Subject: RE: [SIP] T2 and 182 Queued

From: Jonathan Rosenberg <[email-masked]>
Date: Thu, 1 Feb 2001 04:19:50 -0500

> -----Original Message-----
> From: Michael Thomas [mailto:[email-masked]]
> Sent: Sunday, January 28, 2001 4:18 PM
> To: Henning G. Schulzrinne
> Cc: Michael Thomas; Patrice Calhoun; [email-masked];
> 'Anders Kristensen'; 'David Frascone'; [email-masked]
> Subject: Re: [SIP] T2 and 182 Queued
> 
>  > > Digest is worse than nothing at all (Basic at
>  > > least doesn't cop an attitude that it's anything
>  > > less than inadequate): as currently -- and likely
>  > > forever -- implemented does not provide basic
>  > > security features like replay protection,
>  > 
>  > You keep repeating this, but that still doesn't make it correct.
> 
>    \/\/hatever. Be my guest. Build insecure boxes for
>    specious reasons. Declare the problem intractable
>    and substitute non-scalable fake security instead.
>    Maybe we can have a great big group hug after we
>    properly fawn over the emperor's new cloths.

I suspect I sit somewhere between Henning and Mike in my attitude towards
crypto; I've found myself becoming a strong advocate of TLS for inter-proxy
communication, but I'm still not sure I believe its going to solve the
problems to client to proxy authentication/confidentiality (lack of client
certs being a real problem). There, digest has, for better or for worse,
been used by many vendors. So, from a purely educational standpoint, I'd
like additional clarification on its weaknesses, and why it is "worse than
nothing". As far as I can tell, it does prevent replays (since it uses
nonces which rotate frequently), does not expose plaintext passwords, etc.
It is possible to modify messages in transit to change headers not covered,
I'll give you that. Digest in 2617 does allow for the hash to cover the
body, though, so this helps some. 2617 also does allow for response hashes,
although I have not used it and don't know what problems it has. 

Thanks,
Jonathan R.

---
Jonathan D. Rosenberg                       72 Eagle Rock Ave.
Chief Scientist                             First Floor
dynamicsoft                                 East Hanover, NJ 07936
[email-masked]                     FAX:   (973) 952-5050
http://www.cs.columbia.edu/~jdrosen         PHONE: (973) 952-5000
http://www.dynamicsoft.com

_______________________________________________
This list is for continuing development of the SIP protocol.
The sip-implementer's list is the place to discuss implementation,
and to receive advice on understanding existing sip.
To subscribe to it, send mail to [email-masked] with
"subscribe sip-implementors" in the body.