Multimedia Internet Keying Sample Clauses

Multimedia Internet Keying. XXXXX This section will only describe XXXXX with focus on the aspects that affect the call establishment delay. For more information about XXXXX we refer to work being done within the IETF. The current MIKEY draft[1] supports three different authentication mech- anisms: shared key, public key and signed Xxxxxx-Xxxxxxx authentication. The negotiation of MIKEY parameters (including authentication mecha- nism) follows the SDP Offer/Answer model and is integrity protected by the authentication mechanism offered, i.e., a MAC for the shared key, or a digital signature for the other two. Shared key authentication is probably going to be used at an early de- ployment stage when people can manually exchange secret keys with their friends. To use secure IP telephony at large scale a PKI should be intro- duced. A likely scenario is that user agents will store a small set of root CAs, just like web browsers do today. SIP providers will have certificates signed by any of these root CAs, and the providers will issue user certificates to their customers. Of the certificate based authentication mechanisms we only consider signed Xxxxxx-Xxxxxxx. The reasons for excluding the public key mechanism are that we expect it to have a longer delay (Xxxxx will somehow have to retrieve Bob’s public key before sending the INVITE), and we have not yet implemented the public key mechanism into our user agent (minisip). Furthermore, with signed Xxxxxx-Xxxxxxx one gets perfect forwarding secrecy. XXXXX has some additional properties that may affect the call estab- lishment delay: • To avoid replay attacks XXXXX messages carry a time stamp. This may be a source of annoyance (and would have a major impact on the call establishment delay) if Xxxxx’s and Bob’s clocks are not reasonably synchronized. The reason for using time stamps instead of nonce chal- lenges is probably to make it fit into the Offer/Answer model (nonces would require (at least) a three-way handshake,) however we suggest the usage of nonces challenges as a fall-back mechanism. In our mea- surements we have assumed that the clocks are synchronized. • When including certificates in the MIKEY messages the SIP mes- sages become too large for UDP transport (SIP messages larger than 1300 bytes must be sent using congestion controlled transport[7]). For Xxxxxx-Xxxxxxx we will therefore have to use TCP or TLS, and this will affect the delay of steps 1b, 2b and 3b (see figure 1a), unless those transport sessions are already up. It ...