Subject: Re: [Sip-security] Proxy authentication in incoming INVITEs?

From: "Sanjoy Sen" <[email-masked]>
Date: Mon, 22 Oct 2001 16:05:35 -0500

Dean,

   I like the option of using extended Remote-party-id header for
transfering the credential. How about the option of using the Cookie header
for the same purpose? 

Sanjoy

======================

To: "Jari Arkko" <[email-masked]> 
Subject: Re: [Sip-security] Proxy authentication in incoming INVITEs? 
From: "Dean Willis" <[email-masked]> 
Date: Fri, 19 Oct 2001 11:10:07 -0500 
Cc: "Pekka Pessi" <[email-masked]>, "James Undery"
<[email-masked]>, <[email-masked]> 
List-Id: Security Issues for the SIP protocol <sip-security.ietf.org> 
References: <[email-masked]>
<[email-masked]>
<005701c158b0$71c24510$7d7075d5@flak> <[email-masked]> 
Sender: [email-masked] 

----------------------------------------------------------------------------
----

Ah, Perhaps I was being dense. I've just reread the entire thread.

Perhaps further analysis of the requirement would help.

Do we wish to authenticate the identity of the system that is acting as a
UAS, or authenticate the identity of the human operating that system? What
is the persistency of the relationship between the proxy and the UAS? Will
the UAS need to know how to authenticate to many proxies? What level of
security is required? Do we need to protect against playback, or does the
call signature (to:, From:, Call-ID) provide sufficient uniqueness on its
own?

Several possible candidates might include

TLS (already discussed, just issue a client cert signed by a CAS trusted by
the proxy)
IPSEC (key management base problem for IKE)
HIP
SSH
Kerberos (it has to be said)
Use of remote-party-ID extended with some sort of cryptographic signature of
the response
-- shared secret key
-- PGP
-- PKI cert
--  kerberos key exchange

Personally, I'm leaning toward the latter. This would have interesting
interaction with the goals of the DCS Privacy draft.

--
Dean

----- Original Message -----
From: "Jari Arkko" <[email-masked]>
To: "Dean Willis" <[email-masked]>
Cc: "Pekka Pessi" <[email-masked]>; "James Undery"
<[email-masked]>; <[email-masked]>
Sent: Friday, October 19, 2001 10:24 AM
Subject: Re: [Sip-security] Proxy authentication in incoming INVITEs?

> Dean Willis wrote:
>
> > SIP Proxies authenticate clients
> > making use of those proxies.
>
> Yes... and this has to be interpreted very literally.
> If you have a local proxy and a user agent, you can
> authenticate half of what the user agent does, namely
> the user agent client part, but not the user agent
> server part.
>
> > If you want UAs to be able to authenticate every proxy that has
processed a
> > message, you'll need to do something like using a PKI to have each proxy
> > sign the message and attach a signed copy of the message to the body of
the
> > outgoing message. Checking the authentications requires processing the
> > signature chain in reverse order. It's pretty seriously tedious, and
> > consumes vast amounts of signaling bandwidth, not to mention CPU.
>
> I don't think anyone is proposing authenticating every proxy.
> Just the whole user agent to the local proxy.
>
> >Of course, one could implement TLS with bidirectional certification. That
> >would essentisally authenticate edge proxies.
>
> This would work, if you can pay for it... seems a bit strange
> that one has to upgrade to PKIs, TCP, public key cryptography,
> etc. because an otherwise suitable scheme only works in one
> direction.
>
> But I do appreciate the problems outlined in 19.4. Are
> there any other possible solutions than TLS?
>
> Jari
>
> _______________________________________________
> Sip-security mailing list
> [email-masked]
> http://www1.ietf.org/mailman/listinfo/sip-security
>
>

_______________________________________________
Sip-security mailing list
[email-masked]
http://www1.ietf.org/mailman/listinfo/sip-security

---

From: "Dean Willis" <[email-masked]>
Date: Mon, 22 Oct 2001 16:11:44 -0500

Re: [Sip-security] Proxy authentication in incoming INVITEs?
That might work, but it would take some thinking. One of the issues is that the credential set needs to include something like a a serial number or a hash of the message it is in, or it is subject to replay attacks. The cookie draft is mostly intended to force "replays" of certain information, so this could be problematic for use in credential transfer.

I suppose one could have something like an "adaptive cookie" that is modified by the UA, but this is sort of antithetical to the original cookie concept.

--
Dean
  ----- Original Message ----- 
  From: Sanjoy Sen 
  To: [email-masked]' ; [email-masked]' 
  Sent: Monday, October 22, 2001 4:05 PM
  Subject: Re: [Sip-security] Proxy authentication in incoming INVITEs?

  Dean, 

     I like the option of using extended Remote-party-id header for transfering the credential. How about the option of using the Cookie header for the same purpose? 

  Sanjoy 

  ====================== 

  To: "Jari Arkko" <[email-masked]> 
  Subject: Re: [Sip-security] Proxy authentication in incoming INVITEs? 
  From: "Dean Willis" <[email-masked]> 
  Date: Fri, 19 Oct 2001 11:10:07 -0500 
  Cc: "Pekka Pessi" <[email-masked]>, "James Undery" <[email-masked]>, <[email-masked]> 
  List-Id: Security Issues for the SIP protocol <sip-security.ietf.org> 
  References: <[email-masked]> <[email-masked]> <005701c158b0$71c24510$7d7075d5@flak> <[email-masked]> 

  -------------------------------------------------------------------------------- 

  -- 
  Dean 

  ----- Original Message ----- 
  From: "Jari Arkko" <[email-masked]> 
  To: "Dean Willis" <[email-masked]> 
  Cc: "Pekka Pessi" <[email-masked]>; "James Undery" 
  <[email-masked]>; <[email-masked]> 
  Sent: Friday, October 19, 2001 10:24 AM 
  Subject: Re: [Sip-security] Proxy authentication in incoming INVITEs? 

  processed a 
  the