Subject: [Sip] Nonce value in SIP Challenge

From: "Suha Cubukcuoglu" <[email-masked]>
Date: Thu, 4 Aug 2005 16:40:44 +0100

Hi,

In a scenario where a UA sends simultaneous requests, can the SIP Proxy
assign the same 'nonce' value in each challenge response to these
requests? This is not explained in the RFC3261, so I decided to post to
this list in case someone can help us with this.

For example, consider the following scenario:

1. UA ------------- REGISTER ----------> SIP Proxy 
2. UA -------------- INVITE -----------> SIP Proxy
3. UA <-- 401 (for REGISTER) nonce = 1234 --- SIP Proxy  
4. UA <-- 407 (for INVITE) nonce = 5678   --- SIP Proxy

5. UA ------------- REGISTER (nonce = 1234) --- SIP Proxy

(REGISTER attempt fails since the new nonce value stored against
the user is 5678) 

Had the Proxy not changed the 'nonce' value for the second request, the
REGISTER request in (5) would succeed.

My question is actually general: Is the result of this scenario
dependent on implementation of the proxy or is it defined anywhere as a
standard? Is the Proxy obliged to 'remember' the nonce for each request
or can there be only one 'nonce' value per subscriber at any point in
time? 

Thanks.

Regards,

Suha Cubukcuoglu
nplusone
t: +44 131 514 2000
d: +44 131 514 4037

-- 

This email and any files transmitted with it are confidential and intended 
solely for the use of the individual or entity to whom they are addressed.  
If you have received this email in error please notify the sender. Any 
offers or quotation of service are subject to formal specification.  
Errors and omissions excepted.  Please note that any views or opinions 
presented in this email are solely those of the author and do not 
necessarily represent those of Lumison, nplusone or lightershade ltd.  
Finally, the recipient should check this email and any attachments for the 
presence of viruses.  Lumison, nplusone and lightershade ltd accepts no 
liability for any damage caused by any virus transmitted by this email.

-- 
-- 
Virus scanned by Lumison.

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: "Brett Tate" <[email-masked]>
Date: Thu, 4 Aug 2005 14:45:08 -0400

> In a scenario where a UA sends simultaneous 
> requests, can the SIP Proxy assign the same 
> 'nonce' value in each challenge response to 
> these requests?

It can; but that does not mean that it should.

If qop is used, some UAs would cache and increment 
the nonce count for the cached nonce across 
unrelated dialogs/transactions.  However 
if they don't cache, the nonce count will not 
increment correctly across unrelated 
dialogs/transactions.

> This is not explained in the RFC3261, so I 
> decided to post to this list in case someone 
> can help us with this.
> 
> (REGISTER attempt fails since the new nonce 
> value stored against the user is 5678) 
> 
> Had the Proxy not changed the 'nonce' value for 
> the second request, the REGISTER request 
> in (5) would succeed.
> 
> My question is actually general: Is the result of this 
> scenario dependent on implementation of the proxy or 
> is it defined anywhere as a standard? 

The result is dependent on the proxy.

Because of the SHOULDs and MAYs associated with nonce 
caching, the UA does not know how the proxy will cache; 
and the proxy does not know how the UA will cache.

Thus if the proxy wants to avoid some of the "stale" 
nonce situations, it can implement a nonce caching
mechanism to handle UAs that cache and those that
don't cache.

> Is the Proxy obliged to 'remember' the nonce for 
> each request or can there be only one 'nonce' value 
> per subscriber at any point in time? 

The RFC allows the proxy to make the decision.
And depending on the implementation, this might 
occasionally cause another challenge when the 
proxy thinks the UA sent a "stale" nonce.