Subject: [Sip] Question on rfc3310 Hypertext Transfer Protocol (HTTP) Digest Aut hentication Using Authentication and Key Agreement (AKA)

From: Xin Chen <[email-masked]>
Date: Thu, 23 Oct 2003 11:38:14 +0100

Hi,

My question is that if REGISTER procedure is used to authenticate the user
agent, then it can only authenticate the device which initiate the REGISTER.

What happen if the REGISTER contains multiple contact addresses which
possibly represent multiple devices, does that mean all the other devices
are authenticated also?

If forking happens, how to provide confidentially and integration to the SIP
messages towards the other contact addresses?

I am not sure whether these questions are within the scope of the RFC or
not, but your comment and thoughts are appreciated. 

Regards
 
Xin Chen
Mobile Network Division
Fujitsu Laboratories Europe
Tel: +44(0)2086064453
Mobile: +44(0)7775741020

-----Original Message-----
From: Jonathan Rosenberg [mailto:[email-masked]] 
Sent: 21 October 2003 09:09
To: [email-masked]
Subject: [Sip] GRUU Mechanism I-D

Folks,

I've submitted a new I-D that proposes a specific mechanism for GRUUs 
that meets the requiremetns draft under discussion in sipping. Based 
on our conclusion in the list discussion, the GRUU is placed into the 
Contact header field, and therefore does not require both caller and 
callee to support it.

Until the I-D appears in the archives, you can pick up a copy at:
http://www.jdrosen.net/papers/draft-rosenberg-sip-gruu-00.txt

There are still some open issues. The most notable one, I think, is 
how a UA knows about whether it can construct a GRUU locally, or 
whether it needs to obtain one from its provider. The draft recommends 
that a UA never try to use a locally constructed one. This is under 
the premise that it will never have a good way to know whether it is 
globally reachable. The drawback to this, of course, is that we will 
never see direct UA to UA signaling anymore.

Comments and questions welcome.

Thanks,
Jonathan R.
-- 
Jonathan D. Rosenberg, Ph.D.                600 Lanidex Plaza
Chief Technology Officer                    Parsippany, NJ 07054-2711
dynamicsoft
[email-masked]                     FAX:   (973) 952-5050
http://www.jdrosen.net                      PHONE: (973) 952-5000
http://www.dynamicsoft.com

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip Use
[email-masked] for new developments on the application of sip

---

From: Dean Willis <[email-masked]>
Date: Thu, 23 Oct 2003 14:28:43 -0500

> not, but your comment and thoughts are appreciated. 

1) This type of question is probably better-addressed to the SIP
Implementors list. Perhaps we should even include it in the FAQ?

2) In the typical case, authentication of a REGISTER request simply
establishes that the request in question came from a user agent with
credentials to authenticate against the address-of-record in question.
It does NOT establish anything about future requests coming from that
user agent, or about contacts registered by that request.

Authentication of a REGISTER request does NOTHING to provide
confidentiality or message protection of traffic back toward the
registering UA, nor to any other UA for which a "Contact" exists. That's
why we have "sips" and TLS. And the ability to authenticate EVERY
request, not just REGISTER.

3GPP has done something "special" here -- during the registration
transaction, they establish keying for a transport-level
integrity-protected (and optionally encrypted) tunnel between the UA and
its edge proxy. This tunnel then protects future messages between the
two, and since the edge proxy is trusted (and every other proxy, for
that matter), allows for transitive trust all the way through the
system. This isn't a general case solution, but they feel it works in a
telecom operator environment. This is why there are all sorts of
applicability statement and scope warnings in the RFCs defining 3GPP
P-headers -- if used in the outside world, the sensistive information
therein would be likely to be compromised.

--
Dean

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip