On 6/2/2007 10:36 AM, Eric Rescorla wrote:
At Sat, 2 Jun 2007 10:29:56 -0700,
Totally agree. I'm just saying that we ought to think of the authentication as happening in the signalling and being transferred into the media. We should try to avoid having authentication mechanisms which authenticate only the media and not the signalling.
Why? If we apply this to other use cases, this is akin to saying that we ought to tie access authentication to end-to-end secure communication.
I can see the point that in case of SIP, communicating parties may choose to use identities asserted in the signaling path.
regards, Lakshminath
-Ekr