Subject: RE: CPLng (was [IPTEL] agenda items)

From: Jonathan Rosenberg <[email-masked]>
Date: Wed, 29 Nov 2000 23:49:42 -0500

I agree that there is a use for authentication-switch. In fact, when I first
implemented CPL back at Bell Labs, I added some stuff that I needed to make
it a more administrator-centric language. One of them was, in fact,
authentication switch as Jiri has described.

I believe the authentication-switch can be independent of the mechanism. I
do not like the model of using CPL to convey shared secrets and the like, as
Jiri has done. THese things need to be configured separately on the server,
as they are orthogonal to CPL.

What makes sense to me is something like:

<authentication-switch realm="myfriends">
   <failure>
      do something
   </failure>
   <no-credentials>
      do something
   </no-credentials>
   <cleartext-password>
      go here if the authentication was with cleartext pass
   </cleartext-password>
   <digest-password>
      go here if the authentication was with digest password
   </digest-password>
   <public>
      go here if this was a public key verification
   </public>
</authentication-switch>

The tokens "cleartext-password", "digest-password", and "public" could refer
to classes of algorithms; we would map actual algorithsm to one of these
(PGP and S/MIME to "public", for example).

-Jonathan R.

> -----Original Message-----
> From: Henning G. Schulzrinne [mailto:[email-masked]]
> Sent: Tuesday, November 28, 2000 5:04 PM
> To: Jiri Kuthan
> Cc: Jonathan Lennox; Jonathan Rosenberg; [email-masked]'
> Subject: Re: CPLng (was [IPTEL] agenda items)
> 
> 
> Jiri Kuthan wrote:
> > 
> > Jonathan Lennox wrote:
> > > Unfortunately, this is a bigger problem than just for 
> CPL.  While I would
> > > love to have some way of switching on authenticated 
> addresses in CPL, it
> > > first needs to be figured out how to do this in IP 
> telephony in gneeral, or
> > > at least in specific protocals such as SIP.  Once a 
> framework for this is
> > > worked out, we can figure out how best to map these 
> things into CPL.
> > >
> > > I don't think IPTel is the right forum for doing this 
> sort of thing, though
> > > certainly the needs of a CPL authentication switch would 
> be a major
> > > requirement sent as input to that process. [...]
> > 
> > Actually, I'd like to have authentication switching dependent on
> > authentication id and independent on authentication mechanism. The
> > place where mechanism-dependencies is unavoidable is the credential
> > database.
> > 
> > The authentication switch can be specified at iptel because it is
> > independent on the mechanism. Authentication protocols come and go
> > and should not affect authentication switching. I'm not sure what
> > the most appropriate place for working on a specification of the
> > credential database format is.
> 
> In practice, this is not likely to be as big a deal. Authentication at
> CPL level is primarily useful for rejecting spammers, as 
> mentioned, and
> possibly to give access to otherwise restricted destinations to
> 'special' people. For that, we have three levels of 
> 
> - make sure the caller can be reached - to prevent the SIP version of
> kids ringing doorbells and running away
> 
> - make sure that the caller's SIP or H.323 address is legitimate. One
> could, for example, build a UA that doesn't accept calls, but rather
> returns the INVITE with the same Call-ID or other token to the caller.
> Assuming intercept is not likely, this is reasonably secure 
> and requires
> no PKI.
> 
> - set up secrets ahead of time, by (e.g.,) emailing them to 
> the caller,
> similar to how most level-1 certificates work
> 
> - full-fledged PKI. Not likely except in closed communities, i.e., at
> best useful for the second application of authentication.
> 
> CPL doesn't have to know anything about the details, just needs to
> convey the level of authentication used to verify the 
> identity, allowing
> the script to make appropriate choices.
> 
> > 
> > The idea behind that particular proposal is to enable 
> accessing the lists
> > from any place (address switches, string switches, 
> whatever) without changing
> > CPL's syntax. The hack is to indicate with an escape 
> sequence that a value
> > should be interpreted as a reference to a list. E.g.,
> >   <address is="@@http://www.nospam.org/badguys.txt">
> >         <reject/>
> > 
> > I do not insist on this particular syntax, other ideas are 
> appreciated.
> 
> I have to admit that I find this type of URL special-casing less than
> savory. If you want to check for a list, create a new qualifier other
> than 'is'.
> 
> 
> -- 
> Henning Schulzrinne   http://www.cs.columbia.edu/~hgs
> 
---
Jonathan D. Rosenberg                       72 Eagle Rock Ave.
Chief Scientist                             First Floor
dynamicsoft                                 East Hanover, NJ 07936
[email-masked]                     FAX:   (973) 952-5050
http://www.cs.columbia.edu/~jdrosen         PHONE: (973) 952-5000
http://www.dynamicsoft.com

_______________________________________________
IPTEL mailing list
[email-masked]
http://lists.bell-labs.com/mailman/listinfo/iptel