Re: [sipcore] I-D Action: draft-ietf-sipcore-sip-token-authnz-02.txt

[Christer Holmberg <[e-mail]>]

Hi,

>>>> As I said in another reply, if you by default place a REGISTER token in a non-REGISTER request the token may reach the remote peer, which could be a security concern.
>>>     
>>>     I would like to hear more about this. Is there something about the token
>>>     that reveals stuff that might not be suitable to expose to everyone? I
>>>     personally don't know. This seems like something that ought to be
>>>     discussed in security considerations.
>>>    
>> The token itself does not reveal anything, but in OAuth the token is used to access the requested resource, so it is considered sensitive information.
>> 
>> As far as I know, OAuth for SIP has only been used for REGISTER requests, between the UA and the registrar. I have never heard about anyone using
>> it for non-REGISTER authentication, and I wonder whether we even need to cover it in the draft. We could limit the scope the REGISTER requests. 
>> Then, if anyone ever needs OAuth for non-REGISTER requests, a separate draft can be written.
>    
>    Yes, you can do that if you wish. But ISTM that the issues are largely 
>    the same so I don't know why you would do that.

The REGISTER request, and the token, will only reach the registrar.

Regards,

Christer
  




  
    	Thanks,
    	Paul