Subject: using RADIUS authentication for SIP requests

From: "Jerry Mahler" <[email-masked]>
Date: Wed, 9 Feb 2000 10:51:58 -0600

Does anyone know of a way to authenticate SIP requests using a RADIUS server?

Using a RADIUS server (which uses CHAP) to authenticate SIP requests that use
BASIC authentication is not difficult.  The SIP Server (user agent or proxy) can
simply spoof a CHAP challenge and response based on the username and password
contained in the SIP request's Authorization (or Proxy-Authorization) header and
submit it to the RADIUS server.  However, BASIC authentication is quite weak and
therefore many implementations may not support it.

Using a RADIUS server to authenticate SIP requests that use DIGEST
authentication is impossible.  This is because the method of producing the
DIGEST response is very different from the method of producing the CHAP
response.  Therefore, a SIP Server (user agent or proxy) which receives a DIGEST
challenge and response cannot spoof a CHAP challenge and response to a RADIUS
server.

Does anyone have a solution to this problem?  Perhaps a new authentication
mechanism (such as CHAP, in addition to BASIC and DIGEST) is in order?

-Jerry

---

From: Paul Krumviede <[email-masked]>
Date: Wed, 09 Feb 2000 14:01:39 -0800

--On Wednesday, 09 February, 2000 10:51 -0600 Jerry Mahler 
<[email-masked]> wrote:

> Using a RADIUS server (which uses CHAP) to authenticate SIP requests
> that use BASIC authentication is not difficult.  The SIP Server (user
> agent or proxy) can simply spoof a CHAP challenge and response based on
> the username and password contained in the SIP request's Authorization
> (or Proxy-Authorization) header and submit it to the RADIUS server.
> However, BASIC authentication is quite weak and therefore many
> implementations may not support it.
>
> authentication is impossible.  This is because the method of producing
> the DIGEST response is very different from the method of producing the
> CHAP response.  Therefore, a SIP Server (user agent or proxy) which
> receives a DIGEST challenge and response cannot spoof a CHAP challenge
> and response to a RADIUS server.
>
> Does anyone have a solution to this problem?  Perhaps a new
> authentication mechanism (such as CHAP, in addition to BASIC and DIGEST)
> is in order?

Note that in the case of CHAP, a RADIUS server has no way of authenticating
the requestor (other than by source IP address, which isn't very strong). 
Running
such an authentication protocol over something that did provide such 
authentication
might be useful. An alternative would be to look at ways of specifying a 
way to
carry digest authentication in RADIUS; a motivation for doing so might be 
the
desire to use the HMAC construction in HTTP digest rather than the 
construction
in CHAP.

-paul