Subject: [sipcore] The versions of SIP digest authentication

From: [email-masked] (Dale R. Worley)
Date: Thu, 23 Jan 2014 17:45:47 -0500 (EST)

I accumulated the information I could find regarding the three (!)
versions of SIP digest authentication that have been defined.  The
following chart summarizes the relationship between these various
documents.  In particular, beware that RFC 2543's version is based on
RFC 2617, but RFC 3261 incorrectly states that RFC 2453 is based on
RFC 2069.

In principle, I'd like to see this documented in
draft-ietf-sipcore-digest-scheme, but I'm not sure that it would be
worth the effort.

SIP auth.               Based on HTTP auth.     Changes from previous version
---------               -------------------     -----------------------------
RFC 2543                RFC 2617[1]             --

RFC 3261                RFC 2617                Basic auth. forbidden

draft-ietf-             draft-ietf-             added SHA2-256, SHA2-256-sess, 
sipcore-digest-scheme   httpauth-digest         SHA2-512-256, and              
                                                SHA2-512-256-sess              
                                                "qop" is required

[1] RFC 3261 states in section 22.4 that "RFC 2543 is based on HTTP
Digest as defined in RFC 2069", however this is incorrect.  The
reference in RFC 2543 is to "HTTP authentication:  Basic and digest
access authentication," Internet Draft, Sept.  1998, which resolves to
draft-ietf-http-authentication-03, which is the last draft version of
RFC 2617.  But RFC 2617 does describe mechanisms to provide backward
compatibility with RFC 2069, and it appears from RFC 3261, section
22.4, item 8 that some pre-2543 implementations only supported 2069
authentication.

Dale