VOIPSEC] Using SRTP for University project

[Hadriel Kaplan]

> -----Original Message-----
> From: Voipsec-bounces at voipsa.org [mailto:Voipsec-bounces at voipsa.org] On
> Behalf Of Mark Baugher
> Sent: Monday, March 27, 2006 12:16 PM
> To: Cesc Santasusana
> Cc: Voipsec at voipsa.org; Christian.Stredicke at snom.de
> Subject: Re: [VOIPSEC] Using SRTP for University project
> 
> I expect that we are still a long way off from the final key
> establishment and key management solutions for IP telephony.  Whether
> or not sdesc is the final answer is far from certain.  Regarding
> security, those who have read the latest sdescriptions draft should
> recognize that S/MIME is required for end-to-end security through
> intermediate systems, even S/MIME with self-signed certificates and a
> user-to-user authentication procedure (e.g. reading the fingerprint
> of the public key over the phone) offers good security.  Why don't we
> use this as the interim solution for those implementations that are
> using sdesc?

S/MIME is only "required" if you don't trust the intermediate systems to
follow sips rules.  If that's true, you're probably in a world of hurt
anyway.  And you don't seriously expect people to read out hex values over
the phone before talking, do you?  Somehow I think that will make for a lot
more car accidents due to cell phones.  :)

(note I'm talking about the 99.9% population, not the DoD)

> I have heard from a few persons that S/MIME is not deployable, but I
> have not yet heard from anyone who has tried to deploy it.  I'd be
> interested in hearing about those experience.

It depends on your application.  If you want your sip call to work through
most service providers (and my guess is enterprises) today, and in the
foreseeable future, then s/mime won't work. So why would you use a mechanism
which only works inside your own environment?

> But if you're sending the keys in the clear through multiple proxies,
> this is not a secure solution.  I agree with that.

Agreed.  Hence SIPS, i.e. TLS, or stronger is mandated.

-hadriel