Subject: [Sip] Comments RFC 3329 Security Mechanism Agreement for SIP

From: "George Foti (LMC)" <[email-masked]>
Date: Wed, 15 Jan 2003 20:48:09 -0500

Hi Gonzalo & company, 
Some comments on RFC 3329:

*	Section 2.4 Security mechanisms:

You dont specify the behavior w.r.to a proxy when it comes to headers such as Security-Client. You only specify the proxy behavior towards the Require and Proxy-Require headers. 
Also,  what should the proxy do to a Supported header if it is present
*	Section 2.3.2 Server initiated :
It is stated:
"A server that by policy requires the use of this specification and receives a request that does not have the sec-agree option tag in a Require, Proxy-Require or Supported header field MUST return a 421 (Extension Required) response"
I read the text that it mandates the presence of the 3 headers for the server to accept the request.
Is that the case?
If the answer is yes, then I dont see that it is mandated in the RFC that the client MUST include Supported header. The strength used for the client w.r.to Supported header is SHOULD.
If the answer is no, then please clarify the text to eliminate any ambinguity.
*	Section 2.6
The table indicates that a proxy can add a Security-Client, and a Security-Verify. This looks like an error.
Also, I beleive that 421, 494 response can add a Security-Server.
Please verify the table
Rgds/gf