Subject: [sipcore] HTTP Basic deprecation

From: Tanguy Ortolo <[email-masked]>
Date: Mon, 8 Jun 2009 12:10:02 +0200

Hello,

Documenting myself to set up a personal telephony service, I found that
SIP authentication requires the use of HTTP Digest, and deprecates HTTP
Basic because of its weaknesses.

I suppose these weaknesses are the possible cleartext transmission of
the password, and the possibility to replay an authentication. These
issues can be addressed by using an external encryption, such as TLS.

With HTTP Digest, these problems no more exist, as it is
challenge-response and nonce-based. But it introduces two side-effects:
- the passwords need to be stored in clear (or, at least, the HA1, which
  knowing is sufficient to authenticate, and that actually /replaces/
  the password);
- it forbids the use of some generic authentication managers, such as
  PAM, that requires the cleartext password, in particular to check it
  against a secured hashed password database.

Ideally, for my personal services, I prefer to use PAM as a single
authentication manager with a secure storage: for SIP, I know I cannot
do so, right now. But are there solutions to avoid HTTP Digest issues,
or to reintroduce HTTP Basic (over TLS) in future SIP improvements?

Regards,

-- 
Tanguy Ortolo

---

From: Theo Zourzouvillys <[email-masked]>
Date: Tue, 9 Jun 2009 05:28:21 +0100

On Mon, Jun 8, 2009 at 11:10 AM, Tanguy Ortolo<[email-masked]> wrote:

> But are there solutions to avoid HTTP Digest issues,

There are a number of solutions available, none of which involve
sending plain text passwords over the wire :)

If you're trying to authenticate directly attached clients, i.e an
outbound proxy service, then mutual TLS is the way forward.  If you're
trying to provide a service to non directly connected clients, but
want to be able to identify them, take a look at Identity (rfc4474),
or it's trusted network cousin P-Asserted-Identity.

 ~ Theo