Subject: [Sip] Digest auth-int in bis9

From: "Cullen Jennings" <[email-masked]>
Date: Sun, 5 May 2002 09:48:54 -0700

I interpret lines 4997-5001 in bis9 say that a bis 9 proxy must set the qop
parameter in a challenge and a bis 9 compliant UA must also set them in the
reply to the challenge.

It is not clear if the proxy or UA must do auth or auth-int. The example
shows the proxy being able to do both and the UA selecting just auth. I
think we should make it clear what the preferred thing for a UA to do.

The point I am getting to is, if the UA selects auth-int and sends it
through a SIP ALG firewall/nat, odd are good that the SDP gets modified and
when the proxy gets the message it will fail the auth-int check. I don't
know if this is a feature or a bug but it seems worth explicitly discussing.
When we want to protect bodies, I think there are much better approaches
than Digest auth-int.

My proposal is that User Agents are RECOMMENDED NOT to use auth-int and that
Proxies MAY support auth-int but MUST support auth.

Thoughts?

Cullen

PS. Is there any reason why RFC 2617 has auth quoted in WWW-Authenticate
header but not quoted in a Authorization header?

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: [email-masked]
Date: Sun, 5 May 2002 22:13:21 +0300

Hi Cullen,

> parameter in a challenge and a bis 9 compliant UA must also 

I assume that the reason for this is that bis-9 compatible proxies and UAs need not be RFC2069 compatible, which is why in RFC2617, the qop is optional.
 
> think we should make it clear what the preferred thing for a UA to do.

This depends on the application, so I don't think such an explicit preference exists. For example, to a REGISTER or MESSAGE, auth-int could make more sense than when proxy-authenticating an INVITE...

> When we want to protect bodies, I think there are much better 

Auth-int seems like a very easy and inexpensive way to protect bodies, and headers as well by using sip-frag. You are right that an ALG that modifies the SDP will fail the auth-int authentication. But it will also fail S/MIME or any other integrity protection on the body.

> Proxies MAY support auth-int but MUST support auth.

I don't agree. Auth-int is useful in some authentication scenarios, just not when there is a firewall/NAT that modifies the message bodies.

> header but not quoted in a Authorization header?

In WWW-Authenticate, its a comma separated list, whereas in Authorization it's a token.

Cheers,
Aki