Subject: [SIP] A question on Digest Authentication.

From: "M. Ranganathan" <[email-masked]>
Date: Wed, 27 Sep 2000 12:48:45 -0400

Greetings!

I have a simple confusion about how to compute message digests for SIP Authorization headers using the HTTP

Digest authentication scheme.

According to Digest I need to use the request URI as part of the string over which I run tbe MD5 hash. However,

uri= may also be a part of the parameters supplied with Authorization header. I am assuming that :

1. If no such parameter is supplied, use the request URI in the request-line.

2. If such a parameter is supplied, then it takes precedence over the request URI in the request-line and gets

used in the hash computation. The bis RFC does say request URI but I am not sure then how the uri= parameter

of the authentication header parameter list comes into play.

Is this the right set of assumptions?

Thank you in advance for your help.

Ranga.

--
M.Ranganathan
NIST Advanced Networking Technologies Group,
100 Bureau Drive, Stop 8920, Gaithersburg, MD 20899.
Tel: 301 975 3664 Fax: 301 590 0932

_______________________________________________
SIP mailing list
[email-masked]
http://lists.bell-labs.com/mailman/listinfo/sip

---

From: "Phil Hoffer" <[email-masked]>
Date: Thu, 28 Sep 2000 10:43:08 +0100

> Greetings!
>
> I have a simple confusion about how to compute message digests for SIP
Authorization headers using
> the HTTP  Digest authentication scheme.
>
> According to Digest I need to use the request URI as part of the string
over which I run tbe MD5 hash.
> However,  uri= may also be a part of the parameters supplied with
Authorization header. I am assuming that :
> 2. If such a parameter is supplied, then it takes precedence over the
request URI in the request-line and
> gets  used in the hash computation. The bis RFC does say request URI but I
am not sure then how the
> uri= parameter of the authentication header parameter list comes into
play.
> Thank you in advance for your help.

Hi Ranga,

rfc2617 mandates that the Authorization header MUST contain a digest-uri
parameter.
The digest-uri parameter is mandated as the Request-URI can be modified by
proxies in transit.
Therefore, when validating the credentials, the digest-uri value should be
taken from the credentials,
and not from the Request Line.

If the digest-uri parameter is missing from the credentials then the
response should be 400 Bad Request.
See section 3.2.2 of rfc2617.

HTH
Cheers
Phil

http://www.ubiquity.net