Subject: RE: [Sip] replays and SMIME

From: "James Undery" <[email-masked]>
Date: Tue, 19 Feb 2002 15:52:48 -0000

> -----Original Message-----
> From: Eric Rescorla [mailto:[email-masked]]

> Michael Thomas <[email-masked]> writes:
> > So I'm not terribly familiar with SMIME so I was
> > curious how replay detection was performed.
> In general, S/MIME doesn't worry much about replay protection.
> 
> >In
> >any case, if we're going to have replay detection
> >for SMIME bodies, I think we're going to need a
> >better scheme here.
> I agree. What I had in mind was using essentially the same mechanism
> that is use with Digest: a series of nonces that must be echoed in the
> message to ensure freshness. The alternative, of course, is to use
> sequence numbers a la IPsec, but this requires storage for each
> client.

Without wishing to sound pedantic or put words into your mouth, what
your looking for is just a nonce distribution scheme. For the I-D
draft-undery-sip-auth-00.txt we tried to get away from digest and
generalise the HTTP authentication framework; from the little I
understand of SMIME something along the lines of... 

challenge = "SMIME" nonce
credentials "SMIME" nonce cnonce
scheme = "SMIME"
info-credentials = nextnonce cnonce

is all that is needed to work with our framework only leaving how the
nonce is included into the SMIME body, which superficially would be to
include the relevant headers. Obviously this is off the top of my head
and should be taken as the ramblings of an idiot.

James

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: Eric Rescorla <[email-masked]>
Date: 19 Feb 2002 08:00:38 -0800

> and should be taken as the ramblings of an idiot.
Yes, this is more or less what I had in mind, but your draft is
a lot more complicated than what we'd need for this purpose,
I suspect.

-Ekr

-- 
[Eric Rescorla                                   [email-masked]]
                http://www.rtfm.com/