Subject: [Sipping] More thoughts on fixing early media -- using null authentication

From: Dean Willis <[email-masked]>
Date: Sun, 23 Jul 2006 17:02:29 -0500

A side conversation with Michael Hammer raised another idea for me.

Is there a  way to use the http-auth mechanism (which also has the  
desirable property of return routability) here?

Henning, I believe, has several times suggested that we use a null- 
authentication transaction to prevent the voice-hammer attack.

UAC sends offer to UAS.
UAS responds with a 401, indicating some realm that basically means  
"Make up a response and send it".
UAC sends a reinvite, this time with the made-up credentials
UAS says "Ahah, I have SIP return routability to this guy. Maybe he's  
legit". Then proceeds as a normal transaction.

Note that this doesn't prevent a voice hammer, but at least does give  
the dupe some idea where the attack came from.

Perhaps we could tack on an extension in the 401 that says "Will send  
you early media for reason X", where X is one of a set of registered  
early-media-reasons.
Then UAC could defer sending the re-INVITE until it gets ready for  
that early-media.

There's probably some sort of fatal flaw here, but there also might  
be the tip of an idea that we could dig out and look at.

--
Dean

_______________________________________________
Sipping mailing list  https://www1.ietf.org/mailman/listinfo/sipping
This list is for NEW development of the application of SIP
Use [email-masked] for questions on current sip
Use [email-masked] for new developments of core SIP

---

From: "Christer Holmberg \(JO/LMF\)" <[email-masked]>
Date: Mon, 24 Jul 2006 00:35:39 +0200

Hi,

>you early media for reason X", where X is one of a set of registered 

In case of forking, would the UAC need to get this 401 response from ALL UASs that want to send early media? The forking proxy wouldn't fowards all 401 responses, would it?

>Then UAC could defer sending the re-INVITE until it gets ready for  that early-media.

I guess we should not use the word re-INVITE. Because, the 401 response terminated to session setup, and does NOT build a route set. So, you would be sending a new initial INVITE (with the credentials), and that INVITE may get forked, in which case you would basically tell all receivers at once that you are ready for early media.

Or, did I missunderstand?

Regards,

Christer

---

From: Dean Willis <[email-masked]>
Date: Sun, 23 Jul 2006 20:56:36 -0500

On Jul 23, 2006, at 5:35 PM, Christer Holmberg ((JO/LMF)) wrote:

>
> In case of forking, would the UAC need to get this 401 response  
> from ALL UASs that want to send early media? The forking proxy  
> wouldn't fowards all 401 responses, would it?
>

The proxy had better forward 401s . . .

> I guess we should not use the word re-INVITE. Because, the 401  
> response terminated to session setup, and does NOT build a route  
> set. So, you would be sending a new initial INVITE (with the  
> credentials), and that INVITE may get forked, in which case you  
> would basically tell all receivers at once that you are ready for  
> early media.
>

Yes, I should have send "re-sending the INVITE."

But since each receiver used a different nonse/realm set, you only  
are authorizing early media for the one(s) for which you're including  
a response for. The others are going to come back with another 401.

--
Dean

---

From: Henning Schulzrinne <[email-masked]>
Date: Sun, 23 Jul 2006 22:21:19 -0400

There is something like that in RFC 3261:

22.1

   server does not require authentication for a particular request, it
    MAY accept a default username, "anonymous", which has no password
    (password of "").

On Jul 23, 2006, at 6:02 PM, Dean Willis wrote:

> UAS says "Ahah, I have SIP return routability to this guy. Maybe  
> he's legit". Then proceeds as a normal transaction.
>
>
> Note that this doesn't prevent a voice hammer, but at least does  
> give the dupe some idea where the attack came from.
>
>
>
> Perhaps we could tack on an extension in the 401 that says "Will  
> send you early media for reason X", where X is one of a set of  
> registered early-media-reasons.

---

From: "Jeroen van Bemmel" <[email-masked]>
Date: Mon, 24 Jul 2006 08:15:51 +0200

>> In case of forking, would the UAC need to get this 401 response  from ALL 
>> UASs that want to send early media? The forking proxy  wouldn't fowards 
>> all 401 responses, would it?
>>
>

The proxy would collect all 401's and combine them to a single answer, 
containing all challenges. So as long as you put your early media thingy as 
a parameter within the WWW-Authenticate header itself, it could work

Regards,

Jeroen

---

From: Paul Kyzivat <[email-masked]>
Date: Tue, 25 Jul 2006 09:09:50 -0400

Dean,

Seems like there are some nasty HERFP problems in this approach.

	Paul

Dean Willis wrote:
> Henning, I believe, has several times suggested that we use a 
> null-authentication transaction to prevent the voice-hammer attack.
> 
> UAC sends offer to UAS.
> There's probably some sort of fatal flaw here, but there also might be 
> the tip of an idea that we could dig out and look at.
> 
> -- 
> Dean
> 
>