Subject: [Sip] Question on draft-ietf-sip-identity-01

From: Marco Aime <[email-masked]>
Date: Tue, 10 Jun 2003 18:20:53 +0200

Hi Jon,

regarding draft-ietf-sip-identity-01, I'm wondering what can be the 
problems trying to place the authentication token into a SIP header 
rather than the body: has the consequences of this option been 
investigated already?

Thanks in advance
Bye
Marco Aime

-- 
------------------------------------------------------------------
Marco AIME
Dipartimento di Automatica e Informatica
Politecnico di Torino
Addr: Via Cardinal Massaia 83, Torino, Italy
Tel: +39 011 22102-44
Fax: +39 011 22102-29
Mail: [email-masked] ([email-masked])
------------------------------------------------------------------

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: "Peterson, Jon" <[email-masked]>
Date: Fri, 13 Jun 2003 02:34:56 -0500

Hi,

Yes, the consequences of placing an authentication token into a SIP header
have been considered in the past. There were really three significant
factors that led to the architecture used in draft-ietf-sip-identity (in
which the authentication token appears in a body instead):

- The tokens themselves can be quite large and complicated. Following the
recommendation in the AIB draft (draft-ietf-sip-authid-body), a token might
contain numerous headers which are required for reference integrity.
Compound that with a digital signature. Compound that with an appended
certificate for verifying the signature (common in CMS applications). All
together, the size of one of these tokens would be considerably larger that
conventional SIP headers. While technically, headers are unbounded in size,
from a practical perspective chunks of data over a certain threshhold are
more suitable for the body of a message than a header. A proxy handling a
header that was, say, over 1K in size could conceivably hiccup. Encoding a
header that contained multiple SIP headers and a digital signature and a
certificate could also be challenging.

- For additional reference integrity, some tokens may want to place
signatures around actual message bodies, notably SDP. This is a general
motivation for the use of S/MIME for identity. Replicating bodies in headers
would be... silly.

- Headers are frequently manipulated by proxy servers - bodies, however,
MUST NOT be modified by proxy servers (per RFC3261 16.6). A great deal of
emphasis in the SIP security work was placed on end-to-end security
properties. While headers can be marked unmodifiable (by omitting the 'amd's
in the famous Table 2 of RFC3261), the guidelines for bodies are more
strict.

Jon Peterson
NeuStar, Inc.

> -----Original Message-----
> From: Marco Aime [mailto:[email-masked]]
> Sent: Tuesday, June 10, 2003 9:21 AM
> To: [email-masked]
> Cc: [email-masked]
> Subject: Question on draft-ietf-sip-identity-01
> 
> 
> Hi Jon,
>