Subject: [Sip] sip-target-dialog-01

From: "Cullen Jennings" <[email-masked]>
Date: Fri, 29 Jul 2005 12:29:06 -0400

I like this and hope we can move forward with it. The lack of progress on
anyone securing REFER via the current mechanism is part of what makes me
believe in this.

I think your security section on randomness needs a little more. 3261 only
requires things to be pseudo random in that collisions are avoid. However,
it allows for things to be predictable such that if I see the state of
several of your request is a row, I may be able to guess the state of your
random number generator and predict the next one. What we need here is not
just pseudo random but crypto random. The to and from tags and probably
call-id need to not be predictable. Right now, most implementations I have
seen are using pseudo random (not crypto random) numbers for things like to
and from tags. If they support this mechanism, then they need to start using
crypto random. This may be a little hard for large GWs as they don't have
many sources of randomness (such as disk drives etc) and they have to
produce lots of these numbers. I think it should be possible given that they
do have lots of somewhat random network events.

If a UA only uses pseudo random, an attacker could send 100 calls to it,
look at the to tags, guess the state of the random number generator, then
try to "authorize" as the next logical call that comes to it.

Anyways, I think you should add into the security section that the right
things needs to be crypto random and what that means.

Cullen

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: Jonathan Rosenberg <[email-masked]>
Date: Sun, 31 Jul 2005 09:21:52 -0400

This is a good point, Cullen. I'll mention it in the next revision.

Thanks,
Jonathan R.

-- 
Jonathan D. Rosenberg, Ph.D.                   600 Lanidex Plaza
Director, Service Provider VoIP Architecture   Parsippany, NJ 07054-2711
Cisco Systems
[email-masked]                              FAX:   (973) 952-5050
http://www.jdrosen.net                         PHONE: (973) 952-5000
http://www.cisco.com

---

From: Jonathan Rosenberg <[email-masked]>
Date: Sun, 31 Jul 2005 09:40:14 -0400

One more thing actually:

Cullen Jennings wrote:

> requires things to be pseudo random in that collisions are avoid. 

Actually, that is not true. Quoting RFC 3261:

    When a tag is generated by a UA for insertion into a request or
    response, it MUST be globally unique and cryptographically random
    with at least 32 bits of randomness.  A property of this selection

That said, I added some text to target-dialog emphasizing the importance 
of the cryptographic randomness, not just pseudorandom identifiers.

However,
> random number generator and predict the next one.

To be clear, when sips is used you can't observe them. But if you are a 
user of the system you can make/receive your own calls, and observe them 
by being a participant.

-Jonathan R.