Subject: Re: Hide interaction with Record-Route

From: Sean Olson <[email-masked]>
Date: Tue, 22 Jun 1999 09:22:18 -0500 (CDT)

> 
> Alan Johnston wrote:
> > 
> > >From the responses seen to date, it seems:
> > 
> > 1. There is interest in the SIP spec support for the Hide header and
> > encrypted Via fields.
> 
> I guess silence probably signifies a lack of strong feelings. Personally
> I'd be happy to see Hide disappear. It sounds like the rules for how to
> treat this header is quickly becoming rather complicated and IMHO that's
> a good reason for dropping it, especially if we think it may not really
> be needed.
> 
> -- 
> Anders Kristensen <[email-masked]>,
> http://www-uk.hpl.hp.com/people/ak/
> Hewlett-Packard Labs, Bristol, UK
> 

I concur. Given the growing complexity and the questionable value of the
Hide: header, I say drop it. It gives a false sense of security and can 
just as easily be achieved by stripping the Route/Record-Route headers. 

-----------------------------------------------------------------
Sean Olson            E-mail: [email-masked]
Ericsson Inc.         Voice: (972) 583-5472 
                      FAX: (972) 669-0154

---

From: Jonathan Rosenberg <[email-masked]>
Date: Tue, 22 Jun 1999 16:23:23 -0400

> just as easily be achieved by stripping the Route/Record-Route headers.

There is an additional issue worth considering, which is the somewhat
unusual trust model implied by Hide. Namely, a server is not responsible
for hiding its address - the NEXT HOP is. This implies that a server
trust the next hop to perform the encryption, and do it with sufficient
randomness added in. It also implies that the next hop puts itself in
the Record-Route. This is a lot of trust to be placed in the next hop.
If the server is another domain, it seems unlikely it will happen. Whats
the motivation for the next hop to do it? In fact, it can serve as a DOS
attack. A server can always add Hide to requests sent the to the next
hop, and that server would be forced to go call stateful in order to
perform the operation. 

If I really wanted to hide the route, I would prefer to deploy a system
where it was my own servers providing this feature. Stripping the
Via/Record-Route/Routes and replacing them on the way back works this
way. If I want the feature, my own server provides it.

-Jonathan R.
-- 
Jonathan D. Rosenberg                       Lucent Technologies
Member of Technical Staff                   101 Crawfords Corner Rd.
High Speed Networks Research                Holmdel, NJ 07733
FAX:   (732) 834-5379                       Rm. 4C-526
EMAIL: [email-masked]
URL: http://www.cs.columbia.edu/~jdrosen