Subject: SIP security

From: Markus Pscheidt <[email-masked]>
Date: Wed, 14 Apr 1999 15:16:05 +0200

What is the security situation of SIP likely to be in the future?

...There was an article in this mailing list some time ago stating that
SAP security mechanisms would be appropriate to address the missing
authentication procedures of SIP. Is that right, or are there other
plans?

~~ Markus Pscheidt alias [email-masked] ~~
 student at Graz Technical University, Austria

---

From: Jonathan Rosenberg <[email-masked]>
Date: Thu, 15 Apr 1999 01:38:08 -0400

What missing authentication procedures? rfc2543 supports basic, digest,
and pgp authentication.

-Jonathan R.

-- 
Jonathan D. Rosenberg                       Lucent Technologies
Member of Technical Staff                   101 Crawfords Corner Rd.
High Speed Networks Research                Holmdel, NJ 07733
FAX: (732) 834-5379                         Rm. 4C-526
EMAIL: [email-masked]
URL: http://www.cs.columbia.edu/~jdrosen

---

From: Henning Schulzrinne <[email-masked]>
Date: Thu, 15 Apr 1999 09:44:24 -0400

Can you be precise as to the "missing authentication features"? SIP
currently supports password-based, challenge-response and PGP-based
authentication, with additional methods easily addable. (E.g., a current
homework assignment of mine is asking my Network Security students to
add OTP (S/KEY aka Lamport hash) to HTTP/SIP.

---

From: Markus Pscheidt <[email-masked]>
Date: Tue, 20 Apr 1999 13:27:58 +0200

sorry, my fault. the sip-security draft - which is outdated by the
way - did not mention authentication procedures that make use of HTTP.

---

From: Henning Schulzrinne <[email-masked]>
Date: Tue, 20 Apr 1999 09:01:54 -0400

> way - did not mention authentication procedures that make use of HTTP.

Just for the record: The SIP security draft has long been superseded by
including the material into RFC 2543.

-- 
Henning Schulzrinne   http://www.cs.columbia.edu/~hgs