[VOIPSEC] [Fwd: draft-state-sip-relay-attack-00]

[Geoff Devine]

Andy Zmolek writes:
> TLS isn't the problem, per se. (although it's true enough that not many
stack vendors
> support it well and scalability can be an issue which is why the carriers
aren't as
> anxious to implement it). It's the certificate management around it that's
the
> challenge and finding a forum for all the right parties to agree on a set
of
> certificate management best practices for SIP TLS interoperability is
something
> in which perhaps VOIPSA can play a future role going forward. 
>
>
> /\\//\Y/\   Andy Zmolek  |  zmolek at avaya.com  |  303-538-6040 
>            GCS Security Technology Development  |  Avaya, Inc.

Scaling is a pretty big deal.  Most SIP implementations are running in the
clear over UDP.  TLS runs over a reliable transport.  TCP.  Most TCP
implementations are memory pigs so you have to cope with yet another memory
upgrade.  It's highly unlikely that you'd be able to convince many service
providers to do an upgrade in today's economic climate.  Media security is
even worse since encryption and authentication in a media gateway is
typically done in a high cost DSP.  When you add this function to your
software mix, it cuts into channel density.  30% degradation isn't
unexpected.  

The other issue with turning on TLS is that the network becomes very
difficult to debug.  Today, you can put a sniffer anywhere and sort out your
problems.  When you turn on security, you're forced to rely on proprietary
tools from your equipment vendors to look at protocol traces.  With the
matrix of vendors in your network with different implementations at
different quality levels, it basically makes it impossible to troubleshoot
your network.

Geoff