Subject: [SIP] Re: [Sip-implementors] Query on PGP authentication scheme.

From: Neil Deason <[email-masked]>
Date: Tue, 24 Apr 2001 09:32:14 +0100

moved to main SIP list as there is a suggested modification 
to the spec's wording here ...

Jonathan Rosenberg wrote:
> 
> > -----Original Message-----
> > From: Anand Vasudevan [mailto:[email-masked]]
> > Sent: Monday, April 23, 2001 10:07 AM
> > To: [email-masked]'; 'Jonathan Rosenberg'
> > Subject: RE: [Sip-implementors] Query on PGP authentication scheme.
> >
> > Hi,
> >    Thanks for your comments..If PGP authentication is
> > deprecated (as per
> > Jonathan),which authentication scheme
> > is the better one to implement?Because,I know only three
> > which are mentioned
> > in RFC ,
> > 1.Basic scheme
> > 2.Digest scheme
> > 3.PGP
> >
> > And also RFC2617(HTTP : Basic & Digest Authentication
> > schemes) says "Digest"
> > is better than "Basic" but is never better than any
> > Private-key crytography
> > scheme(eg., PGP)..
> >
> > So,if PGP itself is not advisable to implement,which one can i go for?
> 
> Most implementations are doing digest. I think there are a few that haven't
> even bothered with basic.

Which isn't a bad thing imho as this means you cannot 
negotiate down from a stronger authentication scheme 
to basic. Basic authentication is so badly flawed 
(clear text password transmitted over the network). 
Digest is not that hard to implement and provides 
for the same end user experience as basic whilst being 
more secure.

In fact RFC 2316 states:

"no protocol that relies on passwords sent over
unencrypted channels is acceptable."

So that this should be something we want to remove support
for over time. For now I would certainly be in favour of
motivating text to 14.2 stating basic authentication SHOULD NOT 
be used. I know this is clear in the referenced HTTP RFCs but
people don't always seem to bother reading that far when 
compiling 'must have' feature lists for SIP Servers.

Cheers,
Neil.
-- 
Ubiquity Software Corporation, UK        http://www.ubiquity.net

_______________________________________________
This list is for continuing development of the SIP protocol.
The sip-implementor's list is the place to discuss implementation,
and to receive advice on understanding existing sip.
To subscribe to it, send mail to 
[email-masked] with "subscribe" in the body.