Re: [Sip] draft-state-sip-relay-attack-00

[Victor Pascual Ávila <[e-mail]>]

On Tue, Mar 17, 2009 at 10:48 AM, Raphael Coeffic <[e-mail]> wrote:
> You may be aware of it or not, however, we have already implemented this
> scenario at iptel.org. This is because iptel.org does not have any own PSTN
> gateway. In this case, the user can configure a PSTN gateway he whishes to
> use when such a number is dialed. We implemented like this to cope with all
> the low-end phones that do not provide multiple accounts, or do not offer a
> convenient way for the user to provide routing rules.

I agree-- some terminating domains may require authentication. Indeed,
this is defined in rfc3665 as a BCP. In Section 3.3 (Session with
Multiple Proxy Authentication), Proxy 1 is relaying challenges and
responses for different (sub)domains.

> So, as a conclusion, I do not think we are talking about theory, but about
> real existing applications. Of course, you could also store your other PSTN
> credentials at the proxy, and make it deal with the authentication for you.
> However, I'm quite sure you wouldn't be very confident about that, would
> you?

Once again, IMHO this should be as much end-to-end as possible. Some
folks are still using SIP as a protocol for the (open) Internet.

Cheers,
-- 
Victor Pascual Ávila