Subject: [stir] SIP PASSporT and Registrations

From: "Brian C. Wiles" <[email-masked]>
Date: Wed, 31 May 2017 13:24:43 -0500

Hi, Jon and Chris, 

 I have been searching for a way to use JSON
Web Tokens in SIP, and it looks like PASSporT is close to what I need.
However, I see a couple of issues that would need to be addressed in
order for me to be able to use it. I was hoping we could get some
changes before it becomes a final RFC because I think they are big
issues for some uses of SIP, but it sounds like I'm a bit too late. 

The main issue is that PASSporT is only designed for INVITEs. There is
no method for handling REGISTER events in the context of a PASSporT. For
example, I have clients that need to authenticate with a SIP gateway to
receive calls, and I'm trying to use JWT tokens so that my SIP gateway
doesn't have to contact an external database or web service to verify
the credentials. 

 The other issue is that I don't want to have to
specify the destination in my PASSporT token. I realize there are some
security implications there, but using expirations via the "exp" claim
and other methods, I can protect against replay attacks, etc. My
architecture has its own security protocols to prevent unauthorized use,
and I don't really care how many calls are made since they are only to
other clients who have registered. 

 My current implementation is close
to PASSporT but using the Authorization header like most other JWT
implementations use. I'm fine with using PASSporT if we can at least
make the "dest" claim optional and specify that it can be used with
REGISTERs as well. Let me know what you think. I'd like to get something
drafted soon before I publish my open source module. Thanks. 

-Brian

---

From: Chris Wendt <[email-masked]>
Date: Thu, 1 Jun 2017 00:15:52 -0400

Hi Brian,

What you are really looking for is not Passport but specifically an authentication mechanism.  Passport is not for authentication and is very specific to proving an originator to a destination party.  Thus the explicit dependency on orig and dest as claims in the JWT.

There was some recent work on using OAuth 2.0 with SIP, and as you say there is other authentication mechanisms exist outside of SIP both using JWT and not.  But unfortunately, Passport is not going to be the right answer for REGISTER.

-Chris

> On May 31, 2017, at 2:24 PM, Brian C. Wiles <[email-masked]> wrote:
> 
> Hi, Jon and Chris,
> 
> 
>   I have been searching for a way to use JSON Web Tokens in SIP, and it looks like PASSporT is close to what I need.  However, I see a couple of issues that would need to be addressed in order for me to be able to use it.  I was hoping we could get some changes before it becomes a final RFC because I think they are big issues for some uses of SIP, but it sounds like I'm a bit too late.
> 
>  
>   The main issue is that PASSporT is only designed for INVITEs.  There is no method for handling REGISTER events in the context of a PASSporT.  For example, I have clients that need to authenticate with a SIP gateway to receive calls, and I'm trying to use JWT tokens so that my SIP gateway doesn't have to contact an external database or web service to verify the credentials.
> 
>  
>   The other issue is that I don't want to have to specify the destination in my PASSporT token.  I realize there are some security implications there, but using expirations via the "exp" claim and other methods, I can protect against replay attacks, etc.  My architecture has its own security protocols to prevent unauthorized use, and I don't really care how many calls are made since they are only to other clients who have registered.
> 
>  
>   My current implementation is close to PASSporT but using the Authorization header like most other JWT implementations use.  I'm fine with using PASSporT if we can at least make the "dest" claim optional and specify that it can be used with REGISTERs as well.  Let me know what you think.  I'd like to get something drafted soon before I publish my open source module.  Thanks.
> 
>  
> -Brian
> 
>