Subject: [dispatch] Updated version of SIP DANE brainstorm

From: "Olle E. Johansson" <[email-masked]>
Date: Thu, 4 Jul 2013 14:46:12 +0200

Hi!

I've updated my brainstorm of SIP & Dane. The new version can be found here:
http://www.slideshare.net/oej/sip-dane

Changes:
- Clarified TLSA records and validation (Cullen, Victor)
- Added thoughts on SIP connection reuse

SIP connection reuse is the art form of re-using a TLS connection between two SIP servers for more than one destination - in the case of SIP hosting with multiple domains.
The current RFC is based on exchanging server and client certificates with a list of domains in the SubjAltName field. 

With DANE, there will be only the SRV host name. The server needs to look up domains and if there's a secure delegation from a new domain to a hostname where
the server has a connection, add the domain to the domain table for that connection and reuse it.

Now the question is raised in my head - what about the client certificate?

We get a connection from an IP address and request a client certificate. Is it really needed? In the current RFC it's a requirement.

Server for example.com gets a connection from serverb.example.net. The example.com domain relationship to the actual host srv02.example.com
was verified using DANE and the cert validated correctly.

Now if example.com has a SIP request addressed to example.net - it checks DNS and gets DNSsec signed responses that points to serverb.example.net.
Is this enough to reuse the existing TLS connection for requests to example.net?

Or do we need a certificate on top of this somewhere?

/O

References:
- RFC 5923 describes SIP connection reuse
- RFC 5922 defines SIP domain certificates