Subject: RE: [Sip] Questions to draft-undery-sip-auth-00.txt

From: "James Undery" <[email-masked]>
Date: Wed, 6 Mar 2002 09:25:04 -0000

> -----Original Message-----
> From: Steffen Fries [mailto:[email-masked]]

> within the current bis draft, the Authentication-Info header 
> may only be sent in 2xx responses. The SIP Digest 
> Authentication draft does not state this limitation explicitly. 
> Is the intension to provide the Authentication-Info for every 
> response, not only 2xx. If not, what would be the reason? 

I definitely envisaged it in other responses such as 3xxs and 6xxs, the
only restriction I can see is it must be in response to a request
containing an Authorization header for that realm. (You need to know the
identity the UAC is claiming.)

> By including the Authentication-Info header in all responses, 
> one could already provide protection against some denial of 
> service attacks (despite tzhe fact, that the draft states that 
> these types of attacks are not countered)

Definitely, although I would add that it could provide an almost
identical result with selective application.

James

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: "Steffen Fries" <[email-masked]>
Date: Wed, 6 Mar 2002 15:13:19 +0100

> identical result with selective application.

Okay, that is exactly, what I was hoping ;-)

Steffen________________________________________________________
___
Steffen Fries,     Siemens AG, CT IC 3	
Otto-Hahn-Ring 6,  D-81730 Munich, Germany 
Phone:  (+49) 89 / 636-53403, Fax  :  (+49) 89 / 636-48000
Email:  [email-masked]
___________________________________________________________
    This email was written on 100% recycled bytes!