What advantages does Transport Layer Security (TLS, what we used to call “SSL”) bring to voice-over-IP (VoIP) that uses the Session Initiation Protocol (SIP)? What is the state of TLS usage within SIP and VoIP? Why isn’t it being used more?
Tomorrow, June 10, 2014, I’ll be speaking at the SIP Network Operators Conference (SIPNOC) 2014 event down in Herndon, Virginia, on the topic of “Is It Time For TLS For SIP?“. I’ll be discussing why we need more TLS usage in SIP-based communication, including what we think of as “VoIP” and also “Unified Communications (UC)”. The abstract for my talk is:
With concerns about large-scale pervasive monitoring on the Internet, many groups are encouraging the increased use of Transport Layer Security (TLS, what we used to call “SSL”). While SIP has had TLS support for quite some time, it is often not used. This session will look at concerns of using TLS with SIP and discuss opportunities for providing higher security for SIP-based communication. The session will also outline some newer innovations such as the DANE protocol that when coupled with DNSSEC can provide a higher level of trust for TLS encryption.
As you can tell, my focus will be around the “TLS for Applications” topic area we have here on Deploy360, as well as some discussion around DANE and what it can bring in terms of increased security.
I’ve spoken at SIPNOC events for the past two years (and before that) but my topic has always included IPv6. This time I won’t be doing that… but to my delight one of the talks before mine tomorrow will be Carl Klatsky from Comcast providing a case study of their work their voice services to IPv6. Here is his abstract:
Comcast Voice IPv6 Deployment Lessons Learned. Presented by Carl Klatsky, Comcast.
This presentation will review the successes, challenges, and lessons learned in deploying IPv6 support into Comcast’s IMS based SIP voice network, in support of an upcoming IPv6 technical trial. The presentation will review the overall target architecture covering both access and network side elements, and share the lessons learned with the SIP community.
I’m very much looking forward to hearing what Carl has to say!
There are many other great sessions on the SIPNOC 2014 agenda. Unfortunately I can only be at the event tomorrow and will be missing out on the great content on Wednesday and Thursday. You can, of course, expect to find me in any of the security-related sessions on Tuesday!
If any of you reading this are at SIPNOC 2014 tomorrow please do feel free to say hello!
P.S. And before anyone asks in the comments, no, there is not a live stream (or recordings) of the SIPNOC sessions. They try to keep it an informal atmosphere where information can be shared with the conference sessions without that information being immediately public.