[Sip] RE: Question on draft-ietf-sip-identity-01

Hi,

Yes, the consequences of placing an authentication token into a SIP header
have been considered in the past. There were really three significant
factors that led to the architecture used in draft-ietf-sip-identity (in
which the authentication token appears in a body instead):

- The tokens themselves can be quite large and complicated. Following the
recommendation in the AIB draft (draft-ietf-sip-authid-body), a token might
contain numerous headers which are required for reference integrity.
Compound that with a digital signature. Compound that with an appended
certificate for verifying the signature (common in CMS applications). All
together, the size of one of these tokens would be considerably larger that
conventional SIP headers. While technically, headers are unbounded in size,
from a practical perspective chunks of data over a certain threshhold are
more suitable for the body of a message than a header. A proxy handling a
header that was, say, over 1K in size could conceivably hiccup. Encoding a
header that contained multiple SIP headers and a digital signature and a
certificate could also be challenging.

- For additional reference integrity, some tokens may want to place
signatures around actual message bodies, notably SDP. This is a general
motivation for the use of S/MIME for identity. Replicating bodies in headers
would be... silly.

- Headers are frequently manipulated by proxy servers - bodies, however,
MUST NOT be modified by proxy servers (per RFC3261 16.6). A great deal of
emphasis in the SIP security work was placed on end-to-end security
properties. While headers can be marked unmodifiable (by omitting the 'amd's
in the famous Table 2 of RFC3261), the guidelines for bodies are more
strict.

Jon Peterson
NeuStar, Inc.

> -----Original Message-----
> From: Marco Aime [mailto:m.aime@polito.it]
> Sent: Tuesday, June 10, 2003 9:21 AM
> To: jon.peterson@neustar.biz
> Cc: sip@ietf.org
> Subject: Question on draft-ietf-sip-identity-01
> 
> 
> Hi Jon,
> 
> regarding draft-ietf-sip-identity-01, I'm wondering what can be the 
> problems trying to place the authentication token into a SIP header 
> rather than the body: has the consequences of this option been 
> investigated already?
> 
> Thanks in advance
> Bye
> Marco Aime
> 
> -- 
> ------------------------------------------------------------------
> Marco AIME
> Dipartimento di Automatica e Informatica
> Politecnico di Torino
> Addr: Via Cardinal Massaia 83, Torino, Italy
> Tel: +39 011 22102-44
> Fax: +39 011 22102-29
> Mail: m.aime@polito.it (marcodomenico.aime@polito.it)
> ------------------------------------------------------------------
> 
_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use sip-implementors@cs.columbia.edu for questions on current sip
Use sipping@ietf.org for new developments on the application of sip