Subject: [SIP] Authorization in the ACK

From: A Srinath <[email-masked]>
Date: Fri, 14 Jul 2000 12:02:09 +0530 (IST)

Hi,
	Consider the following scenario

	User Agent A             User Agent B

                      INVITE 
                     ---------------->

                      401 Unauthorized
                     <----------------

                      ACK
                      --------------->

                      INVITE with
                      Authorization
                      ---------------->

                      200 OK
                      <---------------

                      ACK
                      ---------------->
                              .
                              .
                              .
                      Media Flow Started
                              .
                              .
                              .
                      BYE
                      ----------------->

                      200 OK
                      <----------------

The following questions arise. 

	1. Does User Agent A provide authentication in the first ACK. 
        2. Does the User Agent A provide authentication in the second
           ACK, BYE, and any other requests that it makes in between. 
           if so what 'nonce' does it use. 
           This is a problem in the case of ACK as we cannot respond with 
           a 401 unauthorized to an ACK. In all other cases this can be
           done and a new 'nonce' given. If the ACK uses the 'nonce' of
           the previous INVITE then chance of replay attack is present. 

Please comment on this. 

regards,

 Srinath A
 Silicon Automation Systems       Phone: 5276100, 5276108 extn 4220
 #1309, 10th Main, HAL III Stage   
 Bangalore 560 008, India                    

_______________________________________________
SIP mailing list
[email-masked]
http://lists.bell-labs.com/mailman/listinfo/sip

---

From: Jonathan Rosenberg <[email-masked]>
Date: Fri, 14 Jul 2000 02:53:25 -0400

>         User Agent A             User Agent B

No.

>            ACK, BYE, and any other requests that it makes in between.

Yes.

>            if so what 'nonce' does it use.

The one it received in the original 401. If its not acceptable anymore,
the request is rejected with an updated nonce.

>            the previous INVITE then chance of replay attack is present.

This is a good point.

In this case, I would say that a UAS has to accept ACKs (and ONLY ACKs)
with stale nonces. This does enable replays of old ACK. But, so what?
ACK is only useful to acknowledge an INVITE with a specific call-ID, To,
From, CSeq. Since the Call-ID is chosen randomly, a UAC will never
generate another INVITE with these same parameters. This means that the
stale ACK can never be used to do anything useful anyway. 

-Jonathan R.

-- 
Jonathan D. Rosenberg                       72 Eagle Rock Ave.
Chief Scientist                             First Floor
dynamicsoft                                 East Hanover, NJ 07936
[email-masked]                     FAX:   (973) 952-5050
http://www.cs.columbia.edu/~jdrosen         PHONE: (732) 741-7244
http://www.dynamicsoft.com