Subject: RE: [Sip] Residential UA security

From: "Mahey, Sonit" <[email-masked]>
Date: Wed, 3 Apr 2002 14:25:01 -0500

Gvelo writes:

ok . but how my UA validate an invite message from a proxy ?? anyone can
impersonate my proxy.
in other words, a proxy can validate a UA but can a UA validate a proxy ?

thanks.
------------------------
[SonitMahey] Sure can. Take a look at Proxy-Authentication in the draft(s)
from James Undery - draft-undery-.....

Sonit Mahey,
Architect - Voice Business Unit,
Unisphere Networks,
10 Technology Park Drive,
Westford, MA 01886,
USA.

======================================= 
This email message is for the sole use of the intended recipient (s) and may
contain confidential and privileged information, including without
limitation, Confidential and/or Proprietary Information belonging to
Unisphere Networks, Inc. Any unauthorized review, use, disclosure or
distribution is prohibited. If you are not the intended recipient, please
contact the sender by reply email and destroy all copies of the original
message.

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: "Vesa Torvinen (LMF)" <[email-masked]>
Date: Thu, 4 Apr 2002 12:06:01 +0200

We (James Undery et al) got very clear negative feedback for our 
Proxy-to-UAS authentication extensions in Minneapolis. It currenly 
seems that UAS will not be able to validate a Proxy with HTTP 
authentication headers - unless you don't want to put B2BUA's in 
every last-hop proxy. 

Another potential extension to SIP/HTTP authentication would have 
been to allow proxy to forse UAS for authentication with 
terminating calls (because it can already authenticate UAC with 
originating calls). HTTP authentication framework really works 
only for one direction between UA and proxy - three other 
'directions' are uncovered. The case where the clients forse the 
servers to authenticate was never covered by undery-draft(s). 

I think that folks don't care about the last-hop-proxy authentication 
because UAS can always challenge the UAC at the other end e.g. with 
this "anonymous" authentication. This provides some security even if 
you didn't have the TLS connection open with the proxy. However, I 
think that the security related to the last-hop-proxy is still 
somehow problematic issue in SIP. 

Vesa 

> -----Original Message-----
> From: Mahey, Sonit [mailto:[email-masked]]
> Sent: 3. huhtikuuta 2002 22:25
> To: [email-masked]'
> Cc: [email-masked]'; [email-masked]'; [email-masked]';
> [email-masked]'
> Subject: RE: [Sip] Residential UA security
> 
> 
> Gvelo writes:
>