Subject: Re: [Sip] Authentication: qop/cnonce issue

From: Jonathan Rosenberg <[email-masked]>
Date: Tue, 08 Jan 2002 01:48:05 -0500

Going through old emails.

As far as I can tell, this appears as yet another bug in rfc2617. I
suspect the proper solution is that you can only use MD5-sess if a qop 
directive is issued.

-Jonathan R.

Sanjay Dhand wrote:

 > Hi All,
 >
 > I have a query regarding "qop" and "cnonce" fields in Digest
 > Authentication procedure. Looks like some gap in the specs. Please
 > provide your input.
 >
 > The problem is that if qop parameter does not arrive in the Challenge 
(401/407) and the algo for the session is "MD5-sess" then Hash Key A1 is 
built with "cnonce-value" at the client, but "cnonce-value" is not sent 
to the Server in the subsquent Requests.
 >
 > Then How will the Server decode the response without the "cnonce-value"?
 >
 > Does it mean that if Algo is "MD5-Sess", then qop parameter MUST be 
supplied to the client in the Challenge?
 >
 > Quoted from RFC 2617, Sec 3.2.2:
 >
 > "If qop (Quality of Protection) is not sent to the Client then cnonce
 > value and nonce-count value MUST NOT  be specified in the subsquents
 > requests."
 >
 > AND (construction of the Hash Key A1)
 >
 > If Algo is "MD5-sess" then A1 is calculated as
 > A1 =H(unq(username-value) ":" unq(realm-value) ":" passwd ":"
 > unq(nonce-value) ":"   unq(cnonce-value)
 >
 > where A1 is the Session Key for authentication of subsquent requests and
 > responses.
 >
 > A1 is used to calculate the response-digest along with the second hash
 > Key A2.
 >
 > Best regards,
 >
 > Sanjay Dhand
 >
 > ipDialog India Pvt Ltd
 > 453, Udyog Vihar phase 5,
 > Gurgaon INDIA.
 >
 > ph: (91) (120) 6399051, 6399657/58
 > cell: 9810309914
 >
 >
 >

-- 
Jonathan D. Rosenberg, Ph.D.            72 Eagle Rock Avenue
Chief Scientist                         First Floor
dynamicsoft                             East Hanover, NJ 07936
[email-masked]                 FAX: (973) 952-5050
http://www.jdrosen.net                  PH:  (973) 952-5000
http://www.dynamicsoft.com

_______________________________________________
Sip mailing list  http://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: "James Undery" <[email-masked]>
Date: Tue, 8 Jan 2002 09:18:17 -0000

Unfortunately, this is a backwardly compatibility issue with rfc2069 (that
doesn't quite work). There is a circle of SHOULDs and MUSTs that I think
cover it in the description of the digest challange and response parameters
(3.2.1 & 3.2.2), although it would be better as explicit.

James

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]On Behalf Of
> Jonathan Rosenberg
> Sent: 08 January 2002 06:48
> To: Sanjay Dhand
> Cc: SIP Mailing List
> Subject: Re: [Sip] Authentication: qop/cnonce issue
>
>