Re: [tram] Sync STUN and SIP auth

[Alan Johnston <[e-mail]>]

Marc & Simon,

Rifaat and many other SIPCORE folks will be in Dallas next week, so we
should definitely meet up and figure out a solution.

- Alan -


On Thu, Mar 19, 2015 at 8:55 AM, Marc Petit-Huguenin <[e-mail]>
wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA256
>
> On 03/19/2015 07:43 AM, Simon Perreault wrote:
> > Le 2015-03-19 07:14, Marc Petit-Huguenin a écrit :
> >>> Does the use of salted SHA256 for passwords match up with what is
> planned
> >>> for SIP?  See:
> >>>
> >>>     https://tools.ietf.org/html/draft-yusef-sipcore-digest-scheme
> >>>
> >>> Does H(A1) match up?  Also, I'm not aware if this draft is moving
> forward:
> >>>
> >>>     https://tools.ietf.org/html/draft-veltri-sip-alt-auth
> >> It is not, which is sad because I find it better than
> draft-yusef-sipcore-digest-scheme.  It also fits better with STUN where the
> hash algorithm (SHA-1 and now SHA256) has been split off the password hash
> algorithm (MD5) from the beginning.  draft-yusef-sipcore-digest-scheme does
> not even talk about the password algorithm, continuing the (I think) rather
> bad idea of linking the two together.
> >
> > What you're saying makes sense, yet does not bring us closer to syncing
> > STUN and SIP auth. I don't know if it is a possible goal, but I feel it
> > is our duty to at least explore the possibility.
> >
> > I note that the two drafts above are not working-group drafts. It would
> > be good to have a chat with the sipcore chairs in Dallas and reach a
> > common understanding of the situation...
>
> Let's do that, but I noticed that sipcore will not have a session in
> Dallas.
>
> >
> > Simon
> >
>
>
> - --
> Marc Petit-Huguenin
> Email: [e-mail]
> Blog: http://blog.marc.petit-huguenin.org
> Profile: http://www.linkedin.com/in/petithug
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1
>
> iQIcBAEBCAAGBQJVCtU5AAoJECnERZXWan7EHyYP/1gnBqKC/J1zuPYg+M4Xg3qV
> tXFQwAcTv9CuF+/9j0+vkSyUluopXTPP4i9hf8Ms4PRZc6QT3ZkBqpDwkZZYuXQK
> zPyxT1o2D5XV1dnjYfZXZcN68Bf/5rR23EHYRdY1j/fMPrEJkVP7vtu3Sr3xfXA7
> m4zcdKLA4u2OmK5aeDHP24+zcRAXOJ07WW6gudKSb3MAzOyn3sL4hC56tgQdJWNO
> wEyZXhIP4VdBjGy0Cs9wNrvZsgi7AR9J3HkOGZMv9gpH5ZI3yJYBHbyn3IuGa/ig
> u+rEXwXjdvBVPEmrNyd3PURop1V9szsHg2x86wn58DbH4YmRJeqXHT8uPiug+c7A
> 59rEPxiN3ajRQaN+KVEE7Zp5iQeFpPRKz6FJtd1261eMFawE0vMApGC4oaVZuEL8
> KQIGu+trEixJG8SI29UwYq5YLOOQsDBLP+q6uV6nqYgz9G8I2d4MeTZpTHQxOoGl
> 3+8OFkUJzqiteo59PP281NW4GCwS63iuRNzGHkpdb14X9SA91MJ0EEU0tcfMbro7
> u7APmH40ID8TqzfW2WQiL4ZlxxoyAIdMT4GkE13wAkxbJWQdEDJ19yfmMX6rtqnn
> lpMKsQFmZC3fyfZ43IuzJEziGcq+QDbltqetmef1kKnoDKTIHE3TX7FldUyIo7Ap
> P2FJWLCJksSm6yKh2O/2
> =5Iz6
> -----END PGP SIGNATURE-----
>