Re: [Sip] draft-state-sip-relay-attack-00

[Hadriel Kaplan <[e-mail]>]

> -----Original Message-----
> From: Raphael Coeffic [mailto:[e-mail]]
> Sent: Tuesday, March 10, 2009 6:06 AM
> 
> Hadriel Kaplan wrote:
> 
> Forcing registrations is the path that IMS went for, I believe. But if
> you want to take advantage of this, you may have to deploy a little more
> IMS than you'd like to. 

The concept and practice of "forcing" UA's, which have AoR's belonging to a domain, to REGISTER their contact binding for those AoR's in order to make calls, has been around a lot longer than IMS has.  Invoking the "that sounds like IMS" defense is a cheap guilt-by-association argument, and not relevant.  One might as well argue that using INVITE's or RTP "is the path that IMS went for".

You keep making it sound like sending a SIP request which does not create a dialog is somehow a difficult mechanism to implement, or "forces" people to do something they don't want to.  What is it forcing?

You're looking for a means of authenticating a UA without being subject to a relay attack.  Using a different SIP Method name, which can only be initiated by the client with the credentials, and one that UA's cannot be baited to provide by random third parties, is one solution to the problem.  If you don't like the string "REGISTER", then how about "OPTIONS"?


> This reminds me of some email providers that
> require you to connect through POP3 prior to send any message through
> SMTP, instead of deploying any secure authentication mechnism.

No, this is more like a Website which offers email services requiring you to login using your credentials before letting you send.  It's not analogous to making you use POP3 because a REGISTER does not use a different protocol, and can be tied to the same connection-layer "flow" as the INVITE et al.

You may not like it, but any form of authentication by definition is more restrictive than no form of authentication.

 
> Maybe just an example: let's say you have a home SIP server, doing the
> usual least cost routing. Your least cost router might have something
> like 50 different routes. Do you want this box, or maybe your phones to
> have 50 running registrations, just for the purpose of having cheap
> calls? Well, personaly, I would prefer to just install my certificate on
> this box, and use TLS. But as very very few of those PSTN providers do
> support TLS, I cannot. By the way, there are already commercial products
> supporting this scenario.

So you have a mechanism that people don't seem to want to implement - and meanwhile you have another mechanism, which is widely implemented.  And the problem is...?

-hadriel