Subject: [Sip] Possible interop issues due to BNF of digest auth

From: Itamar Gilad <[email-masked]>
Date: Thu, 18 Oct 2001 18:39:55 +0200

SIP borrows the definitions of authentication headers from RFC 2616 and RFC
2617

RFC 2616 14.47:
       WWW-Authenticate  = "WWW-Authenticate" ":" 1#challenge

RFC 2616 14.33:
       Proxy-Authenticate  = "Proxy-Authenticate" ":" 1#challenge

From RFC 2617 3.2.1 as follows:

      challenge        =  "Digest" digest-challenge

      digest-challenge  = 1#( realm | [ domain ] | nonce |
                          [ opaque ] |[ stale ] | [ algorithm ] |
                          [ qop-options ] | [auth-param] )

This means that there's a great deal of freedom in the way WWW-Authenticate
and Proxy-Authenticate headers are constructed which may lead to major
interop issues. We've seen some of this in the last SipIt.  For example the
header below is valid:

WWW-Authenticate: Digest realm="realm1", realm="realm2",
  nonce="aaaaaEF1ZyAxNCAxNTowNjoxNyBCU1QgMjAwMVtCQDZkMzJjNAaa", 
  nonce="rrrrrEF1ZyAxNCAxNTowNjoxNyBCU1QgMjAwMVtCQDZkMzJjNAaa", 
  opaque="bbbbbbFiYTAwMzgzYTY4MA==", stale=false, 
  algorithm=md5, algorithm=sha1, qop="auth, auth-int",
  Digest realm="realm3", realm="realm4",   
  nonce="aaaaaEF1ZyAxNCAxNTowNjoxNyBCU1QgMjAwMVtCQDZkMzJjNAaa", 
  opaque="ttttttFiYTAwMzgzYTY4MA==", stale=false, algorithm=sha1, qop="auth,
auth-int"

Questions:
1. Do you have a parser that can parse this header?
2. Can you explain the semantics of this header?
3. Shouldn't we restrict the way SIP messages use this syntax to a more
"canonic" form? 
4. If the answer to (3) is no: should we add this as a torture message?

Itamar Gilad
RADVISION
[email-masked]               24 Raul Wallenberg St.
tel: +972 3 7659938                 Building D
mob: +972 56 429938                 Tel-Aviv 69719
fax: +972 3 6472637                 Israel

_______________________________________________
Sip mailing list  http://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: Jonathan Rosenberg <[email-masked]>
Date: Sun, 21 Oct 2001 17:58:45 -0400

> -----Original Message-----
> From: Itamar Gilad [mailto:[email-masked]]
> Sent: Thursday, October 18, 2001 12:40 PM
> To: 'SIP list'
> Subject: [Sip] Possible interop issues due to BNF of digest auth
> 
> 

No, this is not valid. It passes the grammar, but grammars are ill suited at
expressing more complex constraints. In this case, the grammar does not
specify that duplicates of certain parameters are not allowed. However, I
think it is reasonably clear from the specifications that you can only have
one realm, one nonce, and so on. Most web browsers have gotten this right, I
think SIP implementors can too.

As an example of this, consider the Date header. Dates introduce constraints
that are far too complex to place in the grammar (for example, Feburary 29
is allowed in some years), and it is unrealistic to even try.

-Jonathan R.
---
Jonathan D. Rosenberg, Ph.D.                72 Eagle Rock Ave.
Chief Scientist                             First Floor
dynamicsoft                                 East Hanover, NJ 07936
[email-masked]                     FAX:   (973) 952-5050
http://www.jdrosen.net                      PHONE: (973) 952-5000
http://www.dynamicsoft.com

---

From: Itamar Gilad <[email-masked]>
Date: Sun, 28 Oct 2001 16:49:51 +0200

Thanks for the response.  Shouldn't we have this documented in the spec just
to avoid confusion?  

> From: Jonathan Rosenberg [mailto:[email-masked]]
> Sent: Sun, October 21, 2001 11:59 PM
> To: 'Itamar Gilad'; 'SIP list'
> Subject: RE: [Sip] Possible interop issues due to BNF of digest auth
> 
> 
> 
> 
> 
>