Subject: [Sip] Anohter possible slution for draft-shenoy-sip-via-validation

From: "Cullen Jennings" <[email-masked]>
Date: Sat, 4 Jan 2003 21:06:07 -0800

I doubt that doing this will help reduce DDOS or DOS attacks. For example
consider a request with a pre loaded route. There's lots more. Anyways, on a
more useful note ...

I'm suspect that we can accomplish what you are suggesting without any
protocol changes. Imagine your scheme would create a VIA that looks like:
Via: SIP/2.0/UDP foo.com:5060;branch=1234;cookie=abcd

Instead just create a branch that has the cookie embedded in it. It would
look like:
Via: SIP/2.0/UDP foo.com:5060;branch=1234-abcd

This trick is being used by proxies to embed other state that they might
want to get back later. You should have a look at HMAC.

Cullen

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: "Sachin Shenoy" <[email-masked]>
Date: Sun, 5 Jan 2003 23:25:11 +0530

Hi Cullen,

Thanks for you comments. Please find my comments inline.

> consider a request with a pre loaded route. There's lots more. Anyways, on
a

Requests with pre-loaded route set can be authenticated at proxies.
This, I think, can ward off DDoS attack using tailor made route set.

For requests there are mechanisms to authenticate and validate it. But
in the case of responses, it seems that, there is no way in which
proxies can authenticate or validate it. The mechanism given in the
draft try to provide one.

> Via: SIP/2.0/UDP foo.com:5060;branch=1234-abcd

I had reservations in reusing the branch parameter. That is why I thought a
new
paramter would serve better. Having this parameter should not require any
change in protocol as such. As far as I know Proxies and UAs are supposed
to keep the Via's intact (i.e. they are not supposed to remove any
parameters
from it), so this cookie parameter would be retained when the response
reaches
proxy.

> want to get back later. You should have a look at HMAC.

I will do that.

Thanks again.
Sachin

---

From: Jonathan Rosenberg <[email-masked]>
Date: Sun, 05 Jan 2003 21:39:43 -0500

inline.

Sachin Shenoy wrote:
>>consider a request with a pre loaded route. There's lots more. Anyways, on
>> a more useful note ...
> 
> 

The responses can be validated too, if you choose to use the security 
mechanisms specified in SIP. SPecifically, TLS connections between 
proxies would prevent the attack you describe.

DOn't get me wrong, I think what you have proposed is generally a fine 
idea and I suspect is something people may already be doing. As cullen 
said, it can be done without standardization. Indeed, you could even use 
a new Via parameter for this, and it would interoperate, since it does 
not require processing by any element but the one which inserted it.

In that regard, its very similar in concept to my predictive nonce idea:
http://www.jdrosen.net/papers/draft-rosenberg-sip-http-pnonce-00.txt
for which we also decided not to standardize - there was no need.

-Jonathan R.
-- 
Jonathan D. Rosenberg, Ph.D.                72 Eagle Rock Ave.
Chief Scientist                             First Floor
dynamicsoft                                 East Hanover, NJ 07936
[email-masked]                     FAX:   (973) 952-5050
http://www.jdrosen.net                      PHONE: (973) 952-5000
http://www.dynamicsoft.com