Subject: [SIP] Re: Why do we need another header? Re: How to put a Kerberos ticket in SIP messages?

From: S_S_Dinesh/India/[email-masked]
Date: Mon, 8 May 2000 14:10:06 +0530

Before jumping into the syntax issues, I'd like to understand exactly
whats going on here. Integration of Kerberos with SIP is a fairly big
topic. There has been some discussion of this for establishing security
associations between clients and local proxies as an alternative to IKE.
You are proposing a different use yet, where it seems a redirect server
is acting as a KDC, handing out tickets in SIP redirects. Lots of issues
here, syntax is the least interesting one, IMHO. How is the client
authenticating itself to the redirect/KDC in the first place? Does a
client cache tickets and try to use them later when connecting to a
server it was redirected to previously? What if the server thats
redirected to, with a ticket, is yet another redirect server?

I'm not saying I don't like this idea (in fact, I think its a very
interesting one indeed), but I'd rather discuss higher level issues
first. Actually, I'd love to see an I-D first to give a context for the
discussion.

-Jonathan R.

Bryan Byerly wrote:
>
> So I expect a few people to come back and ask why not reuse an existing
> header.
>
> I'm trying to achieve a flow where a SIP proxy hands back a Kerberos
> ticket to a client.  The client, in turn can use this ticket for
> authorization to receive a service.  (Yes, alternatively the client could
> go get his own ticket (if he knew the IP address of the KDC and was an
> authorized Kerberos client), and this follows along with moving
complexity
> out to the endpoints.  However, I'm trying to initially simplify things
> for dumber, less complex SIP clients.  (and yes, I agree that SIP clients
> could eventually go get their own tickets)).
>
> Let's go through the list of existing headers and why we can't use them:
>
> 401 WWW-Authenticate: header and Authorization: header
> Using 401's WWW-Authenticate: header and the Authorization: header are
> used for end-to-end authorization.  So, using WWW-Authenticate is not
> appropriate for passing back a Kerberos ticket.
>
> 407's Proxy-Authenticate: header and Proxy-Authorization: header
> Using 407's Proxy-Authenticate: header and the Proxy-Authorization:
header
> are used to authorize a SIP client to transit through a SIP proxy.
> Proxy-Authorization: is specified by a SIP client to provide credentials
> such that he will be authorized by the SIP proxy.  So, I don't think its
> appropriate to overload Proxy-Authorization: to mean "here's an
> authorization that the SIP proxy is passing to the SIP client".
>
> Response-Key:
> This header is used by a client to specify a key which it requests the
> called user agent should use to encrypt a response.  So, its not
> appropriate to use this header to pass a ticket.
>
> Thanks again for your help and suggestions!
>
> Bryan
>
> Bryan J. Byerly
> [email-masked]
>
> Bryan Byerly wrote:
>
> > Hi guys,
> >
> > I'm trying to understand how best to place a Kerberos (v5) ticket in
> > SIP messages (i.e. either in SIP request or SIP response).
> > (If someone already has such as draft, please forward me a copy.)
> >
> > I can think of two possible approaches:
> > 1) Put it in a SIP header:
> > 2) Put it in the SDP
> > other ideas?
> >
> > 1) Thoughts on putting it in a header
> > So, a Kerberos ticket is ASN.1 DER encoded.  Is there any reason we
> > couldn't just stick the binary representation of the ASN.1 DER encoded
> > object in a header?
> > Something like:
> > ticket=fj7d543ghklc8654f7...
> > (Yes, you're right, that's not a real ticket).
> >
> > So, I'm leaning towards a more generic header name like:
> > Service-Authorization=[service name], [authorization-type],
> > encoding=[encoding-type], ticket={octet string}
> > authorization-type=kerberos5
> > encoding=octet-string
> >
> > b) Thoughts on putting it in the SDP
> >
> > Since a Kerberos ticket is ASN.1 DER encoded, it occurs to me that we'd
> > need a email-safe version of the Kerberos ticket if we were to place it
> > in the SDP.
> >
> > Can anyone point me to an existing draft/rfc which converts a Kerberos
> > key to an email-safe version.  I guess a draft on converting an
> > arbitrary octet-string to an email-safe version would be fine too.
> >
> > P.S.
> > For fun, who has a suggestion for which SDP abbreviation should be used
> > for a Kerberos ticket?  (It appears all the obvious ones are taken).
> > taken: a, b, c, e, i, k, m, o, p, r, s, t, u, v, z
> > remaining: f, g, h, j, l, n, q, w, x, y     (Please correct me if some
> > of these is already taken).
> >
> > Thanks for your help!
> >
> > Bryan
> >
> > Bryan J. Byerly
> > [email-masked]

--
Jonathan D. Rosenberg                       200 Executive Drive
Chief Scientist                             Suite 120
dynamicsoft                                 West Orange, NJ 07052
[email-masked]                     FAX:   (732) 741-4778
http://www.cs.columbia.edu/~jdrosen         PHONE: (732) 741-7244
http://www.dynamicsoft.com

_______________________________________________
SIP mailing list
[email-masked]
http://lists.bell-labs.com/mailman/listinfo/sip