Re: [sipcore] Benjamin Kaduk's Discuss on draft-ietf-sipcore-sip-token-authnz-13: (with DISCUSS and COMMENT)

[Christer Holmberg <[e-mail]>]

    
    >>>    NOTE: At the time of writing this specification, detailed procedures for the cases where a UAC receives multiple
    >>>    different authentication schemes had not been defined. A future specification might define such procedures.
    >>>
    >> Until we have a point where we know we can securely handle multiple authentication schemes from the same UAS,
    >> I think we should recommend one policy per realm and/or domain.
    >> 
    >> That will mean that until we have the BCP we determine method per device - new devices gets the challenge
    >> that they support and we limit the possibilities of downgrade attacks.
    >
    > I don't understand what you are suggesting here.
    >
    > Is it that the UAS should only challenge with one scheme? That could be 
    > problematic, since it means either only use Digest, or else use Bearer 
    > and fail to work with any device that doesn't support it. (Can you say 
    >"flag day"?)
    >
    > Or do you mean that the UAC should only respond with credentials for one 
    > of the schemes it receives challenges for?
 
    The UAC only responding with credentials for one scheme is the suggestion based on Benjamin's review.

    Regards,

    Christer