Subject: Re: [SIP] Registration Authentication

From: Carmelo Zaccone <[email-masked]>
Date: Thu, 03 May 2001 23:31:39 +0200

Hello everybody,

	I followed your discussion on how to protect the
	registration information and I do not totally agree
	with all that was mentioned.

	On the one hand, I agree that the digest auth. scheme
	as it is currently defined, is not protecting enough 
	information!
	As you all know even then auth-int alternative do
	not protect any of the header fields at all.
	Ok, it enable us to protect the registration body
	such as cpl script for example but like James mentioned
	it do not protect the contact we register.
	
	If you remember, I already proposed, a few weeks ago,
	a very simple extension to the digest auth-int alternative
	such as to mimic the pgp protection scheme as proposed
	so far.
	With this extension we enable, the sip security framework
	to provide integrity to sip message sensible parts (set of 
	headers and message body). Unfortunately, I did not receive
	any feedback after Jonathan Lenox proposed me to move the 
	thread to the main sip list...

	I also agree with you Jonathan concerning the need of a set
	of other security mechanisms based on private/public keys.
	And I do believe that sip security framework's future will be
	mainly focused on public/private keys framework.
	nb: What Henning also suggested with the SSL channel is 
	again going into the direction of a keys oriented security
	framework.

	However, I do not agree on the idea to depreciate the use
	of PGP. I think that the security feature that PGP offers us 
	are already of a good interest regarding the path to a strong
	key based security framework.
	Just to add some words on the 'man in the middle' scenario 
	discussed in this thread, PGP enables you to completely prevent
	this from happening as it is impossible to reproduce a valid
	signature if you do not have access to the private key of the
	signer. Note that replay attack are also prevented as the digital 
	signature check will fail as soon as a character in the set of 
	protected data is modified. The only thing that a hacker might do,
	if he wants the signature check to succeed, is to resend the same
	protected data in his new message. 

	(Finally, PGP is very easy and fast to to implements and it also 
	provide us with encryption opportunity, so I believe that thinking
	to forget about PGP is not a good idea)
	
	This problem of 'strong' security aspect such as authentication,
	data integrity and even data encryption are not only bind to 
	register, subscribe messages for example are also concerned 
	by this thread.

		Carmelo

-- 
...........................................................
  Indigo                         Carmelo Zaccone             
    Software                       Head Software Engineer  
                                                           
  Indigo Software Group, Inc.                              
        505 Montgomery Street               50 rue Wiertz         
      San Francisco, CA 94111              Brussels, 1050        
                          USA                     Belgium               
                                                            
      Phone: 1 (415) 887-3511      Phone : +32 2 230 3594  
      Fax  : 1 (415) 887-3001      Direct: +32 2 235 0955  
                                   Fax   : +32 2 280 2676  
...........................................................