Re: [dispatch] New SIP digest algorithm … Re: New Version Notification for draft-johansson-dispatch-dane-sip-00.txt

[Rifaat Shekh-Yusef <[e-mail]>]

Thanks Cullen,

Updating the Digest mechanism should be simple and straightforward to allow
us to address the algorithms limitation without requiring major changes to
the deployed systems.

I agree that we need a better solution for SIP that would also allow us to
provide a better way of storing the passwords in the DB.
I have been thinking about other solutions, but did not have a chance to
look at OAuth yet; I will take a look.

Regards,
 Rifaat



On Wed, Jan 8, 2014 at 1:49 PM, Cullen Jennings (fluffy)
<[e-mail]>wrote:

>
> On Jan 2, 2014, at 11:34 AM, Rifaat Shekh-Yusef <[e-mail]>
> wrote:
>
> > Hi Olle,
> >
> >        >Can we improve upon MD5 digest authentication?
> >
> > Take a look at the following HTTPAuth WG document:
> > https://datatracker.ietf.org/doc/draft-ietf-httpauth-digest/
> >
> > I have been working on this for some time, with SIP in mind. This
> started as an attempt to update RFC2617, and now it is a different document
> that will obsolete RFC2617.
> > The document updates 3 aspects of RFC2617:
> > 1. Algorithms agility: use of SHA2
> > 2. Internationalization
> > 3. Username hashing
> >
> > I am planning on writing a document to update the digest algorithms for
> SIP.
> >
> > Regards,
> >  Rifaat
> >
> >
>
> I suspect that sip core would be the best place to move forward a proposal
> like that. Personally, I would probably ague that moving to OAuth might be
> a better way to move forward.
>
> Cullen (with my individual contribute hat on)
>
>
>