Re: [sipcore] Resend: WGLC: draft-ietf-sipcore-digest-scheme

[Rifaat Shekh-Yusef <[e-mail]>]

Thanks Dale!

See my replies below.

Regards,
 Rifaat


On Fri, May 17, 2019 at 8:20 AM Dale R. Worley <[e-mail]> wrote:

> [resend -- for some reason, this didn't get through to the mailing list]
>
> Sorry for being late with this.  Below are my detailed comments, but
> generally the significant ones fall into two groups:
>
> 1) When is the binding time of "the contents of the Hash Algorithms for
> HTTP Digest Authentication registry"?  That is, if a new algorithm is
> added to the registry, does it automatically become authorized for use
> in SIP?
>
> My impression is that the answer is Yes.  But if so, the wording should
> be updated in several places, because it seems to me that the current
> wording tends to imply that this document copies the list of algorithms
> from the registry at this time and authorizes those algorithms.
>
>
Yes, that is correct.
I will try to make it clearer; feel free to suggest a text, if you want.




> 2) There is discussion "The IANA registry ... specifies the algorithms
> .... and specifies a priority for each algorithm."  But I cannot find the
> word
> priority in the registry, nor in the sole reference in the registry, RFC
> 7616.  Can you update this to point to whatever defines the priority?
>
>
It is specified in section 3.7:
https://tools.ietf.org/html/rfc7616#section-3.7

But I think the wording in the draft is confusing; I will try to clarify
that.



> Dale
>
> ----------
>
>    Abstract
>
>    This document updates the Digest Access Authentication scheme used by
>    the Session Initiation Protocol (SIP) to add support for secure
>    digest algorithms to replace the broken MD5 algorithm.
>
> Might be worth specifying what the "secure digest algorithms" are.
>

Ok



>
>    1.  Introduction
>
>    [...] which by default uses MD5 as
>    the default algorithm.
>
> Do you want "default" twice in this phrase?
>
> No I do not :)
I will fix that.



>    This document updates the Digest Access Authentication scheme used by
>    SIP to support the list of digest algorithms defined in the "Hash
>    Algorithms for HTTP Digest Authentication" registry defined by
>    [RFC7616].
>
> This should be phrased "to support the algorithms defined in the "Hash
> Algorithms for HTTP Digest Authentication" registry".  This phrasing
> gives a late-binding interpretation, that is, if an algorithm is added
> to the registry, ipso facto it becomes authorized for use in SIP.
>

Ok


>
>    2.  The SIP Digest Authentication Scheme
>
>    This section describes the modifications to the operation of the
>    Digest mechanism as specified in [RFC3261] in order to support the
>    SHA- 256 and SHA-512/256 algorithms as described in [RFC7616], and
>    also to require support for the "qop" option."
>
> Similarly, you want this to be late-binding:
>

Ok.



>
>    This section describes the modifications to the operation of the
>    Digest mechanism as specified in [RFC3261] in order to support the
>    algorithms defined in the "Hash Algorithms for HTTP Digest
>    Authentication" registry defined by [RFC7616].
>
> --
>
>    2.1.  Hash Algorithms
>
>    The Digest scheme has an 'algorithm' parameter that specifies the
>    algorithm to be used to compute the digest of the response.  The IANA
>    registry named "HTTP Digest Hash Algorithms" specifies the algorithms
>    that correspond to 'algorithm' values, and specifies a priority for
>    each algorithm.
>
> I don't see a priority specified in the registry.
>

I will clarify it.


>
>    3.  Augmented BNF for the SIP Protocol
>
>    The number of hex digits must be specified by the specification of
>    the algorithm used.
>
> It might be better to say that the number of hex digits is implied by
> the length of the value of the algorithm used, since the specification
> of an algorithm might explicitly define its output as a sequence of
> hex digits.
>
> Ok



>    It extends the algorithm parameter as follows to allow for SHA2
>    algorithms to be used:
>
> Or indeed, any algorithm in the registry.
>
> Ok


>    5.  IANA Considerations
>
>    This document will use the algorithms defined in that
>    registry.
>
> Again is the question of binding time:
>
>    This document specifies that algorithms defined in that registry
>    may be used in SIP digest authentication.

Ok



>
> [END]
>
> _______________________________________________
> sipcore mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/sipcore
>