Subject: [SIP] Registration Authentication

From: James Undery <[email-masked]>
Date: Thu, 26 Apr 2001 17:29:08 +0100

Hi,

Now the second version of the sip-register draft is out, it may be a
good time to bring up an issue I don't think was resolved last time. In

 http://lists.bell-labs.com/pipermail/sip/2000q4/003116.html

it was mentioned REGISTER is totally unprotected from by digest
authentication, i.e. auth-int does nothing to prevent someone from
replaying a successful registration with a different Contact header(s).
As PGP has been depreciated (and justifiably so) we are left without any
method, however weak, of authenticating REGISTER requests.

I am inclined to suggest deprecating REGISTER, however, I won't and
suggest instead we allow (or recommend) the contact headers are repeated
in the REGISTER message body.

James Undery

_______________________________________________
This list is for continuing development of the SIP protocol.
The sip-implementor's list is the place to discuss implementation,
and to receive advice on understanding existing sip.
To subscribe to it, send mail to 
[email-masked] with "subscribe" in the body.