Subject: RE: [Sip] Re: [Sipping] New version of the SIP-AAA reqs draft

From: Jiri Kuthan <[email-masked]>
Date: Tue, 04 Mar 2003 16:38:14 +0100

At 01:57 PM 3/3/2003, [email-masked] wrote:
>A server knows what realm to use for a certain interface (it can do its own mapping). It cannot rely of a UA telling it the realm.

Why?

-jiri

_______________________________________________
Sipping mailing list  https://www1.ietf.org/mailman/listinfo/sipping
This list is for NEW development of the application of SIP
Use [email-masked] for questions on current sip
Use [email-masked] for new developments of core SIP

---

From: Jiri Kuthan <[email-masked]>
Date: Tue, 04 Mar 2003 16:41:37 +0100

At 02:28 PM 3/3/2003, [email-masked] wrote:
>Can the proxy challenge with all its realms? I really don't believe you can trust the UA supplying the realm it belongs to.

What is the security concern?

Think of it like about when you log on at your PC -- of course
uid is first supplied by user. The point is it is only accepted
if the password for that uid is good.

-Jiri

---

From: Jiri Kuthan <[email-masked]>
Date: Tue, 04 Mar 2003 16:47:01 +0100

At 04:06 PM 3/3/2003, [email-masked] wrote:
>I was offering a solution to your problem in the form of a question. Here it is again in the form of a suggestion:
>
>If your poxy supports multiple realms on the same interface, then it can challenge with all the realms and therefore the UA does not have to supply the realm to the proxy.

As Juha said, interfaces are unrelated to digest authentication.

I suspect that your solution is not usable. I really do not want to dump 
as many challenges in responses as  number of domains I server (1000?)

-Jiri

---

From: Jiri Kuthan <[email-masked]>
Date: Tue, 04 Mar 2003 17:11:31 +0100

At 04:22 PM 3/3/2003, [email-masked] wrote:
>I think you exaggerating here with several hundreds, but anyway, I was suggesting several hundreds of proxy-authenticate headers. Of course you can scale your network to be better than that. I'm trying to find a solution that doesn't rely on the UA to send its realm (You haven't objected to that yet).
>
>/Hisham

First of all, as said previously, live with realms from UAC. They
are as trustworthy as user's id -- all is supplied by user and what
really matters is whether the credentials are ok. (And again, forget
interfaces, please.)

The real questions is whether to authenticate at all, and if so
which realm the server should use to challenge.

Let me give an example. A proxy maintains a policy which is 
a no relaying: drop requests which neither have my domain 
  in r-uri nor have my domain in From
b verify from: if request originator claims to be a part of
  my domain in From of a request, authenticate
c watch all: sessions are record-routed

Scenario:
1) a@other calls b@other which gets forwarded to b@mine
2) b@mine sends a BYE, it looks like:

BYE sip:[email-masked]
From: b@other
To: a@other
Route: <proxy@mine;lr>

What will you do now? Well with the policy above you would drop
it (point a). If you are smarter, you will see your Route and
infer "that's my Route, I must have accepted the previous INVITE"
and will not drop it. The questions are now:
- should you authenticate? (remember, you can't authenticate
  request originators from other domains)
- if so, with what realm
- how far can you trust the information in Route (actually, not at all)

-Jiri

---

From: "Peterson, Jon" <[email-masked]>
Date: Tue, 4 Mar 2003 16:13:37 -0500

Understood, but I'd like to stress that TLS provides a very important
property to the Digest authentication process - being able to correlate the
realm with the certificate of the proxy is very valuable from a security
perspective. I wouldn't go so far as to say that Digest authentication is
useless without this property... but it is weakened. The two are best used
in concert. I hope that properties like this will encourage the further
deployment of TLS.

Jon Peterson
NeuStar, Inc.

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]
> Sent: Tuesday, March 04, 2003 12:46 PM
> To: Peterson, Jon
> Cc: [email-masked]; [email-masked];
> [email-masked]; [email-masked];
> [email-masked]; [email-masked]; [email-masked];
> [email-masked]
> Subject: RE: [Sip] Re: [Sipping] New version of the SIP-AAA reqs draft
> 
> 
> Peterson, Jon writes:
> 
>  > The TLS extensions draft defines a
>  > 'server_name' extension to the TLS HELLO message that 
> allows the client to
>  > say which hostname, of many possible virtual hosts at a 
> single address, it
>  > intends to connect to. Effectively, by choosing the 
> hostname, in the SIP
>  > case this would also choose the realm.
> 
> this seems to solve what i have been asking for, i.e., allowing the
> client to tell to the proxy, which realm it belongs to.
> 
> the only problem is that today there exist very few UAs and proxies on
> the market that implement TLS.
> 
> -- juha
>