Subject: [Sip] one question on the authentication for third-party registration

From: [email-masked]
Date: Tue, 13 Dec 2005 09:07:24 +0800

Hi,

I am confused by the authentication for third-party registration. 

We assume that Bob registrers for Alice, so the REGISTER request may be 
like this:

REGISTER sip:registrar.biloxi.com SIP/2.0
Via: SIP/2.0/UDP bobspc.biloxi.com:5060;branch=z9hG4bKnashds7
Max-Forwards: 70
To: Alice <sip:[email-masked]>
From: Bob <sip:[email-masked]>;tag=456248
Call-ID: 843817637684230@998sdasdh09
CSeq: 1826 REGISTER
Contact: <sip:[email-masked]>
Expires: 7200
Content-Length: 0

As RFC3261 Section 10.3 (page 64) described, registrar SHOULD authenticate 
the UAC using 
the mechanisms described in RFC3261 Section 22, so the username of the 
credential should 
be "bob", while RFC3261 Section 26.3.2.1 (page 243) said that username of 
this credential 
SHOULD correspond with the "userinfo" portion of the URI in the To header 
field of the 
REGISTER request, that is "alice", this means authentication is for Alice, 
not Bob.

Which one is the correct?

Best Regards,
LionEagle

***********************************************
信息安全声明：本邮件包含信息归ZTE所有，
ZTE对该邮件拥有所有权利。请接收者注意
保密，未经发件人书面许可，不得向任何第
三方组织和个人透露本邮件所含信息的全部
或部分。以上声明仅适用于工作邮件。
Information Security  Notice：
The information contained in this mail is
solely property of  ZTE Corporation. 
This mail communication is confidential.
Recipients named above are obligated to
maintain secrecy and are not permitted to
disclose the contents of this communication
to others.
***********************************************
_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: "Kasturi Narayanan" <[email-masked]>
Date: Mon, 12 Dec 2005 19:20:20 -0600

Ideally the intention is to authenticate the originator of the Register
regardless of whom that person is registering.

Once authenticated there may be authorization needed (local policy)
regarding whom all this person can register if the person to be registered
is a valid user of this network.

So authentication is done for the originator of the request. 

And also in your example if Alice is being registered u may want the contact
to look like [email-masked] unless u intentionally meant that.

If what u mentioned below is true then it needs to be looked into.

Kasturi

  _____  

From: [email-masked] [mailto:[email-masked]] On Behalf Of
[email-masked]
Sent: Monday, December 12, 2005 7:07 PM
To: [email-masked]
Subject: [Sip] one question on the authentication for
third-partyregistration

Hi, 

We assume that Bob registrers for Alice, so the REGISTER request may be like
this: 

Best Regards, 
LionEagle 

***********************************************
d?!f/e. e(e#0f
o<f,i.d;6ee+d?!f/e=ZTEf f o><

ZTEe/9h/%i[1].d;6f
%f f f f 

  _____  

e)c[1]h/7f
%f6hf3(f 
  _____  

d?e/o<
f*g;ed;6d::d9&i"h.8e/o<d8e>ed;;d=g,,
d8 f9g; 
  _____  

g;e
d8*d::ii2f,i[1].d;6f e+d?!f/g 
  _____  

e(i 
  _____  

(
fi 
  _____  

(ec[1]d;%d8 e#0f
d;i[1]g(d:
e7%d=i[1].d;6c
Information Security  Noticeo<

---

From: Mahesh Govind <[email-masked]>
Date: Tue, 13 Dec 2005 10:44:16 +0900

HI,

If  bob can use his credentials for registering for alice ,  If required,
he can hijack the calls to alice ???

So I think one have to authenticate REGISTER against the userinfo in To:

With regards

Mahesh

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of
[email-masked]
Sent: Tuesday, December 13, 2005 10:07 AM
To: [email-masked]
Subject: [Sip] one question on the authentication for third-party
registration

Hi, 

Best Regards, 
LionEagle 

***********************************************
岳→겘若됧뀲鶯경삇竊싨쑍??뻑?끻맜岳→겘壤뭒TE?€?됵펽
ZTE野배???뻑?ζ쐣?€?됪쓢?⒲€귟??ζ뵸?끾낏??br>
岳앭칳竊뚧쑋瀯뤷룕餓뜸볶阿?씊溫멨룾竊뚥툖孃쀥릲餓삡퐬寧?br>
訝됪뼶瀯꾤퍐?뚥릉雅븅€뤻쑓?ч궙餓뜻??ヤ에??쉪?③깿
?뽭깿?녴€귚빳訝듿０?롣퍎?귞뵪雅롥램鵝쒒궙餓뜰€?br> Information Security
Notice竊?br> The information contained in this mail is
solely property of  ZTE Corporation. 
This mail communication is confidential.
Recipients named above are obligated to
maintain secrecy and are not permitted to
disclose the contents of this communication
to others.
***********************************************

---

From: [email-masked]
Date: Tue, 13 Dec 2005 09:50:49 +0800

Hi, Mahesh

Thank you for your reply.

There is a mistake in the example, then user-info in Contact uri should be 
"alice" not "bob".

My confusion is the username of the credential not the Contact in 
REGISTER. I think the username of the credential should be "bob" since the 
originator of REGISTER is bob, but RFC3261 Section 26.3.2.1 (page 243) 
said that username of this credential 
SHOULD correspond with the "userinfo" portion of the URI in the To header 
field of the REGISTER request.

Best Regards, 
LionEagle 

====================================================
实质性的东西，用眼睛是看不见的，只有用心才能看得清
====================================================
     nothing left even the death 
====================================================
              施浩111543
     中心研究院  固网软件开发部
Tel:    +86-25-52871361
E-mail: [email-masked]
MSN:    [email-masked]
====================================================

Mahesh Govind <[email-masked]>

2005-12-13 上午 09:44
 
        收件人：        [email-masked], [email-masked]
        抄送： 
        主题：  RE: [Sip] one question on the authentication for 
third-party     registration

HI,

With regards
Mahesh

-----Original Message-----

Hi, 

Best Regards, 
LionEagle 

ZTE野배???뻑?ζ쐣?€?됪쓢?⒲€귟??ζ뵸?끾낏??br> 岳앭칳竊뚧쑋瀯뤷룕餓뜸볶
阿?씊溫멨룾竊뚥툖孃쀥릲餓삡퐬寧?br> 訝됪뼶瀯꾤퍐?뚥릉雅븅€뤻쑓?ч궙餓뜻??
ヤ에??쉪?③깿

************************************************
The email has  been scanned by Anti-Spam
system,  if you find Spam or Virus in this mail,
please forward it to: [email-masked]
************************************************

***********************************************
��Ϣ��ȫ���������ʼ�������Ϣ��ZTE���У�
ZTE�Ը��ʼ�ӵ������Ȩ�����������ע��
���ܣ�δ���������������ɣ��������κε�
������֯�͸���͸¶���ʼ�������Ϣ��ȫ��
�򲿷֡����������������ڹ����ʼ���
Information Security  Notice��
The information contained in this mail is
solely property of  ZTE Corporation. 
This mail communication is confidential.
Recipients named above are obligated to
maintain secrecy and are not permitted to
disclose the contents of this communication
to others.
***********************************************
_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip