Subject: RE: [Sip] RFC 3325 - Private Extensions to SIP for Asserted Ident ity within Trusted Networks

From: "Mark Watson" <[email-masked]>
Date: Mon, 31 Mar 2003 14:00:08 +0100

Wolfgang,

Section 11 of the RFC is just an example.

The point of the mechanism in this RFC is that P-Asserted-Identity can only
be used within a 'trusted domain', but that to make this concept meaningful,
you must provide concrete details of the requirements that are met by all
elements of the trusted domain. This is called Spec(T), and section 11 gives
an example.

Nevertheless, this statement simply says that users must be authenticated
using SIP Digest Authentication. I cannot see what relevance this has to
whether P-Asserted-Identity may be used in responses.

The handling of responses from a node outside the Trust Domain is a sub-case
of the handling of messages described in section 5:

  "A proxy in a Trust Domain can receive a message from a node that it
   trusts, or a node that it does not trust.  When a proxy receives a
   message from a node it does not trust and it wishes to add a P-
   Asserted-Identity header field, the proxy MUST authenticate the
   originator of the message, and use the identity which results from
   this authentication to insert a P-Asserted-Identity header field into
   the message."

This does not specify how or when the originator of the message is
authenticated. If you were using the Spec(T) specified in Section 11, then
Digest is the only method of authentication specified, so clearly this
cannot be carried out at the point at which the response is received. The
proxy would need some means to ascertain that the message (response) came
from the same user it had previously authenticated with Digest (such means
being a form of authentication in themselves).

This 'some means' ought to be specified in Spec(T), but as Section 11 is
just an example, I don't think it is necessary to update the RFC.

Regards,

Mar

> -----Original Message-----
> From: Deuringer Wolfgang [mailto:[email-masked]]
> Sent: 27 March 2003 12:18
> To: [email-masked]'
> Subject: [Sip] RFC 3325 - Private Extensions to SIP for Asserted
> Identity within Trusted Networks
> 
> 
> 
> Dear all,
> 
> the RFC3325 states in Chapter 11.2 Authentication 
> requirements that "Users must be 
> authenticated using SIP Digest Authentication". This 
> contradicts the statement in the SIP discussion
> list that the P-Asserted-Identity should be available in 
> response messages, too. However I see no
> way to authenticate response messages with SIP mechanisms. 
> Additionally the RFC shows the usage 
> of these headers only for Requests.
> 
> If there is a common understanding that the 
> P-Asserted-Identity header is required for responses,
> will there be an update of the RFC?
> *	What happens in a case where a proxy receives a 
> response from a node he does not trust? He cannot
> authenticate the originator of the response. This means that 
> he can only set up the P-Asserted-Identity
> for responsens of users which are stored within the database 
> which is accessible by the proxy.
> *	Does this mean that response messages from users not 
> available in the database would be skipped by the
> proxy. 
> *	Which responses should contain this P-Asserted-Identity 
> Header? Only final responses or even provisional ones? 
>  
> 
> Best regards,
> 
> 	Wolfgang Deuringer
> 
> 
> ____________________________________________________
> Wolfgang Deuringer
> ICN CP D NA D12
> Mch H/Sc8
> Tel.  +49 89 722 28236
> Fax  + 49 89 722 48697
> 
> 
> 
> _______________________________________________
> Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
> This list is for NEW development of the core SIP Protocol
> Use [email-masked] for questions on current sip
> Use [email-masked] for new developments on the application of sip
>