Subject: [Simple] Message Sessions: Security as a motivation

From: Adam Roach <[email-masked]>
Date: Mon, 7 Apr 2003 18:47:25 -0500

The message sessions draft talks about a downfall of
pager-mode being that secure transport of messages in
SIP requires some PKI, and then go on to say that symetric
key exchange can be performed at session initiation.
It is not clear to me how such key exchange can be performed.
It's either in the clear (in which case you're really
not any better off than if you don't encrypt the MSRP), or
it uses TLS or S/MIME. Both of which require a PKI.

More concisely: It seems to me that if you can exchange
keys securely in SIP, then you can exchange IMs securely
in SIP. If you can't, you can't.  While I think that there
are plenty of good reasons to do message sessions, I fear
that this particular motivation is bit of a red herring.

/a
_______________________________________________
Simple mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/simple

---

From: Ben Campbell <[email-masked]>
Date: 07 Apr 2003 20:20:01 -0500

I think the real intent of the draft was poorly worded. The point was
that with message sessions, you could do a single key exchange for the
whole session, while with page mode, you must do a key exchange per
message. (if you are willing to call the session key generation of
s/mime a key-exchange. But it takes a PK operation either way.)