Subject: Re: [dispatch] E2E Secure Messaging for SIP/SIMPLE

From: Christer Holmberg <[email-masked]>
Date: Mon, 6 Nov 2017 15:21:13 +0000

Hi,

A few initial comments:

Q1:

The text says:

"This document discusses the use of S/MIME with SIP based messaging.²

However, the document also covers MSRP, and I don¹t know if that counts as
³SIP based². Perhaps it would be better to explicitly say ³SIP based
messaging and MSRP², ³SIP- and MSRP based messaging², or something?

Q2:

While section 4 describes the applicability of S/MIME, I think it would be
good to mention in section 1 and/or 3 exactly what encryption you are
talking about (i.e., encryption of bodies/content).

Q3:

Section 3 says:

"encryption across a session of messages"

What does that mean?

Thanks!

Regards,

Christer

On 31/10/17 20:47, "dispatch on behalf of Ben Campbell"
<[email-masked] on behalf of [email-masked]> wrote:

>(strictly as an individual)
>
>Hi everyone,
>
>Russ and I submitted a draft [1] on the use of S/MIME for the SIP MESSAGE
>method and for MSRP. It mainly offers clarifications of the S/MIME
>guidance in RFCs 3261, 3428, and 4975, but it also makes a few updates.
>
>The main use case we have in mind is for where organizations want to send
>secure notifications to their users. For example, financial organizations
>send transaction notices, organizations send password update notices, 2FA
>notices, etc. Much of that is currently done over various mobile
>messaging systems (SMS, etc). Most of that is done with no e2e
>authentication or integrity protection. We¹d like to enable at least
>end-to-end signed messaging for SIP based mobile messaging systems.
>
>We would appreciate it if people would take a look, and send your
>comments.
>
>[1] https://tools.ietf.org/html/draft-campbell-sip-messaging-smime-00
>
>Thanks!
>
>Ben.

---

From: Ben Campbell <[email-masked]>
Date: Mon, 6 Nov 2017 09:43:01 -0600

Thanks for the comments! Responses inline:

> On Nov 6, 2017, at 9:21 AM, Christer Holmberg <[email-masked]> wrote:
> 
> Hi,
> 
> A few initial comments:
> 
> Q1:
> 
> The text says:
> 

You are probably right. We were trying to keep the description short, but it’s probably too short.

> talking about (i.e., encryption of bodies/content).

Agreed.

> "encryption across a session of messages"

This is talking about negotiating a session encryption key, where all (or some) of the messages sent over an MSRP session are encrypted with the same key. We will clarify.

Thanks!

Ben.