Hello, does FreeSWITCH support MIKEY? If not, is it scheduled? Which key exchange methods does it support? What about the soft and hard phones on the market? What's the preferred method for key exchange there? Regards, -- Alois Komenda Fraunhofer-Einrichtung für Systeme der Kommunikationstechnik ESK
Right now we do SDES which is described in RFC4568. If we wanted to do MIKEY someone would either have to write a license compatible MIKEY library. I do know its low on the priority list unless someone wants to fund the work to move it up on the priority list. Can you provide me the reasoning behind MIKEY and justify its use? What devices support it? Thanks, Brian On Jan 24, 2008, at 8:33 AM,License Komenda wrote:
Hello,
does FreeSWITCH support MIKEY? If not, is it scheduled? Which key exchange methods does it support?
What about the soft and hard phones on the market? What's the preferred method for key exchange there?
Regards, -- Alois Komenda Fraunhofer-Einrichtung für Systeme der Kommunikationstechnik ESK
_______________________________________________ Freeswitch-users mailing list Freeswitch-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
I don't think SDES over TLS can be called secure. And according to RFC 4568 this combination should not be used. (Anyway this seems to be the mostly used configuration at the moment.) Even if MIKEY is not a perfect soloution for the problem, it provides end-to-end security for keying material. Regards -- Alois Komenda Fraunhofer-Einrichtung für Systeme der Kommunikationstechnik ESK -----Ursprüngliche Nachricht----- Von: freeswitch-users-bounces@lists.freeswitch.org [mailto:freeswitch-users-bounces@lists.freeswitch.org] Im Auftrag von Brian West Gesendet: Donnerstag, 24. Januar 2008 21:35 An: freeswitch-users@lists.freeswitch.org Betreff: Re: [Freeswitch-users] MIKEY-Support Right now we do SDES which is described in RFC4568. If we wanted to do MIKEY someone would either have to write a license compatible MIKEY library. I do know its low on the priority list unless someone wants to fund the work to move it up on the priority list. Can you provide me the reasoning behind MIKEY and justify its use? What devices support it? Thanks, Brian On Jan 24, 2008, at 8:33 AM,License Komenda wrote:
Hello,
does FreeSWITCH support MIKEY? If not, is it scheduled? Which key exchange methods does it support?
What about the soft and hard phones on the market? What's the preferred method for key exchange there?
Regards, -- Alois Komenda Fraunhofer-Einrichtung für Systeme der Kommunikationstechnik ESK
_______________________________________________ Freeswitch-users mailing list Freeswitch-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-use rs http://www.freeswitch.org
_______________________________________________ Freeswitch-users mailing list Freeswitch-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
How on earth is it not secure? The keys are exchanged over a secure TLS channel. That is secure. Read section 8.3 again. "Thus, IT IS REQUIRED that MIME secure multiparts, IPsec, TLS, or some other data security service be used to provide message authentication for the encapsulating protocol that carries the SDP messages having a crypto attribute (a=crypto)." It does however say in 8.3 "When the communication path of the SDP message is routed through intermediate systems that inspect parts of the SDP message, security protocols such as [IPsec] or TLS SHOULD NOT be used for encrypting and/ or authenticating the security description." This can clearly be seen don't trust it if TLS isn't used end to end for the sip signaling channel. SDES seems to be the most widely used method at this point as you pointed out. I feel the security afforded by using SDES + TLS is way more than you'll ever get elsewhere. We do accept patches. ;) /b On Jan 25, 2008, at 12:15 AM, Alois Komenda wrote:
I don't think SDES over TLS can be called secure. And according to RFC 4568 this combination should not be used. (Anyway this seems to be the mostly used configuration at the moment.)
Even if MIKEY is not a perfect soloution for the problem, it provides end-to-end security for keying material.
Regards
-- Alois Komenda Fraunhofer-Einrichtung für Systeme der Kommunikationstechnik ESK
How can you ever be sure TLS is really used end-to-end? Even if TLS is used "end-to-end" i.e. on every hop, every involved proxy can read your keys. So if you can trust all proxys that route your messages, SDES is secure. -- Alois Komenda Fraunhofer-Einrichtung für Systeme der Kommunikationstechnik ESK -----Ursprüngliche Nachricht----- Von: freeswitch-users-bounces@lists.freeswitch.org [mailto:freeswitch-users-bounces@lists.freeswitch.org] Im Auftrag von Brian West Gesendet: Freitag, 25. Januar 2008 12:09 An: freeswitch-users@lists.freeswitch.org Betreff: Re: [Freeswitch-users] MIKEY-Support How on earth is it not secure? The keys are exchanged over a secure TLS channel. That is secure. Read section 8.3 again. "Thus, IT IS REQUIRED that MIME secure multiparts, IPsec, TLS, or some other data security service be used to provide message authentication for the encapsulating protocol that carries the SDP messages having a crypto attribute (a=crypto)." It does however say in 8.3 "When the communication path of the SDP message is routed through intermediate systems that inspect parts of the SDP message, security protocols such as [IPsec] or TLS SHOULD NOT be used for encrypting and/ or authenticating the security description." This can clearly be seen don't trust it if TLS isn't used end to end for the sip signaling channel. SDES seems to be the most widely used method at this point as you pointed out. I feel the security afforded by using SDES + TLS is way more than you'll ever get elsewhere. We do accept patches. ;) /b On Jan 25, 2008, at 12:15 AM, Alois Komenda wrote:
I don't think SDES over TLS can be called secure. And according to RFC 4568 this combination should not be used. (Anyway this seems to be the mostly used configuration at the moment.)
Even if MIKEY is not a perfect soloution for the problem, it provides end-to-end security for keying material.
Regards
-- Alois Komenda Fraunhofer-Einrichtung für Systeme der Kommunikationstechnik ESK
_______________________________________________ Freeswitch-users mailing list Freeswitch-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Alois, Can you break down what mikey is, what it does exactly and what devices if any support it? Seems MIKEY came out in 2004 and SDES came out in 2006 and more devices do SDES. /b On Jan 25, 2008, at 4:20 AM, Alois Komenda wrote:
How can you ever be sure TLS is really used end-to-end? Even if TLS is used "end-to-end" i.e. on every hop, every involved proxy can read your keys.
So if you can trust all proxys that route your messages, SDES is secure.
-- Alois Komenda Fraunhofer-Einrichtung für Systeme der Kommunikationstechnik ESK
MIKEY in very few words: Multimedia Internet KEYing (MIKEY) is a secure key exchange protocol. It is not SIP-specific but independent from the signalling protocol. In the specifying RFC 3830 there are three methods mentioned how the session key can be transmitted securely: - Pre-shared key (mandatory) - Public key (mandatory) - Diffie-Hellman (optional) Every one of these methods has its downside. (For PSK you need a separate channel to transmit the key; With Public Keys you need a PKI; DH is computationally intesnive and is not mandatory to implement.) But you don't need secure signalling for the key exchange with MIKEY. There are extensions for more key exchange methods: - DH HMAC (RFC 4650): Kombination of Diffie-Hellman and HMAC; Needs a pre-shared key - MIKEY RSA-R (RFC 4738): [Haven't evaluated this one yet] I don't know any device using MIKEY. But that does not necessarily mean anything because I have not been looking at many devices. -- Alois Komenda Fraunhofer-Einrichtung für Systeme der Kommunikationstechnik ESK -----Ursprüngliche Nachricht----- Von: freeswitch-users-bounces@lists.freeswitch.org [mailto:freeswitch-users-bounces@lists.freeswitch.org] Im Auftrag von Brian West Gesendet: Freitag, 25. Januar 2008 18:18 An: freeswitch-users@lists.freeswitch.org Betreff: Re: [Freeswitch-users] MIKEY-Support Alois, Can you break down what mikey is, what it does exactly and what devices if any support it? Seems MIKEY came out in 2004 and SDES came out in 2006 and more devices do SDES. /b On Jan 25, 2008, at 4:20 AM, Alois Komenda wrote:
How can you ever be sure TLS is really used end-to-end? Even if TLS is used "end-to-end" i.e. on every hop, every involved proxy can read your keys.
So if you can trust all proxys that route your messages, SDES is secure.
-- Alois Komenda Fraunhofer-Einrichtung für Systeme der Kommunikationstechnik ESK
_______________________________________________ Freeswitch-users mailing list Freeswitch-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Have a look at Minisip. It's a softphone with focus on security, but is of "academic character". Compilation failed for me. Let me know if someone manages to compile it on (K)Ubuntu. -- Alois Komenda Fraunhofer-Einrichtung für Systeme der Kommunikationstechnik ESK -----Ursprüngliche Nachricht----- Von: freeswitch-users-bounces@lists.freeswitch.org [mailto:freeswitch-users-bounces@lists.freeswitch.org] Im Auftrag von Brian West Gesendet: Freitag, 25. Januar 2008 18:18 An: freeswitch-users@lists.freeswitch.org Betreff: Re: [Freeswitch-users] MIKEY-Support Alois, Can you break down what mikey is, what it does exactly and what devices if any support it? Seems MIKEY came out in 2004 and SDES came out in 2006 and more devices do SDES. /b On Jan 25, 2008, at 4:20 AM, Alois Komenda wrote:
How can you ever be sure TLS is really used end-to-end? Even if TLS is used "end-to-end" i.e. on every hop, every involved proxy can read your keys.
So if you can trust all proxys that route your messages, SDES is secure.
-- Alois Komenda Fraunhofer-Einrichtung für Systeme der Kommunikationstechnik ESK
_______________________________________________ Freeswitch-users mailing list Freeswitch-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Ok, I will contribute $250.00 towards it. If others can also assist we can get this added it to FS. Best regards, -Ed Mail: edpimentl[at]gmail.com Mail2: edpimentl[at]ieee.org IM: edpimentl [AOL | Jabber | Yahoo | MSN ] Voip: edpimentl [SKype | GoogleTalk ] http://agileoss.com (Web2.0 and SOA Development ) http://goowallet.ws (Mobile Payment/Banking) http://mobiquity.ws (Private Label Social Network)
Ed, Awesome. Looks like a Mikey lib will have to be created since the only libmikey out there is GPL. Unless someone wants to talk them into releasing it LGPL? I have talked to projects that are libraries in the past and asked if they would release LGPL and most have done so... It never hurts to ask. /b On Jan 25, 2008, at 6:56 AM, EdPimentl wrote:
Ok, I will contribute $250.00 towards it. If others can also assist we can get this added it to FS.
Best regards,
-Ed
Mail: edpimentl[at]gmail.com Mail2: edpimentl[at]ieee.org IM: edpimentl [AOL | Jabber | Yahoo | MSN ] Voip: edpimentl [SKype | GoogleTalk ]
http://agileoss.com (Web2.0 and SOA Development ) http://goowallet.ws (Mobile Payment/Banking) http://mobiquity.ws (Private Label Social Network)
_______________________________________________ Freeswitch-users mailing list Freeswitch-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
It looks like libmikey was put under LGPL till 2006-05-01 so we can use it now. It seems I was mistaken about its current license status. Anyway now that libmikey is there its usable. /b On Jan 25, 2008, at 7:13 AM, Brian West wrote:
Ed, Awesome. Looks like a Mikey lib will have to be created since the only libmikey out there is GPL. Unless someone wants to talk them into releasing it LGPL? I have talked to projects that are libraries in the past and asked if they would release LGPL and most have done so... It never hurts to ask.
/b
On Jan 25, 2008, at 6:56 AM, EdPimentl wrote:
Ok, I will contribute $250.00 towards it. If others can also assist we can get this added it to FS.
Best regards,
-Ed
Mail: edpimentl[at]gmail.com Mail2: edpimentl[at]ieee.org IM: edpimentl [AOL | Jabber | Yahoo | MSN ] Voip: edpimentl [SKype | GoogleTalk ]
http://agileoss.com (Web2.0 and SOA Development ) http://goowallet.ws (Mobile Payment/Banking) http://mobiquity.ws (Private Label Social Network)
_______________________________________________ Freeswitch-users mailing list Freeswitch-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_______________________________________________ Freeswitch-users mailing list Freeswitch-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
participants (3)
-
Alois Komenda
-
Brian West
-
EdPimentl