Subject: AW: [Sip] SIP authentication problem?

From: Euchner Martin <[email-masked]>
Date: Fri, 17 Aug 2001 14:28:54 +0200

digital signatures are not an appropriate security means to prove ownership of content. But that particular problem is definitely not a SIP security issue.

Kind Regards,

Martin Euchner.
-----------------------------------------------------------------------
| Dipl.-Inf.                     Phone: +49 89 722 55790
| Martin Euchner                 Fax  : +49 89 722 46841
| Siemens AG
| ICN M SR 3                     mailto:[email-masked]
|                                mailto:[email-masked]
| Hofmannstr. 51                 Intranet: 
| D-81359 Muenchen               Internet: http://www.siemens.de
| __________________
| Germany     
-----------------------------------------------------------------------

	-----Ursprüngliche Nachricht-----
	Von:	Rami Lehtonen [SMTP:[email-masked]]
	Gesendet am:	Freitag, 17. August 2001 14:03
	An:	James Undery
	Cc:	[email-masked]
	Betreff:	RE: [Sip] SIP authentication problem?

	> Rami Lehtonen wrote:
	>
	> > Hello,
	> >
	> > Does this following behaviour (to encrypt before
	> authenticating) of SIP open
	> > up some security holes, because now you can send the encrypted body with
	> > valid signature even if you are not the original creator of
	> that content?
	>
	> Sorry I don't quite follow why this is a problem, people often
	> sign things they
	> didn't create, if you don't trust it don't sign it.

	That might be the problem, because now we don't know who actually created
	the content. It might be a problem also in case where the body contains some
	sensitive information like the following example:

	If there is e.g. a pre-paid ticket for some service in the body part, C
	could capture that message sent originally by A, remove the signature and
	include C's own signature and then send the message to B. Now B thinks that
	C originally paid money for the service, because there is C's signature and
	the content is encrypted using the B's public key as it should be.

	Anyway this was just a thought. I was just curious to hear if somebody has
	considered this as an authentication problem or not.

	_______________________________________________
	Sip mailing list  http://www1.ietf.org/mailman/listinfo/sip
	This list is for NEW development of the core SIP Protocol
	Use [email-masked] for questions on current sip
	Use [email-masked] for new developments on the application of sip

_______________________________________________
Sip mailing list  http://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip