Re: [sipcore] New Version Notification for draft-yusef-sipcore-digest-scheme-04.txt

Paul Kyzivat <pkyzivat@alum.mit.edu> Tue, 28 January 2014 20:47 UTC

Return-Path: <pkyzivat@alum.mit.edu>
X-Original-To: sipcore@ietfa.amsl.com
Delivered-To: sipcore@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 437DD1A027B for <sipcore@ietfa.amsl.com>; Tue, 28 Jan 2014 12:47:49 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.235
X-Spam-Level:
X-Spam-Status: No, score=-1.235 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, SPF_SOFTFAIL=0.665] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id G1e5J1aGQwqZ for <sipcore@ietfa.amsl.com>; Tue, 28 Jan 2014 12:47:48 -0800 (PST)
Received: from qmta06.westchester.pa.mail.comcast.net (qmta06.westchester.pa.mail.comcast.net [IPv6:2001:558:fe14:43:76:96:62:56]) by ietfa.amsl.com (Postfix) with ESMTP id EFB4E1A001E for <sipcore@ietf.org>; Tue, 28 Jan 2014 12:47:47 -0800 (PST)
Received: from omta08.westchester.pa.mail.comcast.net ([76.96.62.12]) by qmta06.westchester.pa.mail.comcast.net with comcast id KXAh1n0010Fqzac56YnlVn; Tue, 28 Jan 2014 20:47:45 +0000
Received: from Paul-Kyzivats-MacBook-Pro.local ([50.138.229.164]) by omta08.westchester.pa.mail.comcast.net with comcast id KYnk1n00W3ZTu2S3UYnlbC; Tue, 28 Jan 2014 20:47:45 +0000
Message-ID: <52E81770.8040801@alum.mit.edu>
Date: Tue, 28 Jan 2014 15:47:44 -0500
From: Paul Kyzivat <pkyzivat@alum.mit.edu>
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:24.0) Gecko/20100101 Thunderbird/24.2.0
MIME-Version: 1.0
To: sipcore@ietf.org
References: <20140125134253.20916.76333.idtracker@ietfa.amsl.com> <CAGL6epLVX73mx3hme6pVgQ7duk+n0Z_cjqjjUV7LZD63i87wvw@mail.gmail.com> <201401281812.s0SICmND3782203@shell01.TheWorld.com>
In-Reply-To: <201401281812.s0SICmND3782203@shell01.TheWorld.com>
Content-Type: text/plain; charset="ISO-8859-1"; format="flowed"
Content-Transfer-Encoding: 7bit
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=comcast.net; s=q20121106; t=1390942065; bh=WUiJBbcLqSQCnf2VHg2v+lB1qdUIyeNUb1MSm8G3HeQ=; h=Received:Received:Message-ID:Date:From:MIME-Version:To:Subject: Content-Type; b=TZ4vIPZyQkYFrK7/56pEhJJP68o7IOHlAi2fNPPYW5ICdB93yr8pIFgPhsNIwJD4b rtUfM5XSND5SpRfNRoJ7R4feNesi7vl3Mmkc4NYO7e3jTyhCWx5wUBwx+LivnT8B14 /3veqoCHvy/uYxEVOntZ91hDXWY22DVbo/shVvNni4km/efqYGb7faKfKp+fHbZbPk 42d2IsqSnKaao3NiyTsBz2wU2hqOH3uUghG1Mr74MVMkXPWAU02Xcqo3RXIAPoIWbE SXL6z5wR7YnIXqjETecLkdsAoCt56WnFagxCaB9/oMUT8TL4kRfpXpWAWqeOtk6V2i x3aAES8nPzK5g==
Subject: Re: [sipcore] New Version Notification for draft-yusef-sipcore-digest-scheme-04.txt
X-BeenThere: sipcore@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: SIP Core Working Group <sipcore.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/sipcore>, <mailto:sipcore-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/sipcore/>
List-Post: <mailto:sipcore@ietf.org>
List-Help: <mailto:sipcore-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/sipcore>, <mailto:sipcore-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 28 Jan 2014 20:47:49 -0000

On 1/28/14 1:12 PM, Dale R. Worley wrote:
>> From: Rifaat Shekh-Yusef <rifaat.ietf@gmail.com>
>
>> Are there SIP servers and clients out there that support *only* RFC
>> 2069 that would break because of this?
>
> The open-source sipX didn't support qop a few years ago.  I don't know
> which of its derivatives do now.  The one that eZuce sponsors does
> support qop.
>
>> From: Michael Procter <michael@voip.co.uk>
>
>> Without being able to tell these two cases apart, I'm not sure a UAC
>> is able to maximise the chances of a request succeeding at the same
>> time as minimising the risk of using weaker auth-schemes when stronger
>> ones may be supported.
>
> That seems to be an unavoidable tradeoff.

The best I can see is for the UAC to respond to the strongest algorithm 
for each realm.

That is a problem if a single realm has some servers with weaker support 
than others. But the realm ought to fix that.

	Thanks,
	Paul