Subject: Re: [sipcore] New Version Notification for draft-yusef-sipcore-digest-scheme-04.txt

From: Rifaat Shekh-Yusef <[email-masked]>
Date: Sat, 25 Jan 2014 08:49:32 -0500

Hi,

I think that I have addressed all the comments that I received so far with
the exception of the backward compatibility issue.
Please, take a look and let me know if I missed something.

On the backward compatibility issue, I still have the following question:

***[OPEN ISSUE]***

This section does NOT maintain backward compatibility with RFC 2069.

Are there SIP servers and clients out there that support *only* RFC
2069 that would break because of this?

Any thoughts on this?

Thanks,
 Rifaat

On Sat, Jan 25, 2014 at 8:42 AM, <[email-masked]> wrote:

>
> A new version of I-D, draft-yusef-sipcore-digest-scheme-04.txt
> has been successfully submitted by Rifaat Shekh-Yusef and posted to the
> IETF repository.
>
> Name:           draft-yusef-sipcore-digest-scheme
> Revision:       04
> Title:          The Session Initiation Protocol (SIP) Digest
> Authentication Scheme
> Document date:  2014-01-25
> Group:          Individual Submission
> Pages:          9
> URL:
> http://www.ietf.org/internet-drafts/draft-yusef-sipcore-digest-scheme-04.txt
> Status:
> https://datatracker.ietf.org/doc/draft-yusef-sipcore-digest-scheme/
> Htmlized:
> http://tools.ietf.org/html/draft-yusef-sipcore-digest-scheme-04
> Diff:
> http://www.ietf.org/rfcdiff?url2=draft-yusef-sipcore-digest-scheme-04
>
> Abstract:
>    This document updates the Digest Access Authentication scheme used by
>    the Session Initiation Protocol (SIP) to add support for SHA2 digest
>    algorithms to replace the MD5 algorithm.
>
>
>
>
>
> Please note that it may take a couple of minutes from the time of
> submission
> until the htmlized version and diff are available at tools.ietf.org.
>
> The IETF Secretariat
>
>

---

From: [email-masked] (Dale R. Worley)
Date: Tue, 28 Jan 2014 13:12:48 -0500 (EST)

> From: Rifaat Shekh-Yusef <[email-masked]>

> 2069 that would break because of this?

The open-source sipX didn't support qop a few years ago.  I don't know
which of its derivatives do now.  The one that eZuce sponsors does
support qop.

> From: Michael Procter <[email-masked]>

> Without being able to tell these two cases apart, I'm not sure a UAC
> is able to maximise the chances of a request succeeding at the same
> time as minimising the risk of using weaker auth-schemes when stronger
> ones may be supported.

That seems to be an unavoidable tradeoff.

Dale

---

From: Paul Kyzivat <[email-masked]>
Date: Tue, 28 Jan 2014 15:47:44 -0500

> That seems to be an unavoidable tradeoff.

The best I can see is for the UAC to respond to the strongest algorithm 
for each realm.

That is a problem if a single realm has some servers with weaker support 
than others. But the realm ought to fix that.

	Thanks,
	Paul