Subject: RE: [Enum] Non-Terrminal NAPTRs Considered Harmful

From: "Stastny Richard" <[email-masked]>
Date: Thu, 23 Jun 2005 06:09:40 -0400

Jim,

> The ENUM version
> would of course be concerned with unreachable URIs. Or URI end points
> that have access control filters in front of them. Technically, these
> are generally reachable: they're just not accessible to everyone.

Pls read RFC3764 Enumservice SIP 6. Security Considerations:
(from our esteemed AD)

...
Unlike a traditional telephone number, the resource identified by a
SIP URI may require that callers provide cryptographic credentials
for authentication and authorization before a user is alerted.
...

Regards

Richard

Richard Stastny
OeFEG
tel:+43 664 420 4100
enum:+43 780 203 211
callto://fordprefect
http://voipandenum.blogspot.com
 
<snip>

_______________________________________________
enum mailing list
enum at ietf.org
https://www1.ietf.org/mailman/listinfo/enum

---

From: Jim Reid <[email-masked]>
Date: Thu, 23 Jun 2005 06:32:18 -0400

On Jun 23, 2005, at 11:08, Stastny Richard wrote:
The ENUM version
would of course be concerned with unreachable URIs. Or URI end points
that have access control filters in front of them. Technically, these
are generally reachable: they're just not accessible to everyone.
Pls read RFC3764 Enumservice SIP 6. Security Considerations:
(from our esteemed AD)
...
Unlike a traditional telephone number, the resource identified by a
SIP URI may require that callers provide cryptographic credentials
for authentication and authorization before a user is alerted.
Richard, I have read RFC3764. What you've quoted above is different 
from what I was talking about. It is of course right and proper for SIP 
servers (or whatever) to insist on authenticating and validating their 
clients by whatever means they choose: secret handshakes, certificates, 
SSH keys, etc. etc. Access filters typically block incoming traffic 
based on the source address. This was what Michael was (indirectly) 
referring to. In these cases the filters prevent clients from speaking 
to the servers so the clients don't get the opportunity to authenticate 
themselves to those servers.

BTW, I've trimmed the address list since everyone named is already on 
enum at ietf.org.