Seguridad en voip

Special Publication 800-58

Security Considerations for Voice Over IP Systems
Recommendations of the National Institute of Standards and Technology
D. Richard Kuhn, Thomas J. Walsh, Steffen Fries

NIST SP 800-58 Voice Over IP Security ____________________________________________________________

_________________

II

NIST SP 800-58 Voice Over IP Security____________________________________________________________

_____________

NIST Special Publication 800-58

Security Considerations for Voice Over IP Systems
Recommendations of the National Institute of Standards and Technology

C O M P U T E R

S E C U R I T Y

Computer Security Division Information Technology Laboratory National Institute of Standards and Technology Gaithersburg, MD20899-8930

January 2005

U.S. Department of Commerce

Donald L. Evans, Secretary
Technology Administration

Phillip J. Bond, Under Secretary for Technology
National Institute of Standards and Technology

Shashi Phoha, Director

III

NIST SP 800-58 Voice Over IP Security ____________________________________________________________

_________________

Note toReaders
The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation’s measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analysis to advance the development andproductive use of information technology. ITL’s responsibilities include the development of technical, physical, administrative, and management standards and guidelines for the cost-effective security and privacy of sensitive unclassified information in Federal computer systems. This document is a publication of the National Institute of Standards and Technology (NIST) and is not subjectto U.S. copyright. Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by the National Institute of Standards and Technology, nor is it intended to imply that the entities, materials, or equipment arenecessarily the best available for the purpose. T.J. Walsh and D.R. Kuhn are employees of NIST; S. Fries is an employee of Siemens AG.

For questions or comments on this document, contact sp800-58@nist.gov.

Acknowledgments
This document has benefited from review and comment by many experts. We particularly want to thank Mike Stauffer, of Booz Allen Hamilton, for his careful review andmany contributions to improving the quality of this publication. Appendix A is derived from an internal NIST report by Tony Meehan and Tyler Moore of the University of Tulsa. Many people provided us with helpul comments and suggestions for improvements to the first draft of this document. We are grateful to Tim Grance, John Larson and colleagues at Sprint, Stephen Whitlock, DavidWaring, Steven Ungar, Larry L. Brock, Ron Rice, John Dabnor, Susan Landau, Cynthia Des Lauriers, Victor Marshall, Nora Wheeler, Anthony Smith, Curt Barker, Gerald Maguire, Frank Derks, Ben Halpert, Elaine Starkey, William Ryberg, Loraine Beyer, Terry Sherald, Gill Williams, Roberta Durant, Adrian Gardner, Rich Graveman, David Harrity, Lakshminath Dondeti, Mary Barnes, Cedric Aoun, Mike Lee,Paul Simmons, Marcus Leech, Paul Knight, Ken van Wyk, Manuel Vexler, and John Kelsey.

IV

NIST SP 800-58 Voice Over IP Security ____________________________________________________________

_____________

Table of Contents
Executive Summary and Recommendations .......................................................................................... 3 1 Introduction...