Subject: Re: [SIP] Receiver-tagged Via Headers and hidden parameter

From: Jonathan Rosenberg <[email-masked]>
Date: Fri, 02 Jun 2000 10:00:54 -0400

Gethin Liddell wrote:
> 
> hi,
> 
> I'm querying the use of the hidden parameter and received parameter in the same via.
> 
> It is the purpose of the hidden parameter to hide the previous hop from subsequent hopes and this
> is done by encrypting the 'sent-by' part of the Via header.
> 
> However, it is possible that the Proxy has added a received parameter to the encrypted via in order
> to reply to the correct machine.  This received parameter provides open knowledge of the previous
> hop's address and compromises the security.

Good observation.

> 
> Now there are two possibilities here (as far as i can see):
> 
> 1) The received parameter should not be added to the hidden via but cached by the proxy in a lookup
>     table whilst it waits for the response. (or the received parameter can be encrypted as well).
> 
> 2) For a received parameter to be inserted, then the message has probably come through a NAT or firewall.
>     this is sufficent enough for security matters and aslong as the original host is encrypted within the via
>    i.e. the sent-by remains encrypted, all is OK.

There is another possibility, which seems the best choice:

3) Both the sent-by and received parameter are encrypted and placed in
to the Via header.

I don't like (1), since you lose the property of being able to run
statelessly. 

-Jonathan R.
-- 
Jonathan D. Rosenberg                       72 Eagle Rock Ave.
Chief Scientist                             First Floor
dynamicsoft                                 East Hanover, NJ 07936
[email-masked]                     FAX:   (973) 952-5050
http://www.cs.columbia.edu/~jdrosen         PHONE: (732) 741-7244
http://www.dynamicsoft.com

_______________________________________________
SIP mailing list
[email-masked]
http://lists.bell-labs.com/mailman/listinfo/sip

---

From: Gethin Liddell <[email-masked]>
Date: Fri, 2 Jun 2000 15:10:54 +0100

> 3) Both the sent-by and received parameter are encrypted and placed in

actually that's what i meant in the brackets for (1)  :)

-- 
Gethin Liddell
Ubiquity Software Corporation

http://www.ubiquity.net
mailto:[email-masked]