Subject: [SIP] A Clarification

From: [email-masked]
Date: Wed, 20 Sep 2000 17:07:35 +0530

With reference to "http://www.cs.columbia.edu/~hgs/sip/notes.html", under
the Www-Authenticate and Authorization sub-heading, it has been mentioned
that the two headers could be Req & Response hdrs. But, in the SIP Grammar
link
http://www.cs.columbia.edu/~hgs/sip/syntax/draft-ietf-sip-rfc2543bis-01.htm
l, Authorization is included under "request-header" and Www-Authenticate
under "response-header" . Am I looking at the correct Grammar links ? Is
there a correction needed ?

Regards
Prashant

_______________________________________________
SIP mailing list
[email-masked]
http://lists.bell-labs.com/mailman/listinfo/sip

---

From: Jonathan Rosenberg <[email-masked]>
Date: Mon, 25 Sep 2000 11:48:54 -0400

You bring up something we need to discuss.

TH reason they are listed as both request and response headers is that we
wanted to support response authentication and signing. However, the use of
challenge-response authentication for responses worries me, as it has never
been implemented, as far as I know, and I think we would find there are lots
of issues.

Response signing is important, however, as it prevents certain attacks.

It might be time to revisit this issue. We can:

1. support only non-challenge-response (i.e., just  a pure signature)
authentication of responses
2. keep the challenge response stuff for responses, but we better test it
and run through it
3. ditch response signing end to end completely

Comments?

-Jonathan R.

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]
> Sent: Wednesday, September 20, 2000 7:38 AM
> To: [email-masked]
> Subject: [SIP] A Clarification
> 
> 
> 
> 
> 
> With reference to 
> "http://www.cs.columbia.edu/~hgs/sip/notes.html", under
---
Jonathan D. Rosenberg                       72 Eagle Rock Ave.
Chief Scientist                             First Floor
dynamicsoft                                 East Hanover, NJ 07936
[email-masked]                     FAX:   (973) 952-5050
http://www.cs.columbia.edu/~jdrosen         PHONE: (973) 952-5000
http://www.dynamicsoft.com

---

From: "Rosen, Brian" <[email-masked]>
Date: Mon, 25 Sep 2000 14:07:41 -0400

While I like 1), I think we may need to do 2).
If the requestor doesn't need to challenge, but the
responder does....

I'm a bit off from being able to sign up to implement such
a feature, but that looks like what we have to do.

I could probably live with 1) if there were a lot of problems.

Brian

> From: Jonathan Rosenberg [mailto:[email-masked]]
> Sent: Monday, September 25, 2000 11:49 AM
> To: [email-masked]'; [email-masked]'
> Subject: RE: [SIP] A Clarification
> 
>

---

From: Jonathan Rosenberg <[email-masked]>
Date: Tue, 26 Sep 2000 11:39:23 -0400

> From: Rosen, Brian [mailto:[email-masked]]
> Sent: Monday, September 25, 2000 2:08 PM
> To: 'Jonathan Rosenberg'; [email-masked]';
> [email-masked]'

You lost me here; the responder (the UAS), issuing a challenge
is covered already by the standard request authentication case.

> I could probably live with 1) if there were a lot of problems.

Well, here is a problem we encountered with challenge-response on responses.

Basically, there is no analag to proxy-authentication for responses. That
is, the proxy can't challenge the UAS for credentials for the response. Its
just horrible, if not impossible, in a request-response model.

The solution is that if the response is just signed with the key of the UAS,
any proxy along the response path could authenticate the response.

-Jonathan R.
---