Subject: [Ecrit] IPsec

From: "Rosen, Brian" <[email-masked]>
Date: Thu, 28 Jul 2011 14:01:05 -0400

I forgot an item, sigh.  I said there would be another version…

Stephen Farrell objected to our text on allowing either IPsec or TLS, because the usual concerns about implementors making non interoperable choices.

My solution is to change ED-48/SP-24 to:
Either TLS or IPsec MUST be used to protect location (but see Section ??).  All implementations MUST support TLS.  IPsec MAY be used instead of TLS on any hop.

Brian

---

From: "Richard L. Barnes" <[email-masked]>
Date: Thu, 28 Jul 2011 14:09:22 -0400

Note that the following already exists in RFC 3261:
"
Proxy servers, redirect servers, and registrars MUST implement TLS,
and MUST support both mutual and one-way authentication.  It is
strongly RECOMMENDED that UAs be capable initiating TLS; UAs MAY also
be capable of acting as a TLS server.
"

Could we just refer to this?

--Richard

On Jul 28, 2011, at 2:01 PM, Rosen, Brian wrote:

> _______________________________________________
> Ecrit mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ecrit

---

From: "Rosen, Brian" <[email-masked]>
Date: Thu, 28 Jul 2011 14:15:36 -0400

I may have to pass that by Stephen, because it doesn't require it at the UA.

Brian

---

From: "James M. Polk" <[email-masked]>
Date: Thu, 28 Jul 2011 13:21:39 -0500

Richard

3261 saying SIP servers "...MUST implement 
TLS..." and "...strongly RECOMMENDED that UAs use 
TLS..." is very different than Phonebcp now 
saying "...UAs MUST support TLS." and "...IPsec MAY be used per hop..."

I like what phonebcp says now.

James

At 01:09 PM 7/28/2011, Richard L. Barnes wrote:
> > Stephen Farrell objected to our text on 
> allowing either IPsec or TLS, because the usual 
> concerns about implementors making non interoperable choices.
> >
> > Either TLS or IPsec MUST be used to protect 
> location (but see Section ??).  All 
> implementations MUST support TLS.  IPsec MAY be used instead of TLS on any hop.
> >
> > Brian