Subject: RE: [Sip] Possible interop issues due to BNF of digest auth

From: Jonathan Rosenberg <[email-masked]>
Date: Wed, 28 Nov 2001 00:51:05 -0500

Well, the right place for this is really rfc2617, not bis. I hope bis is
clear about when single instances of parameters are needed for the headers
it defines.

-Jonathan R.

---
Jonathan D. Rosenberg, Ph.D.                72 Eagle Rock Ave.
Chief Scientist                             First Floor
dynamicsoft                                 East Hanover, NJ 07936
[email-masked]                     FAX:   (973) 952-5050
http://www.jdrosen.net                      PHONE: (973) 952-5000
http://www.dynamicsoft.com

> -----Original Message-----
> From: Itamar Gilad [mailto:[email-masked]]
> Sent: Sunday, October 28, 2001 9:50 AM
> To: 'Jonathan Rosenberg'; Itamar Gilad; 'SIP list'
> Subject: RE: [Sip] Possible interop issues due to BNF of digest auth
> 
> 
> Thanks for the response.  Shouldn't we have this documented 
> in the spec just
> to avoid confusion?  
> 
> > -----Original Message-----
> > From: Jonathan Rosenberg [mailto:[email-masked]]
> > Sent: Sun, October 21, 2001 11:59 PM
> > To: 'Itamar Gilad'; 'SIP list'
> > Subject: RE: [Sip] Possible interop issues due to BNF of digest auth
> > 
> > 
> > 
> > 
> > 
> > 
> > > -----Original Message-----
> > > From: Itamar Gilad [mailto:[email-masked]]
> > > Sent: Thursday, October 18, 2001 12:40 PM
> > > To: 'SIP list'
> > > Subject: [Sip] Possible interop issues due to BNF of digest auth
> > > 
> > > 
> > > SIP borrows the definitions of authentication headers from 
> > > RFC 2616 and RFC
> > > 2617
> > > 
> > > RFC 2616 14.47:
> > >        WWW-Authenticate  = "WWW-Authenticate" ":" 1#challenge
> > > 
> > > RFC 2616 14.33:
> > >        Proxy-Authenticate  = "Proxy-Authenticate" ":" 1#challenge
> > > 
> > > From RFC 2617 3.2.1 as follows:
> > > 
> > >       challenge        =  "Digest" digest-challenge
> > > 
> > >       digest-challenge  = 1#( realm | [ domain ] | nonce |
> > >                           [ opaque ] |[ stale ] | [ algorithm ] |
> > >                           [ qop-options ] | [auth-param] )
> > > 
> > > This means that there's a great deal of freedom in the way 
> > > WWW-Authenticate
> > > and Proxy-Authenticate headers are constructed which may 
> > lead to major
> > > interop issues. We've seen some of this in the last SipIt.  
> > > For example the
> > > header below is valid:
> > > 
> > > WWW-Authenticate: Digest realm="realm1", realm="realm2",
> > >   nonce="aaaaaEF1ZyAxNCAxNTowNjoxNyBCU1QgMjAwMVtCQDZkMzJjNAaa", 
> > >   nonce="rrrrrEF1ZyAxNCAxNTowNjoxNyBCU1QgMjAwMVtCQDZkMzJjNAaa", 
> > >   opaque="bbbbbbFiYTAwMzgzYTY4MA==", stale=false, 
> > >   algorithm=md5, algorithm=sha1, qop="auth, auth-int",
> > >   Digest realm="realm3", realm="realm4",   
> > >   nonce="aaaaaEF1ZyAxNCAxNTowNjoxNyBCU1QgMjAwMVtCQDZkMzJjNAaa", 
> > >   opaque="ttttttFiYTAwMzgzYTY4MA==", stale=false, 
> > > algorithm=sha1, qop="auth,
> > > auth-int"
> > 
> > No, this is not valid. It passes the grammar, but grammars 
> > are ill suited at
> > expressing more complex constraints. In this case, the 
> > grammar does not
> > specify that duplicates of certain parameters are not 
> > allowed. However, I
> > think it is reasonably clear from the specifications that you 
> > can only have
> > one realm, one nonce, and so on. Most web browsers have 
> > gotten this right, I
> > think SIP implementors can too.
> > 
> > As an example of this, consider the Date header. Dates 
> > introduce constraints
> > that are far too complex to place in the grammar (for 
> > example, Feburary 29
> > is allowed in some years), and it is unrealistic to even try.
> > 
> > -Jonathan R.
> > ---
> > Jonathan D. Rosenberg, Ph.D.                72 Eagle Rock Ave.
> > Chief Scientist                             First Floor
> > dynamicsoft                                 East Hanover, NJ 07936
> > [email-masked]                     FAX:   (973) 952-5050
> > http://www.jdrosen.net                      PHONE: (973) 952-5000
> > http://www.dynamicsoft.com
> > 
> 

_______________________________________________
Sip mailing list  http://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip