Subject: [SIP] Receiver-tagged Via Headers and hidden parameter

From: Gethin Liddell <[email-masked]>
Date: Tue, 30 May 2000 13:34:06 +0100

hi,

I'm querying the use of the hidden parameter and received parameter in the same via.

It is the purpose of the hidden parameter to hide the previous hop from subsequent hopes and this 
is done by encrypting the 'sent-by' part of the Via header.

However, it is possible that the Proxy has added a received parameter to the encrypted via in order
to reply to the correct machine.  This received parameter provides open knowledge of the previous 
hop's address and compromises the security.

Now there are two possibilities here (as far as i can see):

1) The received parameter should not be added to the hidden via but cached by the proxy in a lookup
    table whilst it waits for the response. (or the received parameter can be encrypted as well).

2) For a received parameter to be inserted, then the message has probably come through a NAT or firewall.
    this is sufficent enough for security matters and aslong as the original host is encrypted within the via
   i.e. the sent-by remains encrypted, all is OK.

any thoughts?

-- 
Gethin Liddell
Ubiquity Software Corporation

http://www.ubiquity.net
mailto:[email-masked]

_______________________________________________
SIP mailing list
[email-masked]
http://lists.bell-labs.com/mailman/listinfo/sip