Subject: RE: [SIP] VIA header encryption?

From: "Sean Olson (EUS)" <[email-masked]>
Date: Wed, 28 Feb 2001 09:26:35 -0600

> The conversation on this thread has been moving between 
> several different
> via header issues. It was my understanding that via mucking 
> was happening in
> two places:
> 
> 1. P-CSCF removes via, RR before sending an INVITE to a 
> called party, to
> save bits on the air. This requires transaction stateful 
> proxies to restore
> the information in the response. No call-statefulness required.

Call statefulness is required for the BYE. In order for the
P-CSCF to insert the proper Route: in the BYE, it must maintain
call state. This is not the *only* reason the P-CSCF maintains
call state however.

> 
> 2. I-CSCF will encrypt the via headers, and record-routes, to 
> avoid exposing
> the information outside the network.
> 

Correct.

> 
> Please note that via hiding was removed from the spec 
> primarily because of a
> security issue. The element that wanted the encryption needed 
> to ask the
> next hop, possibly in a different domain, to perform it. 

This is not a concern for 3GPP since Via: hiding is not
being requested through signalling.

> Encryption and
> hiding can still be done in a number of ways, none of which require
> standardization. Some of them can be done statelessly.
> 

Exactly. 

> The issue with bandwidth has to do only with the P-CSCF 
> removal of via and
> RR headers.

As well, of course, as the removal of the need for the
UA to insert Route: headers.

> Any hiding mechanism that is transaction stateful will suffer from
> robustness problems, and call stateful mechanisms will be 
> even worse. If
> done statelessly (which is possible), you get the robustness benefits
> stateless proxies can offer. 

Robustness is then left in the hands of the UA. 
I'm not saying that is a bad thing. That is the Internet
model after all. But it is a tradeoff.

> I think loop detection is generally going to suffer. A complex
> implementation might look for a spiraled request, and when it 
> sees one,
> attempt to locate/decrypt the hidden headers to look for a 
> loop. That may or
> may not be possible depending on how the hiding is implemented.

Spiralling between operator's networks is the complex case that
needs to be handled. This definitely needs more investigation.

> -Jonathan R.

/sean

---

From: "Arnoud van Wijk (ELN)" <[email-masked]>
Date: Wed, 28 Feb 2001 17:01:12 +0100

True, 
but sofar I understand now. a SIP message that leaves a P-CSCF will leave its own address in the topmost VIA header.
So, evil hackers can intercept it before the SIP message is received by the proxy of the other network.(before next hop)
(probably by cutting the cable :-)since the mobile operator may hope that the other network does encrypt the VIA header of the SIP message that passes the bordering proxy of that network.

About Portscans, there are enough programs that prevent proxies to respond back to a portscan. That is known as Stealth mode of the ports.

greetz

Arnoud van Wijk

-----Original Message-----
From: Jonathan Rosenberg [mailto:[email-masked]]
Sent: woensdag 28 feb 2001 15:58
To: 'Henning G. Schulzrinne'; Jonathan Rosenberg
Cc: Sean Olson (EUS); Neil Deason; [email-masked]
Subject: RE: [SIP] VIA header encryption?

> -----Original Message-----
> From: Henning G. Schulzrinne [mailto:[email-masked]]
> Sent: Wednesday, February 28, 2001 9:21 AM
> To: Jonathan Rosenberg
> Cc: 'Sean Olson'; Neil Deason; [email-masked]
> Subject: Re: [SIP] VIA header encryption?
> 
> 
> 
> > 
> > I've seen this requirement for hiding from wireline 
> providers as well - not
> > because the number of servers is sensitive information to 
> be hidden from
> > competitors - but because of hackers. The primary issue, in 
> my mind, is
> > allowing outside parties to learn the IP address of servers 
> within the
> > network. Once that happens, lots of tools are at their 
> disposal to attack
> > these machines. Given that phone companies have 
> historically been a favorite
> > attack point for hackers, and given that these attacks are 
> much easier when
> > we are talking voip, I think paranoia is a good thing here.
> 
> These providers should be informed that they are clueless :-) 
> There are
> port scanners around that search millions of IP addresses 
> very quickly,
> automatically and without the hacker lifting a finger. Thus, 
> this offers
> almost no protection, except assuring PHBs that "yes, we're hiding our
> network".

Well, there is a big difference. With the port scans, you find a device, but
don't necessarily know what it does or why you might want to beat it up.
Without via hiding, an attacker can know what the device is (a proxy), what
provider its with, what calls get routed through it, and so on. It makes for
much more selective, focused attacks.

-Jonathan R.

---
Jonathan D. Rosenberg                       72 Eagle Rock Ave.
Chief Scientist                             First Floor
dynamicsoft                                 East Hanover, NJ 07936
[email-masked]                     FAX:   (973) 952-5050
http://www.cs.columbia.edu/~jdrosen         PHONE: (973) 952-5000
http://www.dynamicsoft.com

_______________________________________________
This list is for continuing development of the SIP protocol.
The sip-implementor's list is the place to discuss implementation,
and to receive advice on understanding existing sip.
To subscribe to it, send mail to 
[email-masked] with "subscribe" in the body.