Re: [sipcore] Resend: WGLC: draft-ietf-sipcore-digest-scheme

Hi,

Regarding “authorized to use”, aren’t SIP clients allowed to use algorithms that aren’t in the registry?

Regards,

Christer

From: sipcore <sipcore-bounces@ietf.org> on behalf of Rifaat Shekh-Yusef <rifaat.ietf@gmail.com>
Date: Saturday, 18 May 2019 at 18.43
To: Dale Worley <worley@ariadne.com>
Cc: "sipcore@ietf.org" <sipcore@ietf.org>
Subject: Re: [sipcore] Resend: WGLC: draft-ietf-sipcore-digest-scheme

Thanks Dale!

See my replies below.

Regards,
 Rifaat

On Fri, May 17, 2019 at 8:20 AM Dale R. Worley <worley@ariadne.com<mailto:worley@ariadne.com>> wrote:
[resend -- for some reason, this didn't get through to the mailing list]

Sorry for being late with this.  Below are my detailed comments, but
generally the significant ones fall into two groups:

1) When is the binding time of "the contents of the Hash Algorithms for
HTTP Digest Authentication registry"?  That is, if a new algorithm is
added to the registry, does it automatically become authorized for use
in SIP?

My impression is that the answer is Yes.  But if so, the wording should
be updated in several places, because it seems to me that the current
wording tends to imply that this document copies the list of algorithms
from the registry at this time and authorizes those algorithms.

Yes, that is correct.
I will try to make it clearer; feel free to suggest a text, if you want.

2) There is discussion "The IANA registry ... specifies the algorithms
..... and specifies a priority for each algorithm."  But I cannot find the word
priority in the registry, nor in the sole reference in the registry, RFC
7616.  Can you update this to point to whatever defines the priority?

It is specified in section 3.7:
https://tools.ietf.org/html/rfc7616#section-3.7

But I think the wording in the draft is confusing; I will try to clarify that.

Dale

----------

   Abstract

   This document updates the Digest Access Authentication scheme used by
   the Session Initiation Protocol (SIP) to add support for secure
   digest algorithms to replace the broken MD5 algorithm.

Might be worth specifying what the "secure digest algorithms" are..

Ok

   1.  Introduction

   [...] which by default uses MD5 as
   the default algorithm.

Do you want "default" twice in this phrase?
No I do not :)
I will fix that.

   This document updates the Digest Access Authentication scheme used by
   SIP to support the list of digest algorithms defined in the "Hash
   Algorithms for HTTP Digest Authentication" registry defined by
   [RFC7616].

This should be phrased "to support the algorithms defined in the "Hash
Algorithms for HTTP Digest Authentication" registry".  This phrasing
gives a late-binding interpretation, that is, if an algorithm is added
to the registry, ipso facto it becomes authorized for use in SIP.

Ok

   2.  The SIP Digest Authentication Scheme

   This section describes the modifications to the operation of the
   Digest mechanism as specified in [RFC3261] in order to support the
   SHA- 256 and SHA-512/256 algorithms as described in [RFC7616], and
   also to require support for the "qop" option."

Similarly, you want this to be late-binding:

Ok.

   This section describes the modifications to the operation of the
   Digest mechanism as specified in [RFC3261] in order to support the
   algorithms defined in the "Hash Algorithms for HTTP Digest
   Authentication" registry defined by [RFC7616].

--

   2.1.  Hash Algorithms

   The Digest scheme has an 'algorithm' parameter that specifies the
   algorithm to be used to compute the digest of the response.  The IANA
   registry named "HTTP Digest Hash Algorithms" specifies the algorithms
   that correspond to 'algorithm' values, and specifies a priority for
   each algorithm.

I don't see a priority specified in the registry.

I will clarify it.

   3.  Augmented BNF for the SIP Protocol

   The number of hex digits must be specified by the specification of
   the algorithm used.

It might be better to say that the number of hex digits is implied by
the length of the value of the algorithm used, since the specification
of an algorithm might explicitly define its output as a sequence of
hex digits.
Ok

   It extends the algorithm parameter as follows to allow for SHA2
   algorithms to be used:

Or indeed, any algorithm in the registry.
Ok

   5.  IANA Considerations

   This document will use the algorithms defined in that
   registry.

Again is the question of binding time:

   This document specifies that algorithms defined in that registry
   may be used in SIP digest authentication.
Ok

[END]

_______________________________________________
sipcore mailing list
sipcore@ietf.org<mailto:sipcore@ietf.org>
https://www.ietf.org/mailman/listinfo/sipcore