Subject: Re: Subsequent Authorization

From: Alan Johnston <[email-masked]>
Date: Mon, 25 Oct 1999 13:49:30 -0500

Clark,

You are correct - the exact way the document reads, where the resend of
the credentials in subsequent INVITEs is identical to credentials in the
initial INVITE, this would be a problem.  In reality, enough "salt"
would be included in the credentials so that the resend would not be
identical, and a forgery attack of this kind would fail.

What is really meant by this section is that the User Agent Client knows
the form of the authentication credentials required by the server and
generates them with the initial INVITE rather than leaving them out and
waiting for the challenge.

Perhaps I should modify the text and credentials accordingly.

Thanks,
Alan Johnston
+1-314-342-7360
MCI WorldCom
[email-masked]

"G. Clark Brown" wrote:
> 
> In 2.1.2 of draft-johnston-sip-call-flows-00.txt, it says:
> "Since the user already has authenticated with the server, the
> user supplies authentication credentials with the request and
> is not challenged by the server."  Since the credentials could
> have been sniffed from the original registration, doesn't the
> lack of a new challenge leave the registration server open
> to a forgery attack?
> 
> Clark

---

From: "G. Clark Brown" <[email-masked]>
Date: Mon, 25 Oct 1999 12:16:03 -0500 (CDT)

Clark