Subject: [Simple] MSRP-relays and HTTP Digest authentication

From: Miguel Garcia <[email-masked]>
Date: Thu, 16 Dec 2004 22:30:58 +0200

Hi:

I think there is also something that deserves a bit more of discussion: 
the usage of HTTP Digest authentication in MSRP-relays.

An HTTP Digest response contains a checksum of the username, password, 
nonce, the method and the requested URI. Unlinke HTTP, MSRP does not 
offer the concept of the Request-URI. So is it the To-Path what we want 
to protect in the Digest checksum? The MSRP To-Path is the most similar 
thing to the HTTP Request-URI.

Note that the MSRP relays draft indicates in Section 8.1:

    Note that unlike
    in some usages of HTTP Authentication (for example, SIP), the uri
    parameter in the Authorize header is the same as the Request-URI in
    the request line of the MSRP parcel of the AUTH request.

which is the parragraph that requires further discussion.

- Miguel

-- 
Miguel A. Garcia           tel:+358-50-4804586
Nokia Research Center      Helsinki, Finland

_______________________________________________
Simple mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/simple

---

From: Cullen Jennings <[email-masked]>
Date: Sat, 18 Dec 2004 12:54:42 -0800

Good point - I agree. I think it is just the final destination so the URI
used in digest calculation. So it should be the last URI in the To-Path
header. I will fix the text.