Subject: [Sip-security] new I-D: single hop Digest message authentication

From: "Sanjoy Sen" <[email-masked]>
Date: Wed, 14 Nov 2001 16:29:33 -0600

Hi Folks,

   We've submitted a draft discussing the usage of Digest for providing full
message authentication capabilities between UA and a Proxy one-hop away.
Until the draft appears in the directory, it can be found at:
http://www.obsidian97.com/draft-sen-sipping-onehop-digest-00.txt

I've attached the abstract below.

Regards,
Sanjoy

=========
To date, the HTTP access authentication framework, as described in 
   [RFC2617] and as used in [SIPbis05], has permitted limited SIP 
   message authentication from UAC to Proxy/UAS, Proxy to Proxy, and 
   Proxy to UAS. This draft addresses some of the shortcomings of SIP 
   usage of Digest for message authentication between a SIP User Agent 
   and a Proxy one hop away (e.g., an outbound Proxy). For the messages 
   exchanged between the UA and a Proxy one hop away, the Service 
   Provider may want to provide a different level of protection than 
   that possible for the same messages end-to-end. Authentication of 
   both requests and responses traveling in either direction should be 
   possible with minimum number of necessary roundtrip exchanges. We 
   discuss some the limitations of SIP Digest message authentication 
   framework in satisfying these requirements and propose possible 
   solutions. A new value of the "qop-options" parameter would indicate 
   to a SIP entity that the challenging entity is one hop away and the 
   maximum protection of SIP message is required. Some other aspects of

   this solution are in the form of behavior enhancements of SIP Proxy 
   and UA.