Subject: Re: [Sipping] review: draft-dotson-sip-mutual-auth-01

From: Scott Lawrence <[email-masked]>
Date: Mon, 10 Mar 2008 16:28:59 -0400

On Fri, 2008-02-22 at 16:22 -0700, Sumanth Channabasappa wrote:
> Folks,
> 
> At the last IETF it was mentioned that the proposal in
> draft-dotson-sip-mutual-auth-00 is not to be considered an essential
> correction. We listened! So a new version that presents the proposal as
> an extension has been uploaded:
> 
> http://tools.ietf.org/id/draft-dotson-sip-mutual-auth-01.txt
> 
> 
> As a refresher, the I-D proposes the use of the
> Proxy-Authentication-Info header for Proxy-to-User authentication within
> SIP. This header allows for a UA to authenticate the client during
> digest authentication, thus enabling mutual authentication. This is
> similar to the currently specified use of Authentication-Info header for
> User-to-User authentication. It also enables limited integrity
> protection, and for the proxy to provide additional details such as the
> nonce to use for future authentication responses (next nonce).

The basic idea of supporting mutual authentication of a SIP proxy is a
good one, but this draft doesn't quite cover the ground.

It has one serious limitation in scope:

  - Why is the proxy limited to putting the Proxy-Authentication-Info
    into 2xx responses?

Are failure responses not important to authenticate?  I think it's
clear that there are many responses in which it's very useful to know
whether or not the authentication you sent to the proxy was acceptable
and whether or not the ; consider 305 (Use Proxy), or any other 3xx
response, or the 6xx responses.

You missed the cases of multiple proxies and how they should be
handled.  Consider:

  UA <---> Proxy1 <----> Proxy2 <----> Target

or

  UA <---> Proxy1 <--+
                     |
                     +--> Proxy2 <-----> Target1
                     |
                     +--> Proxy3 <-----> Target2

Those cases may require that multiple Proxy-Authentication-Info values
be supported; the draft doesn't allow for that, and doesn't describe
how Proxy1 should treat the values from other proxies further
downstream.

For those who are curious, this didn't arise in HTTP, because all
proxy authentication was/is defined to be hop-by-hop.

_______________________________________________
Sipping mailing list  https://www.ietf.org/mailman/listinfo/sipping
This list is for NEW development of the application of SIP
Use [email-masked] for questions on current sip
Use [email-masked] for new developments of core SIP

---

From: "Sumanth Channabasappa" <[email-masked]>
Date: Tue, 11 Mar 2008 06:21:55 -0600

Scott,

Thanks for your comments. You raise some good points. However, the
primary goal was to ensure that we add - what we believe - is missing in
3261. Specifically, we propose that we have the same capabilities for
Proxy-to-User authentication, as we have for User-to-User authentication
using the Authentication-Info header.
 
If we want to explore the error conditions you indicate, we may also
need to analyze the Authentication-Info header in this regard. This
would increase the scope, and needs more thought and discussion. 

- S

-----Original Message-----
From: Scott Lawrence [mailto:[email-masked]] 
Sent: Monday, March 10, 2008 4:29 PM
To: Sumanth Channabasappa
Cc: [email-masked]; Stuart Hoggan; [email-masked]
Subject: Re: [Sipping] review: draft-dotson-sip-mutual-auth-01

or

  UA <---> Proxy1 <--+
                     |