Subject: RE: [SIP] Mutual Authentication (was: Digest Authentication)

From: [email-masked]
Date: Wed, 25 Oct 2000 11:35:59 +0300

> I think that PGP authentication is great. However I am not aware
> that it simplifies mutual authentication. From my understanding,
> in order to accomplish mutual authentication with PGP, the server
> would need to know the client's public PGP key, and the client
> would need to know the server's PGP key. Having said this, I am
> not aware of a standardized mechanism within SIP to authenicate
> the server to the client using PGP.

Just a thought, I know it's not a documented mechanism for SIP, but how
about using a multipart/signed type in the SIP message body? This way, you
wouldn't use any header fields and especially no nonce or cnonce values. You
would simply sign your message and send it to the server who'd do the same
thing. 

The parties would need to know each other's public keys of course. A server
not implementing this mechanism would simply use the 401 Unauthorized to
revert back to Digest or PGP authentication.

The message hash could be produced the same way as in WWW-Authentication
using PGP, e.g., including the body and some important headers of the
message.

Message flows:

INVITE w/ multipart/signed
-------------------------->

200 OK w/ multipart/signed
<--------------------------

ACK
-------------------------->

BR,
Aki Niemi

_______________________________________________
SIP mailing list
[email-masked]
http://lists.bell-labs.com/mailman/listinfo/sip