Subject: RE: AW: [Sipping] FYI: RADIUS & SIP

From: "Beck01, Wolfgang" <[email-masked]>
Date: Thu, 31 Jul 2003 14:45:33 +0200

> The *sample algorithm* used to compute response and session key in
> an early spec (COMP128-1) is indeed "obsure" and has been broken.
> 
> However, the algorithm is an operator's choice, and many operators
> have opted to use different algoríthms which have *not* been broken.

Thanks for the clarification. Coming back to the original question, a
RADIUS server would have to support several challenge/response schemes:
- CHAP (available in today's RADIUS servers, but not in today's SIP phones)
- HTTP Digest (Sterman draft, available in some RADIUS servers and most SIP phones)
- the GSM SIM A3 algorithm du jour
- 3GPP ISIM AKA
if the provider does not have an alternative GSM authentication
infrastructure.

> > > Plus, SIM-based authentication could be used as a bootstrap
> > > mechanism for X.509 certficate distribution and therefore for
> > > TLS mutual authentication.
> > >
> >I support this, but I fear ISIMs will be cheaper as they are
> >already standardized and will be promoted by the UMTS providers.
> 
> [...]There goes your ISIM method.
I did not compare SIM with ISIM AKA, but ISIM with smartcards holding x509
certificates.

This thread was about the question how existing RADIUS infrastructures can
be extended to support SIP. Your proposal is about the question how SIP
should be extended to be able to reuse a existing GSM authentication
infrastructures. This is reasonable for a mobile operator but not for an
ISP.

However, using smart cards (SIM, ISIM, Cryptoflex etc) makes sense for ISPs,
too. It's easier to tell the customer: "insert this card here" instead of
saying: "go to menu x, item y and enter a password longer than 5 characters
with at least 2 numerics, don't choose your aunt's surname and change it
every 8 weeks ...". Interoperability with existing GSM is in this case not
as important as it is for mobile operators.

--
Wolfgang Beck
T-Systems Nova GmbH

_______________________________________________
Sipping mailing list  https://www1.ietf.org/mailman/listinfo/sipping
This list is for NEW development of the application of SIP
Use [email-masked] for questions on current sip
Use [email-masked] for new developments of core SIP

---

From: Henning Schulzrinne <[email-masked]>
Date: Thu, 31 Jul 2003 10:39:29 -0400

> as important as it is for mobile operators.

Don't SIM cards also have PINs? Thus, you still have to tell the 
customer "don't choose the last four digits of your social security 
number or 1234"... Obviously, requiring both "something you have" and 
"something you know" is more secure than jut "something you know".

Also, while SIM cards work ok when kept in the cell phone, the existing 
card mechanics don't seem to work well if you want to, say, quickly use 
the phone in the meeting room. Would you need to remove and insert the 
SIM card each time? "Oops, I left the card in my office phone, I can't 
make a call from home right now."