Subject: [AAA-WG]: [Diameter SIP Application] Digest auth-int protection issue

From: <[email-masked]>
Date: Thu, 12 Feb 2004 14:59:12 +0200

Hi:

There has been some discussion in the RADIUS EXT mailing list about an issue that may affect the Diameter SIP application, due to Radius compatibility. 

I would like to get your opinion on the way to move forward.

The problem comes from the support of the HTTP Digest authentication in SIP. If the Digest authentication includes a quality of protection set to "auth-int", and the Diameter server is authenticating the SIP user, then the Diameter server needs to receive the entity-body in order to perform a hash and authenticate the request. We have defined the SIP-Authentication-Context AVP in the draft to convey this information.

As those of you familiar with SIP may know, SIP bodies may be large in size. They are typically SDP bodies, but could be XML (read: even larger) if used for, e.g., presence publication.

Radius seems to have a maximum message size of 4k. Therefore, most likely these bodies may not fit into a RADIUS message. The proposal in draft-sterman-aaa-sip-01 is that instead of transferring the whole entity-body, which is not actually needed, only the hash of the entity-body is sent (if MD5 that is 128 bits). The SIP server is calculating the hash of the entity-body and it sends it to the server. This saves considerable amount of bandwidth and fis into the RADIUS messages.

It has been proposed that we change the semantics of the SIP-Authentication-Context AVP in the Diameter SIP application, so that if the authentication mechanism is Digest with qop=auth-int, then it conveys the hash of the entity-body rather than the whole body.

I find this proposal attractive, since it would make easier the interoperability with RADIUS systems. I don't think anyone should be proposing different incompatible interoperable mechanisms. Therefore, if I don't hear any voice against it, I would propose to adopt this proposal in the next version of the Diameter SIP application draft (to be submitted soon).

Please, raise your voice if you have some comments.

/Miguel

---
Miguel A. Garcia           tel:+358-50-4804586    
Nokia Research Center      Helsinki, Finland