Subject: [SIP] Proxy Authentication sequence

From: [email-masked]
Date: Tue, 2 Jan 2001 15:52:56 +0530

Hi
     I have a doubt regarding the authentication challenge-response
sequence. Consider the following call-flow:
     A proxy rejects an INVITE with a "407 Proxy Authentication Required"
response containing a challenge. The client acknowledges the response. Now
when the client sends an INVITE with the response to the challenge, does it
necessarily have to be a new call ?  The call-flows draft shows a new
call-id being used in the next INVITE. However, is it correct if the client
uses an incremented CSeq number with the same call-id in the new INVTE
containing the response to the challenge ?

-Binu

_______________________________________________
SIP mailing list
[email-masked]
http://lists.bell-labs.com/mailman/listinfo/sip

---

From: [email-masked]
Date: Tue, 2 Jan 2001 14:43:28 +0200

> containing the response to the challenge ?

Incrementing CSeq is not only correct behaviour, but also required
behaviour. According to RFC2543, a UAC resubmitting a request with its
credentials after a 401/407 MUST increment the CSeq. This way the requests
stay in the same call-leg, and servers can have per request challenges,
which e.g. time out after a while.

Resubmitted requests after 401/407 with a new call-id will result in servers
endlessly sending "fresh" credentials to the client.

Cheers,
Aki

---

From: Jonathan Rosenberg <[email-masked]>
Date: Thu, 4 Jan 2001 02:06:55 -0500

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]
> Sent: Tuesday, January 02, 2001 7:43 AM
> To: [email-masked]
> Cc: [email-masked]
> Subject: RE: [SIP] Proxy Authentication sequence
> 
> 
> 
> > Hi

That would only happen when you tie the value of the nonce to the Call-ID.
Probably not a good idea. Although the spec does say you have to use the
same call-id and increment the CSeq, the stateless nature of the
authentication mechanism (and the ability to cache credentials), means that
it is possible to send credentials in a brand new request. Servers should
not be rejecting these right away. Rather, nonce values should be strictly
based on time.

-Jonathan R.

---
Jonathan D. Rosenberg                       72 Eagle Rock Ave.
Chief Scientist                             First Floor
dynamicsoft                                 East Hanover, NJ 07936
[email-masked]                     FAX:   (973) 952-5050
http://www.cs.columbia.edu/~jdrosen         PHONE: (973) 952-5000
http://www.dynamicsoft.com