Subject: Re: [Sip] Preventing replay in ACK

From: "Dale Worley" <[email-masked]>
Date: Thu, 19 May 2005 12:08:18 -0400

> From: Avshalom Houri [[email-masked]]
>
> > While a server can legitimately challenge most SIP requests, there
> > are two requests defined by this document that require special
> > handling for authentication: ACK and CANCEL.
> > Under an authentication scheme that uses responses to carry values
> > used to compute nonces (such as Digest), some problems come up for
> > any requests that take no response, including ACK.  For this reason,
> > any credentials in the INVITE that were accepted by a server MUST be
> > accepted by that server for the ACK.  UACs creating an ACK message
> > will duplicate all of the Authorization and Proxy-Authorization
> > header field values that appeared in the INVITE to which the ACK
> > corresponds.  Servers MUST NOT attempt to challenge an ACK.

> Logic says the UA should recalculate the authorization headers (using ACK
as
> method) in order to prevent someone to send an ACK using the INVITE
credentials.
> However text says duplicate.
>
> What is the right interpretation?

I believe that what the text means is "UACs creating an ACK message will
generate Authorization and Proxy-Authorization header field values for all
of the credentials that were used to generate those header field values in
the INVITE."  Otherwise, SIP would require a modified digest authentication
verification that would replace "ACK" methods with "INVITE" when calculating
the hash values.

A complication arises from nonce values, which a UAS may accept for only a
limited time.  Since the UAS cannot supply a new nonce value to the UAC for
it to recalculate the headers, it must accept any nonce in the ACK that it
accepted in the INVITE.

Dale

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: Avshalom Houri <[email-masked]>
Date: Fri, 20 May 2005 13:30:49 +0300

Dale and Retesh,

Thanks for replying.

I may be missing something but how we do prevent someone to listen on the 
line and send an ACK containing different ports etc. using the INVITE 
credentials?

Thanks
Avshalom

"Dale Worley" <[email-masked]> 
Sent by: [email-masked]
19/05/2005 07:08 PM

To
<[email-masked]>
cc

Subject
Re: [Sip] Preventing replay in ACK

as
credentials.

I believe that what the text means is "UACs creating an ACK message will
generate Authorization and Proxy-Authorization header field values for all
of the credentials that were used to generate those header field values in
the INVITE."  Otherwise, SIP would require a modified digest 
authentication
verification that would replace "ACK" methods with "INVITE" when 
calculating
the hash values.

A complication arises from nonce values, which a UAS may accept for only a
limited time.  Since the UAS cannot supply a new nonce value to the UAC 
for
it to recalculate the headers, it must accept any nonce in the ACK that it
accepted in the INVITE.

Dale