Subject: [Sip] WGLC for auth-id body

From: Rohan Mahy <[email-masked]>
Date: Tue, 13 May 2003 17:39:48 -0700

Hello Everyone,

I would like to begin Working Group Last Call on

http://www.ietf.org/internet-drafts/draft-ietf-sip-authid-body-01.txt

WGLC will end on Friday, June 13, 2003.

thanks,
-rohan

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: Cullen Jennings <[email-masked]>
Date: Wed, 21 May 2003 15:07:13 -0700

I have a concern about SIP security (I've always wanted to start and email
that way :-) 

If A sends a request to B and B puts an AIB in the response, I think the
response AIB should have a To: B and not have a From: B. The reason is
fairly simple - Imagine A is an attacker and is watching some call B is
having with C. A wants to insert a message into this call flow - It knows
the Call-ID and appropriate tags and such. A can guess a CSeq that will
likely work. Now A sends a request to B with all this stuff and B sends A a
signed AIB that A can now use to send to C and impersonate B.

On the minor NITs level ...

It would be nice to add some text on tags in To From and if they should be
inserted or not and if  they must match.

Use a binary transfer encoding instead of base64 in all of the examples. I
know this is a pain in the RFC but I think it is what we should use in SIP.

Point out that detached signatures SHOULD be used.

Clarify if the signature is computed over

    ---------
    Content-Type: ...
    Content-Disposition: ...

    From:...
    To:....   
    -------

Or over 

    ---------
    From:...
    To:....   
    -------

The outer SIP message in example 3 does not have a Content-Length.

I like the draft.