Re: [sipcore] Comments on draft-ietf-sipcore-sip-authn-02

[Rifaat Shekh-Yusef <[e-mail]>]

Thanks Yehoshua,

Please, see my reply inline...

Regards,
 Rifaat


On Wed, Aug 1, 2018 at 5:23 AM Yehoshua Gev <[e-mail]> wrote:

> Hi Rifaat,
>
> Another question about section 3.
> RFC 3261 separates between "User-to-User Authentication" (section 2.2),
> which uses the Authorization header, and "Proxy-to-User Authentication"
> (section 2.3), which uses the Proxy-Authorization header.
> As you wrote, the draft is mostly intended for Proxy-to-User, so maybe the
> Proxy-Authorization header should be used.
>

Here is a quote from RFC3261:

21.4.2 <https://tools.ietf.org/html/rfc3261#section-21.4.2> 401 Unauthorized

   The request requires user authentication.  This response is issued by

   UASs and registrars, while 407 (Proxy Authentication Required) is

   used by proxy servers.


Since so far the draft was mainly talking about the registration part, I
think the use of Authorization header is correct.



> In any case, I think that the following security consideration should be
> added:
> For HTTP, the request is passed without intermediates, so as long as the
> transport is secured (HTTPS) the access token is not exposed by the
> protocol to other parties.
> For SIP, proxies are used, so unless the token is authenticated by the
> nearest proxy, there is no way to avoid exposure the token to the proxies
> along the way.
> Additionally, if the token is authenticated by a proxy, the proxy MUST
> remove the Authorization header when forwarding the request, to avoid
> exposure of the token.
>

The document is intentionally silent on this issue, because it is out of
scope for this document.
But I agree that the security section must be enhanced to clearly state
that TLS must be used to protect the authz code and tokens.



>
> Regarding error conditions, I think that SIP should follow the behavior of
> HTTP, and return 401 with WWW-Authenticate (or Proxy-Authenticate) header
> as described in RFC 6750 section 3.
>
> Some additional nits:
> - Section 4: s/authorization header/Authorization header field/
> - Section 4: Indicate that the syntax is given in ABNF (at least for me
> it's useful, so I can search the document for "ABNF" and find the syntax
> :-) ).
> - Section 8.2: [RFC474bis] -> [RFC8224]
>
>
Thanks,
 Rifaat


> Regards,
> Yehoshua
>
>
>
>