Subject: Re: Querry regarding PGP Encryption as applied to SIP

From: Henning Schulzrinne <[email-masked]>
Date: Mon, 16 Aug 1999 14:32:21 -0400

> [email-masked] wrote:
> 
> Dear Mr.Schulzrinne,
> 
>  We have a doubt
> 
> According  to section 15.1.1 in SIP rfc on the WWW-Authenticate
> Response header, pgp-algorithm is one of the parameters of the
> header.But the examples for this parameter are md5,sha1, which are
> hash algorithms & not encryption algorithms.

Note that WWW-Authenticate is for signing, not encryption.

> I wanted to know, can the
> encryption algorithm be specified in the same parameter as md5/RSA or
> sha/DH, this is because before encryption can be done both the parties
> who are the part of the session should know which algorithm the other
> party is using be it RSA or DH for encryption.

The PGP message itself contains the algorithm used for signing and
hashing. Thus, the role of WWW-Authenticate is only to indicate to the
client what algorithm the server understands, beyond the required hash
and public key algorithms specified in RFC 2440. RFC 2543 specifies this
for hashing; maybe it would be a good idea to add a similar parameter
(maybe called pubkey) to indicate the desired public-key signing
algorithm. Unfortunately, the public key algorithms in RFC 2440 don't
seem to have textual values (unlike the hash algorithms, which do), so
that we'd have to make up our own text values.

> 
> As WWW-Auhtenticate header is a part of a response, if it was possible
> to specify the encryption algorithm in this parameter, then both the
> parties will know which algorithm is being used.
> 
> please clarify this issue.
> 
> Thanks
> Shalabh.

-- 
Henning Schulzrinne   http://www.cs.columbia.edu/~hgs