Subject: RE: [SIP] VIA header encryption?

From: Jonathan Rosenberg <[email-masked]>
Date: Thu, 1 Mar 2001 01:59:04 -0500

> -----Original Message-----
> From: Henning G. Schulzrinne [mailto:[email-masked]]
> Sent: Wednesday, February 28, 2001 10:03 AM
> To: Jonathan Rosenberg
> Cc: 'Sean Olson'; Neil Deason; [email-masked]
> Subject: Re: [SIP] VIA header encryption?
> 
> 
> 
> > 
> > Well, there is a big difference. With the port scans, you 
> find a device, but
> > don't necessarily know what it does or why you might want 
> to beat it up.
> > Without via hiding, an attacker can know what the device is 
> (a proxy), what
> > provider its with, what calls get routed through it, and so 
> on. It makes for
> > much more selective, focused attacks.
> > 
> 
> Scan for TCP port 5060 and you'll know it's a proxy.

Well, you know its something that listens on 5060. Could be a gateway, could
be a media server. Might even be something else that just happens to use
5060. 

> You'll 
> know the IP
> address range by looking at the packet to your 3GPP device (or the
> public allocations and domain names). 

No; you'll know the IP of the device that sent you the packet, but not the
proxies upstream from it - that is, unless their IP address is in the via
header and RR.

> I agree Via hiding 
> makes the work
> somewhat more difficult, but I doubt that it offers any real 
> protection,
> given other leakage (such as Record-Route) and other ways to find out
> things (max-forward).

Its not a complete solution, no, of course not. My approach to security in
these things is that you have lots of layers, each of which provides a
little more security against certain types of things. The result is that the
whole system is fairly robust and secure, without relying on a single
component or capability to give you everything. Hiding IP addresses makes
things a little harder for attackers. Coupled with firewalls, attack
protection mechanisms within proxies and the machines they run on, intrusion
detection systems, replication, distributed components, and so on, the whole
thing works pretty well.

> 
> My primary concern is that 3GPP seems to be mandating 
> architectures that
> are, at best, useful for a subset of providers and scenarios, imposing
> complexity on everyone.

I agree this is general problem, but not with this specific case. We removed
via hiding explicitly because it could be done without any kind of protocol
support. So, if their P-CSCF do hiding of via and RR, that doesn't affect
anyone else. It makes it a pain for vendors who want to sell such things,
but thats a different point.

Sean wrote:
>Call statefulness is required for the BYE. In order for the 
>P-CSCF to insert the proper Route: in the BYE, it must maintain 
>call state. This is not the *only* reason the P-CSCF maintains 
>call state however. 

Right; I had really only thought about via. Good point. Why else must it be
call stateful, BTW?

-Jonathan R.

---
Jonathan D. Rosenberg                       72 Eagle Rock Ave.
Chief Scientist                             First Floor
dynamicsoft                                 East Hanover, NJ 07936
[email-masked]                     FAX:   (973) 952-5050
http://www.cs.columbia.edu/~jdrosen         PHONE: (973) 952-5000
http://www.dynamicsoft.com

_______________________________________________
This list is for continuing development of the SIP protocol.
The sip-implementor's list is the place to discuss implementation,
and to receive advice on understanding existing sip.
To subscribe to it, send mail to 
[email-masked] with "subscribe" in the body.