Subject: [Sip] outbound: question on flow token algorithms

From: Fredrik Thulin <[email-masked]>
Date: Tue, 28 Nov 2006 08:12:36 +0100

Hi

Outbound (-06) "5.2  Generating Flow Tokens" says

   "A proxy can use any algorithm
    it wants as long as the flow token is unique to a flow, the flow can
    be recovered from the token, and the token can not be modified by
    attackers."

and then goes on explaining two stateless algorithms that both, if I 
understand them correctly, would generate a static flow token for a 
given flow (static for as long as the proxy is running).

Can you please explain what attack scenarios this is meant to avoid?

Algorithm #1 MUST NOT be used if SIPS isn't being used between the edge 
proxy and the registrar, but I don't really see which attacks would be 
possible if algorithm #1 was used without SIPS, that would not also be 
possible with algorithm #2 without SIPS.

Perhaps the problem is that I don't interpret "can not be modified by 
attackers" correctly - please explain what you mean by that too =).

/Fredrik

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip