Subject: RE: [SIP] New draft on SIP registration

From: [email-masked]
Date: Fri, 6 Oct 2000 18:54:21 +0300

Hi,

There seems to be a discrepancy between the SIP registration draft and SIP
RFC (draft-ietf-sip-rfc2543bis-02.pdf)

draft-schulzrinne-sip-register-00.txt says that:

"The Authentication-Info header field contains a response digest, but it
only protects the response entity body, not header fields."

But, draft-ietf-sip-rfc2543bis-02.pdf says in chapter 14.3.:

"The Authentication-Info and Proxy-Authentication-Info fields are not used
in SIP"

So basically Digest as an authentication scheme works even worse with SIP
than it does with HTTP? And if I truly want security in my REGISTER, I need
to have PGP or send my requests over secure sockets?

BR,
Aki

> -----Original Message-----
> From: EXT Henning Schulzrinne [mailto:[email-masked]]
> Sent: 06. October 2000 18:03
> To: [email-masked]
> Subject: [SIP] New draft on SIP registration
> 
> 
> I've written a quick draft on some of the issues related to how to do
> SIP registration when "visiting" networks. I would appreciate 
> feedback.
> The draft does not propose new SIP extensions, except for a possible
> Digest parameter to increase registration security.
> 
> The draft is
> http://www.ietf.org/internet-drafts/draft-schulzrinne-sip-regi
> ster-00.txt
> -- 
> Henning Schulzrinne   http://www.cs.columbia.edu/~hgs
> 
> _______________________________________________
> SIP mailing list
> [email-masked]
> http://lists.bell-labs.com/mailman/listinfo/sip
> 

_______________________________________________
SIP mailing list
[email-masked]
http://lists.bell-labs.com/mailman/listinfo/sip

---

From: Henning Schulzrinne <[email-masked]>
Date: Fri, 06 Oct 2000 12:21:20 -0400

> to have PGP or send my requests over secure sockets?

You could translate my remark as: 

- We may want to allow Authentication-Info since it at least protects
the integrity of responses, e.g., the retrieval of scripts. (This wasn't
really designed when RFC 2543 came around.)

- We need an additional mechanism to protect at least some parts of the
header via Digest. PGP is an option, but Digest is widely implemented
even in small SIP phones (all the ones I have in my office seem to use
it...), but nobody implements PGP, partially because setting up PGP
secrets and storing them on a small device is somewhat painful. Secure
sockets (TLS or IPsec) don't help since in the situations where breaches
are likely to occur, you don't have an end-to-end IP or TCP connection.