[Sip-security] Re: SIP authentication problem when using RES in Digest-AKA

Hi Sanjoy,

> Another option to think about is whether there is any need to carry AKA 
> credentials (as is) in the HTTP *-Authenticate and *-Authorization 
> headers. This means that we define AKA as an authentication scheme at 
> par with Digest (instead of using it as a password generation tool, say, 
> for Digest MD5). In HTTP Authentication syntax,

You are right. This is an alternative option, as we have discussed 
before. As AKA is secure in itself, there shouldn't be a problem sending 
AKA parameters in the clear.

However, by doing this you will lose the one thing that Digest provides, 
which is authentication of the SIP message, or at least parts of it 
during the authentication procedure.

So all in all, from the AKA perspective, both options should be equally 
secure, but with Digest AKA, the SIP message is better protected. How 
desirable exactly this added protection is, and indeed is the added cost 
of calculating the Digest MD5 worth the received benefits, is open to 
discussion.

Cheers,
Aki

_______________________________________________
Sip-security mailing list
Sip-security@ietf.org
https://www1.ietf.org/mailman/listinfo/sip-security