Subject: RE: [SIP] Authorization Header and content question

From: Itamar Gilad <[email-masked]>
Date: Wed, 17 Jan 2001 19:44:39 +0200

> -----Original Message-----
> From: Bob Bell [mailto:[email-masked]]
> Sent: Wed, January 17, 2001 7:17 PM
> To: [email-masked]
> Subject: [SIP] Authorization Header and content question
> 

...
> 
> Third, in the informational draft entitled 
> "draft-ietf-sip-call-flows-02.txt", section 2.1.x, there are several 
> examples of messages containing Authorization headers. Each 
> Authorization 
> header is the last header in the message. Yet in 
> rfc2543bis-02, in section 
> 14.1.2, the calculation of the signature is said to include 
> all headers 
> following the Authorization header and that "Receivers of signed SIP 
> messages SHOULD discard any end-to-end header fields above the 
> Authorization header, as they may have been maliciously added 
> en route by a 
> proxy." This would lead one to believe that all information 
> contained in 
> the REGISTER messages SHOULD be discarded. In studying the procedures 
> outlined, I presume that the proper placement for the 
> Authorization header 
> is immediately following the Via header. Since the Via header 
> is properly 
> modified en route, its contents cannot be protected with a 
> signature from 
> the originating endpoint. All other end-to-end fields should 
> however follow 
> the Authorization header so as to be included in the 
> signature and thus 
> protected. Is my assumption correct?

I think you're confusing Digest authentication with more elaborate schemes.
The rules you refer to don't apply to digest auth and most of the traces in
the call flows draft actually use digest auth.

  Itamar

> Thanks for your help and consideration ---- Bob Bell
> 
> Bob Bell
> Cisco Systems Inc.
> 801-294-3034(v)
> 801-294-3023(f)
> 
> 
> _______________________________________________
> This list is for continuing development of the SIP protocol.
> The sip-implementer's list is the place to discuss implementation,
> and to receive advice on understanding existing sip.
> To subscribe to it, send mail to [email-masked] with
> "subscribe sip-implementors" in the body.
> 

_______________________________________________
This list is for continuing development of the SIP protocol.
The sip-implementer's list is the place to discuss implementation,
and to receive advice on understanding existing sip.
To subscribe to it, send mail to [email-masked] with
"subscribe sip-implementors" in the body.

---

From: Bob Bell <[email-masked]>
Date: Wed, 17 Jan 2001 10:53:00 -0700

Itamar -

I appreciate your quick response. I saw that the call flows used the digest 
method and I was trying to generalize the approach to include the PGP 
method so your observation relative to the digest method is well taken. 
However, in the case of the PGP method, shouldn't the Authorization header 
follow the Via header for the reasons I outlined?

Bob

Bob Bell
Cisco Systems Inc.
801-294-3034(v)
801-294-3023(f)