Domain Certificates in the Session Initiation Protocol (SIP)
RFC 5922
Document | Type |
RFC - Proposed Standard
(June 2010; No errata)
Updates RFC 3261
|
|
---|---|---|---|
Authors | Bell Laboratories , Scott Lawrence , Vijay Gurbani | ||
Last updated | 2015-10-14 | ||
Replaces | draft-gurbani-sip-domain-certs | ||
Stream | IETF | ||
Formats | plain text html pdf htmlized bibtex | ||
Stream | WG state | (None) | |
Document shepherd | No shepherd assigned | ||
IESG | IESG state | RFC 5922 (Proposed Standard) | |
Consensus Boilerplate | Unknown | ||
Telechat date | |||
Responsible AD | Robert Sparks | ||
Send notices to | (None) |
Internet Engineering Task Force (IETF) V. Gurbani Request for Comments: 5922 Bell Laboratories, Alcatel-Lucent Updates: 3261 S. Lawrence Category: Standards Track ISSN: 2070-1721 A. Jeffrey Bell Laboratories, Alcatel-Lucent June 2010 Domain Certificates in the Session Initiation Protocol (SIP) Abstract This document describes how to construct and interpret certain information in a PKIX-compliant (Public Key Infrastructure using X.509) certificate for use in a Session Initiation Protocol (SIP) over Transport Layer Security (TLS) connection. More specifically, this document describes how to encode and extract the identity of a SIP domain in a certificate and how to use that identity for SIP domain authentication. As such, this document is relevant both to implementors of SIP and to issuers of certificates. Status of This Memo This is an Internet Standards Track document. This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It has received public review and has been approved for publication by the Internet Engineering Steering Group (IESG). Further information on Internet Standards is available in Section 2 of RFC 5741. Information about the current status of this document, any errata, and how to provide feedback on it may be obtained at http://www.rfc-editor.org/info/rfc5922. Gurbani, et al. Standards Track [Page 1] RFC 5922 Domain Certs June 2010 Copyright Notice Copyright (c) 2010 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License. Table of Contents 1. Introduction ....................................................3 2. Terminology .....................................................3 2.1. Key Words ..................................................3 3. Problem Statement ...............................................3 4. SIP Domain to Host Resolution ...................................5 5. The Need for Mutual Interdomain Authentication ..................6 6. Certificate Usage by a SIP Service Provider .....................7 7. Behavior of SIP Entities ........................................8 7.1. Finding SIP Identities in a Certificate ....................8 7.2. Comparing SIP Identities ...................................9 7.3. Client Behavior ...........................................10 7.4. Server Behavior ...........................................11 7.5. Proxy Behavior ............................................12 7.6. Registrar Behavior ........................................12 7.7. Redirect Server Behavior ..................................12 7.8. Virtual SIP Servers and Certificate Content ...............12 8. Security Considerations ........................................13 8.1. Connection Authentication Using Digest ....................13 9. Acknowledgments ................................................14 10. References ....................................................14 10.1. Normative References .....................................14 10.2. Informative References ...................................15 Appendix A. Editorial Guidance (Non-Normative) ...................16 A.1. Additions .................................................16 A.2. Changes ...................................................16 A.2.1. Changes to Section 26.3.1 .............................16 Gurbani, et al. Standards Track [Page 2] RFC 5922 Domain Certs June 2010 1. Introduction RFC 5246 [5] Transport Layer Security (TLS) is available in an increasing number of Session Initiation Protocol (SIP) RFC 3261 [2] implementations. In order to use the authentication capabilities of TLS, certificates as defined by the Internet X.509 Public Key Infrastructure, see RFC 5280 [6], are required. Existing SIP specifications do not sufficiently specify how to useShow full document text