Re: [Sip] draft-ietf-sip-sec-agree-04.txt

[Gonzalo Camarillo <[e-mail]>]

Hello,

In the particular example you are referring to, the server did not need
to include any header in the response in order to establish the chosen
security. However, in the general case, the server will chose which
information it should include in the response based on the
security-client header.

Modifying the security-client header can of course be used for a DoS
attack, but keep in mind that what we are trying to avoid is a bid-down
attack.

Regards,

Gonzalo

AC Mahendran wrote:
> 
> I have question regarding the purpose of the "Security-Client" field. Based
> on the description, it looks like this field is not used by the server in
> any way. Can someone explain the purpose of this field?
> 
> thanks,
> AC
> 
> Ps: In the "Server Initiated" (Section 3.4.2) procedures, this field is not
> used. By the same reasoning, this field should not be applicable to the
> "Client Initiated" procedures as well.
> 
> At 12:33 PM 7/7/2002 -0400, [e-mail] wrote:
> >A New Internet-Draft is available from the on-line Internet-Drafts
> >directories.
> >This draft is a work item of the Session Initiation Protocol Working Group
> >of the IETF.
> >
> >         Title           : Security Mechanism Agreement for SIP Sessions
> >         Author(s)       : J. Arkko et al.
> >         Filename        : draft-ietf-sip-sec-agree-04.txt
> >         Pages           : 17
> >         Date            : 05-Jul-02
> >
> >SIP has a number of security mechanisms. Some of them have been built
> >in to the SIP protocol, such as HTTP authentication or secure
> >attachments. These mechanisms have even alternative algorithms and
> >parameters. SIP does not currently provide any mechanism for
> >selecting which security mechanisms to use between two entities. In
> >particular, even if some mechanisms such as OPTIONS were used to make
> >this selection, the selection would be vulnerable against the
> >Bidding-Down attack. This document defines three header fields for
> >negotiating the security mechanisms within SIP between a SIP entity
> >and its next SIP hop. A SIP entity applying this mechanism must
> >always require some minimum security (i.e. integrity protection) from
> >all communicating parties in order to secure the negotiation, but the
> >negotiation can agree on which specific minimum security is used.
> >
> >A URL for this Internet-Draft is:
> >http://www.ietf.org/internet-drafts/draft-ietf-sip-sec-agree-04.txt
> >
> >To remove yourself from the IETF Announcement list, send a message to
> >ietf-announce-request with the word unsubscribe in the body of the message.
> >
> >Internet-Drafts are also available by anonymous FTP. Login with the username
> >"anonymous" and a password of your e-mail address. After logging in,
> >type "cd internet-drafts" and then
> >         "get draft-ietf-sip-sec-agree-04.txt".
> >
> >A list of Internet-Drafts directories can be found in
> >http://www.ietf.org/shadow.html
> >or ftp://ftp.ietf.org/ietf/1shadow-sites.txt
> >
> >
> >Internet-Drafts can also be obtained by e-mail.
> >
> >Send a message to:
> >         [e-mail].
> >In the body type:
> >         "FILE /internet-drafts/draft-ietf-sip-sec-agree-04.txt".
> >
> >NOTE:   The mail server at ietf.org can return the document in
> >         MIME-encoded form by using the "mpack" utility.  To use this
> >         feature, insert the command "ENCODING mime" before the "FILE"
> >         command.  To decode the response(s), you will need "munpack" or
> >         a MIME-compliant mail reader.  Different MIME-compliant mail readers
> >         exhibit different behavior, especially when dealing with
> >         "multipart" MIME messages (i.e. documents which have been split
> >         up into multiple messages), so check your local documentation on
> >         how to manipulate these messages.
> >
> >
> >Below is the data which will enable a MIME compliant mail reader
> >implementation to automatically retrieve the ASCII version of the
> >Internet-Draft.
> >Content-Type: text/plain
> >Content-ID:     <[e-mail]>
> >
> >ENCODING mime
> >FILE /internet-drafts/draft-ietf-sip-sec-agree-04.txt
> >
> ><ftp://ftp.ietf.org/internet-drafts/draft-ietf-sip-sec-agree-04.txt>
> 
> _______________________________________________
> Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
> This list is for NEW development of the core SIP Protocol
> Use [e-mail] for questions on current sip
> Use [e-mail] for new developments on the application of sip

-- 
Gonzalo Camarillo         Phone :  [phone]
Oy L M Ericsson Ab        Mobile:  [phone]
Telecom R&D               Fax   :  [phone]
FIN-02420 Jorvas          Email :  [e-mail]
Finland                   http://www.hut.fi/~gonzalo


_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [e-mail] for questions on current sip
Use [e-mail] for new developments on the application of sip