Subject: RE: [Simple] Sessions of MESSAGEs

From: Jonathan Rosenberg <[email-masked]>
Date: Tue, 21 Aug 2001 15:22:51 -0400

> -----Original Message-----
> From: Robert Brown [mailto:[email-masked]]
> Sent: Tuesday, August 21, 2001 3:13 PM
> To: Jonathan Rosenberg; Vasilis Polychronidis; Robert Osborne
> Cc: Zane Thomas; [email-masked]
> Subject: RE: [Simple] Sessions of MESSAGEs
> 
> 
> Huh?
> 
> I don't see how this is anything like how the web works.  Very few web
> users have certs for TLS, except for a very few specialized 
> cases where
> they are used for user auth.

I think we are talking past each other.

In my proposal, there *is* a server in the public network. This server is
needed for nat traversal if both are behind a nat. In that case, each client
would have a tls connection to that server, and it is only the server which
needs to have a cert. This is standard web stuff, and thats what I was
talking about.

In the case of direct communication between clients, yes, this will be an
issue for TLS as it would require client certs, which is not that common.
This is a problem shared by all e2e encryption/authentication mechanisms.
There is work on defining SDP extensions for negotiation of session keys
(primarily for SRTP), and some of the key management mechanisms don't
require certs, but rather, just shared secrets. It would be nice to be able
to use that key management stuff for transport beyond SRTP, such as whatever
we define for IM.

However, if you want secure IM and trust that server in the cloud, you can
simply elect not to use direct communications even if possible. The
signaling mechanisms in entfw and the drafts it depends on (i.e., comedia)
support that.

So, you get best of both worlds, from what I can tell....

-Jonathan R.
---
Jonathan D. Rosenberg, Ph.D.                72 Eagle Rock Ave.
Chief Scientist                             First Floor
dynamicsoft                                 East Hanover, NJ 07936
[email-masked]                     FAX:   (973) 952-5050
http://www.jdrosen.net                      PHONE: (973) 952-5000
http://www.dynamicsoft.com

---

From: "Henning G. Schulzrinne" <[email-masked]>
Date: Sat, 01 Sep 2001 17:30:58 -0400

SASL seems like the right mechanism for TCP-based connections.

Jonathan Rosenberg wrote:

-- 
Henning Schulzrinne   http://www.cs.columbia.edu/~hgs