--- 1/draft-ietf-speermint-architecture-15.txt 2010-11-08 16:15:43.000000000 +0100 +++ 2/draft-ietf-speermint-architecture-16.txt 2010-11-08 16:15:43.000000000 +0100 @@ -1,19 +1,19 @@ SPEERMINT D. Malas, Ed. Internet-Draft CableLabs Intended status: Informational J. Livingood, Ed. Expires: May 12, 2011 Comcast November 8, 2010 SPEERMINT Peering Architecture - draft-ietf-speermint-architecture-15 + draft-ietf-speermint-architecture-16 Abstract This document defines a peering architecture for the Session Initiation Protocol (SIP) [RFC3261], it's functional components and interfaces. It also describes the components and the steps necessary to establish a session between two SIP Service Provider (SSP) peering domains. Status of this Memo @@ -291,23 +291,23 @@ 5.1.2.1. DNS Resolution The originating (or indirect) SSP uses the procedures in Section 4 of [RFC3263] to determine how to contact the receiving SSP. To summarize the [RFC3263] procedure: unless these are explicitly encoded in the target URI, a transport is chosen using NAPTR records, a port is chosen using SRV records, and an address is chosen using A or AAAA records. When communicating with another SSP, entities compliant to this - document should select a TLS-protected transport [RFC4366] for - communication from the originating (or indirect) SSP to the receiving - SSP if available. + document should select a TLS-protected transport for communication + from the originating (or indirect) SSP to the receiving SSP if + available, as described further in Section 5.2.1. 5.1.2.2. Routing Table If there are no End User ENUM records and the originating (or indirect) SSP cannot discover the carrier-of-record or if the originating (or indirect) SSP cannot reach the carrier-of-record via SIP peering, the originating (or indirect) SSP may deliver the call to the PSTN or reject it. Note that the originating (or indirect) SSP may forward the call to another SSP for PSTN gateway termination by prior arrangement using the routing table. @@ -361,25 +361,26 @@ Once a trust relationship between the peers is established, the originating (or indirect) SSP sends the request. 5.2. Target SSP Procedures This section describes the Target SSP Procedures. 5.2.1. TLS - The section defines uses of TLS [RFC4366] between two SSPs [RFC5246]. - When the receiving SSP receives a TLS client hello, it responds with - its certificate. The Target SSP certificate should be valid and - rooted in a well-known certificate authority. The procedures to - authenticate the SSP's originating domain are specified in [RFC5922]. + The section defines uses of TLS between two SSPs [RFC5246] [RFC5746] + [RFC5878]. When the receiving SSP receives a TLS client hello, it + responds with its certificate. The Target SSP certificate should be + valid and rooted in a well-known certificate authority. The + procedures to authenticate the SSP's originating domain are specified + in [RFC5922]. The SF of the Target SSP verifies that the Identity header is valid, corresponds to the message, corresponds to the Identity-Info header, and that the domain in the From header corresponds to one of the domains in the TLS client certificate. 5.2.2. Receive SIP Requests Once a trust relationship is established, the Target SSP is prepared to receive incoming SIP requests. For new requests (dialog forming @@ -508,20 +509,22 @@ Global Crossing Rochester, NY - USA Email: adam.uzelac@globalcrossing.com 11. Change Log NOTE TO RFC EDITOR: PLEASE REMOVE THIS SECTION PRIOR TO PUBLICATION. + o 16: Yes, one final outdated reference to fix. + o 15: Doh! Uploaded the wrong doc to create -14. Trying again. :-) o 14: WGLC ended. Ran final nits check prior to sending proto to the AD and sending the doc to the IESG. Found a few very minor nits, such as capitalization and replacement of an obsoleted RFC, which were corrected per nits tool recommendation. The -14 now moves to the AD and the IESG. o 13: Closed out all remaining tickets, resolved all editorial notes. @@ -533,32 +536,34 @@ up some of the XML for references. A real revision is coming soon. 12. Open Issues NOTE TO RFC EDITOR: PLEASE REMOVE THIS SECTION PRIOR TO PUBLICATION. o NONE! 13. References + 13.1. Normative References [I-D.ietf-speermint-requirements] Mule, J., "Requirements for SIP-based Session Peering", draft-ietf-speermint-requirements-10 (work in progress), October 2010. [I-D.ietf-speermint-voipthreats] Seedorf, J., Niccolini, S., Chen, E., and H. Scholz, - "SPEERMINT Security Threats and Suggested - Countermeasures", draft-ietf-speermint-voipthreats-05 - (work in progress), September 2010. + "Session Peering for Multimedia Interconnect (SPEERMINT) + Security Threats and Suggested Countermeasures", + draft-ietf-speermint-voipthreats-06 (work in progress), + November 2010. [RFC1918] Rekhter, Y., Moskowitz, R., Karrenberg, D., Groot, G., and E. Lear, "Address Allocation for Private Internets", BCP 5, RFC 1918, February 1996. [RFC3261] Rosenberg, J., Schulzrinne, H., Camarillo, G., Johnston, A., Peterson, J., Sparks, R., Handley, M., and E. Schooler, "SIP: Session Initiation Protocol", RFC 3261, June 2002. @@ -574,31 +579,34 @@ Initiation Protocol (SIP) Addresses-of-Record", RFC 3764, April 2004. [RFC3861] Peterson, J., "Address Resolution for Instant Messaging and Presence", RFC 3861, August 2004. [RFC3953] Peterson, J., "Telephone Number Mapping (ENUM) Service Registration for Presence Services", RFC 3953, January 2005. - [RFC4366] Blake-Wilson, S., Nystrom, M., Hopwood, D., Mikkelsen, J., - and T. Wright, "Transport Layer Security (TLS) - Extensions", RFC 4366, April 2006. - [RFC5246] Dierks, T. and E. Rescorla, "The Transport Layer Security (TLS) Protocol Version 1.2", RFC 5246, August 2008. [RFC5486] Malas, D. and D. Meyer, "Session Peering for Multimedia Interconnect (SPEERMINT) Terminology", RFC 5486, March 2009. + [RFC5746] Rescorla, E., Ray, M., Dispensa, S., and N. Oskov, + "Transport Layer Security (TLS) Renegotiation Indication + Extension", RFC 5746, February 2010. + + [RFC5878] Brown, M. and R. Housley, "Transport Layer Security (TLS) + Authorization Extensions", RFC 5878, May 2010. + [RFC5922] Gurbani, V., Lawrence, S., and A. Jeffrey, "Domain Certificates in the Session Initiation Protocol (SIP)", RFC 5922, June 2010. 13.2. Informative References [I-D.ietf-speermint-voip-consolidated-usecases] Uzelac, A. and Y. Lee, "VoIP SIP Peering Use Cases", draft-ietf-speermint-voip-consolidated-usecases-18 (work in progress), April 2010.