Subject: Re: [Sipping] New version of the SIP-AAA reqs draft

From: "Beck01, Wolfgang" <[email-masked]>
Date: Thu, 27 Feb 2003 15:57:05 +0100

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]
> Sent: Thursday, February 27, 2003 2:50 PM
> To: Beck, Wolfgang
> Cc: [email-masked]
> Subject: RE: [Sip] Re: [Sipping] New version of the SIP-AAA reqs draft
> 
> 
> Beck01, Wolfgang writes:
> 
>  > well, at least in theory: the UAs have TLS connections to their
>  > proxies, the  > proxies trust each other and the ingress proxies
>  > insert P-Asserted-Identity > headers.
> 
> how does the proxy know that a ua that has tls connection to it, is
> its user? tls alone is not enough. 
> 
During TLS handshake, the proxy obtains a X509 certificate from the UA.
The cert. contains a subject name that identifies the peer. This can be
used to create a P-Asserted-Identity header. Only the proxy that is directly
connected via TLS to the customer can do that of, of course. All following
proxies have to rely on P-Asserted-Identity (or OSP-token?). You can use
digest authentication on top of TLS to discriminate SIP users that share a
TLS connection using a proxy.

--
Wolfgang Beck
T-Systems Nova GmbH 
_______________________________________________
Sipping mailing list  https://www1.ietf.org/mailman/listinfo/sipping
This list is for NEW development of the application of SIP
Use [email-masked] for questions on current sip
Use [email-masked] for new developments of core SIP

---

From: [email-masked]
Date: Thu, 27 Feb 2003 17:24:41 +0200

> During TLS handshake, the proxy obtains a X509 certificate from the

so you assume somekind of pki and mutual authentication of ua and proxy?
if so, we don't have any of it in real products and practices. 

 > TLS connection using a proxy.

if you don't have the certificate system that you outlined above, the
proxy can't do digest authentication, because you don't know if the user
sending the request is your user or not.  dialog state would help.
another thing that would help is always using as fro uri the uri of the
sending user, which would allow the proxy to know if the user can be
challenged or not. 

-- juha