Subject: [SIP] possibly unintended recommendation for "tag" in 6.25 of the spec

From: "Piotr S. Kossowski" <[email-masked]>
Date: Thu, 26 Oct 2000 22:03:23 +0200

Hello,

During my studies on RFC2543bis-02, I've noticed following phrase:

section 6.25:

" The “tag” value MUST be globally unique and cryptographically random 
with at least 32 bits of randomness. A single user agent maintains the
same tag at least within the same Call-ID, but it is RECOMMENDED to 
maintain the same tag across calls and instances of the UA application 
to allow restarting of a user agent. "

On the one hand, we want tag to be globally unique to provide
matching in case of forking, on the other, this RECOMMENDATION would
damage to this tag-mechanism, in my opinion. Why ? As the spec. says,
instances of UA should (in recommendation meaning) have the same
tag. Let's assume that there are only ten "equal" vendors of SIP-UAs in
the world. Eeach of them compiled its UA with cryptographically random
tag. According to probability principles, 10% of UAs instances in the
world WILL HAVE THE SAME TAG. It is probably NOT what we had on our mind.

But, don't argue about numbers.
I suppose, that author of this recommendation had on his mind
instances in meaning pair: {1.ran executable code 2.host, on which
this instance was run}, not {ran executable code} (common meaning).

If yes, Such cryptographically random tag would not be fixed in
the executable code, but could be computed on the base of
data unique for the host instance e.g. hard disk capacity, its volume
name, OS id, IP address etc.

If It's what was wanted to be said in 6.25, please for acceptation
of my inerpretation.

To be honest, I would clarify a bit section 6.25 to avoid such
emails in the future... :-)

Thanks,
Piotr

_______________________________________________
SIP mailing list
[email-masked]
http://lists.bell-labs.com/mailman/listinfo/sip

---

From: Billy Biggs <[email-masked]>
Date: Sun, 29 Oct 2000 23:17:01 -0600

Piotr S. Kossowski:

> "The "tag" value MUST be globally unique and cryptographically random
> to allow restarting of a user agent."

  Ouch.  I would highly recommend removing the recommendation from the
bis draft, since it breaks when you call yourself.  Also, changing the
local tag when following a redirect is a useful way of protecting
against UAs which don't add tags.

  Also, as Piotr noted, I would be really scared that UAs would be more
likely to choose the same tag if it was recommended that they try and
preserve them across restarts.

-- 
Billy Biggs, 3Com               Email: [email-masked]
http://www.div8.net/billy/      Phone: [email-masked]