Subject: Re: [sipcore] Comments on draft-ietf-sipcore-sip-authn-02

From: Yehoshua Gev <[email-masked]>
Date: Wed, 1 Aug 2018 12:23:16 +0300

Hi Rifaat,

Another question about section 3.
RFC 3261 separates between "User-to-User Authentication" (section 2.2),
which uses the Authorization header, and "Proxy-to-User Authentication"
(section 2.3), which uses the Proxy-Authorization header.
As you wrote, the draft is mostly intended for Proxy-to-User, so maybe the
Proxy-Authorization header should be used.

In any case, I think that the following security consideration should be
added:
For HTTP, the request is passed without intermediates, so as long as the
transport is secured (HTTPS) the access token is not exposed by the
protocol to other parties.
For SIP, proxies are used, so unless the token is authenticated by the
nearest proxy, there is no way to avoid exposure the token to the proxies
along the way.
Additionally, if the token is authenticated by a proxy, the proxy MUST
remove the Authorization header when forwarding the request, to avoid
exposure of the token.

Regarding error conditions, I think that SIP should follow the behavior of
HTTP, and return 401 with WWW-Authenticate (or Proxy-Authenticate) header
as described in RFC 6750 section 3.

Some additional nits:
- Section 4: s/authorization header/Authorization header field/
- Section 4: Indicate that the syntax is given in ABNF (at least for me
it's useful, so I can search the document for "ABNF" and find the syntax
:-) ).
- Section 8.2: [RFC474bis] -> [RFC8224]

Regards,
Yehoshua

---

From: Rifaat Shekh-Yusef <[email-masked]>
Date: Thu, 2 Aug 2018 14:36:32 -0400

Thanks Yehoshua,

Please, see my reply inline...

Regards,
 Rifaat

> Proxy-Authorization header should be used.

Here is a quote from RFC3261:

21.4.2 <https://tools.ietf.org/html/rfc3261#section-21.4.2> 401 Unauthorized

   The request requires user authentication.  This response is issued by

   UASs and registrars, while 407 (Proxy Authentication Required) is

   used by proxy servers.

Since so far the draft was mainly talking about the registration part, I
think the use of Authorization header is correct.

> remove the Authorization header when forwarding the request, to avoid

The document is intentionally silent on this issue, because it is out of
scope for this document.
But I agree that the security section must be enhanced to clearly state
that TLS must be used to protect the authz code and tokens.

> - Section 8.2: [RFC474bis] -> [RFC8224]
Thanks,
 Rifaat