Subject: [Sip] Why Require: sec-agree

From: "Nayak, Subhash" <[email-masked]>
Date: Thu, 30 Jun 2005 19:15:08 +0530

Hi,

      RFC 3329 (Security Agreement Mechanism for SIP) specifies 

that a client should insert both a Require and a Proxy-Require 

header with value "sec-agree" (See Sec 2.3.1 Client Initiated 

mechanism). Subsequently, after successful processing, the proxy 

removes this token from *both* the headers. 

My question is, why does the client need to add a 

"Require: sec-agree" when only the proxy is required to support 

this feature in this scenario ? As I understand it, it would have 

sufficed to only insert a "Proxy-Require: sec-agree" header...

Thanks in advance

Subhash Nayak

Sonus Networks, Inc.

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: Arjun Roychowdhury <[email-masked]>
Date: Thu, 30 Jun 2005 17:03:05 -0400

The reason for this is that, realistically speaking, there is no
possible way for a UA to guess if the node in the next-hop is really a
proxy or a UA. In addition to that, a general Require would work if
you assume that the first message going out is an OPTIONS to its
next-node. It is also possible for the UAC to just start with an
INVITE directly, in which case, the proxy, seeing an INVITE request
not destined for itself will pass it along without complying to the
sec-agree requirements.

Therefore, it was suggested that a UA inserts *both* require and
proxy-require. The downside, however, is that now the next-hop  would
need to strip both headers before sending it out. Its the lesser of
two evils, I guess.

regds
arjun

On 6/30/05, Nayak, Subhash <[email-masked]> wrote:
> Sip mailing list 
> https://www1.ietf.org/mailman/listinfo/sip

-- 
Arjun Roychowdhury