Subject: [Sip] verification of diversion header (draft-levy)

From: Juha Heinanen <[email-masked]>
Date: Thu, 4 Sep 2003 19:47:29 +0300

according to draft-levy-sip-diversion-06.txt, an UAS can include a
diversion header in 302 reply.  how can the proxy or UAC verify that the
uri included the diversion header really belongs to the user of the UAS?

security section of draft-levy doesn't mentions any problems related to
faked uri in the diversion header, but they can be very serious, e.g.,
cause someone else pay for the call diverted to an expensive pstn
number.

-- juha

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: Cullen Jennings <[email-masked]>
Date: Thu, 04 Sep 2003 19:28:41 -0700

> cause someone else pay for the call diverted to an expensive pstn

Agreed - I don't think it can. It part of the end to middle authentication
problem. This problem has been brought up before - I think the History
requirements include requirements to be able to solve this problem.

Cullen

---

From: Juha Heinanen <[email-masked]>
Date: Fri, 5 Sep 2003 08:25:16 +0300

> requirements include requirements to be able to solve this problem.

i guess the root of the problem is in the fact that a 302 diversion
header sip reply contains information that should be challenged and sip
protocol doesn't allow challenging replies.

-- juha