Subject: RE: [Sip] Re: [Sipping] New version of the SIP-AAA reqs draft

From: [email-masked]
Date: Tue, 4 Mar 2003 10:24:40 +0200

Hi,

Inline.

 > -----Original Message-----
 > From: ext [email-masked] [mailto:[email-masked]]
 > Sent: 03 March, 2003 17:34
 > To: Khartabil Hisham (NMP/Helsinki)
 > Cc: [email-masked]; [email-masked];
 > [email-masked]; [email-masked]; [email-masked];
 > [email-masked]
 > Subject: RE: [Sip] Re: [Sipping] New version of the SIP-AAA 
 > reqs draft
 > 
 > 
 > [email-masked] writes:
 > 
 >   > I think you exaggerating here with several hundreds, but 
 > anyway, I
 >   > was suggesting several hundreds of proxy-authenticate headers. Of
 >   > course you can scale your network to be better than 
 > that. I'm trying
 >   > to find a solution that doesn't rely on the UA to send its realm
 >   > (You haven't objected to that yet).
 > 
 > the realm can be infered from the from header in invite 
 > request, but not
 > in bye request.  as i have explained, there is no security 
 > risk when the
 > user tells the realm in which it want to get authenticated.  
 > so i don't
 > see any problems with that and don't understand why yiou 
 > would need to
 > find another for the proxy to figure it out.   this is how 
 > eap works and
 > that is how sip should work.

I think these problems don't stem from inefficiency of SIP but of a particular type of network deployment. EAP doesn't have a concept of a realm, although some EAP types may. However, EAP does have the Identity request/response mechanism for querying the client's id. In SIP, digest doesn't have a way to do a similar Identity check. Instead the server challenges and issues its realm blindly without knowing the client's id, and the client can then choose a matching username/password pair. Digest authenticates the username, not the From field - these may not be exactly the same. 

This feature of blind challenges in digest has proven problematic before, and I agree that it would be nice if there was an EAP Identity request/response -type mechanism available in Digest. But it isn't an easy add-on.

Cheers,
Aki

 > 
 > -- juha
 > 
 > _______________________________________________
 > Sipping mailing list  https://www1.ietf.org/mailman/listinfo/sipping
 > This list is for NEW development of the application of SIP
 > Use [email-masked] for questions on current sip
 > Use [email-masked] for new developments of core SIP
 > 
_______________________________________________
Sipping mailing list  https://www1.ietf.org/mailman/listinfo/sipping
This list is for NEW development of the application of SIP
Use [email-masked] for questions on current sip
Use [email-masked] for new developments of core SIP

---

From: [email-masked]
Date: Tue, 4 Mar 2003 10:33:14 +0200

[email-masked] writes:

 > Digest authenticates the username,
 > not the From field - these may not be exactly the same.

i have never claimed that digest authenticates the from field, but in
case of an initial request, the proxy can get the realm to be used in
its challenge from the from field.  in subsequent requests this is not
anymore possible.

 > This feature of blind challenges in digest has proven problematic
 > before, and I agree that it would be nice if there was an EAP
 > Identity request/response -type mechanism available in Digest. But it
 > isn't an easy add-on.

we don't need an eap style identity request/response.  what we need is
an ability for the ua to tell in its requests to the proxy the realm it
claims to belong to so that the proxy can correctly challenge it.  this
can be easily fixed with a single new header or parameter.

-- juha