Subject: [AAA-WG]: RE: [Diameter SIP Application] Digest auth-int protection issue

From: <[email-masked]>
Date: Fri, 13 Feb 2004 09:31:15 +0200

Hi,

I haven't followed the RADIUS discussion, so I'm sorry I made more or less redundant proposal.

I'm not very keen on different options for one function and therefore my proposal was little bit too quickly made and the example wasn't the best possible. 

My primary intention was to ask if the SIP-Authentication-Context AVP could be grouped AVP. Then it could carry the Entity-Body-Hash sub-AVP in case of HTTP digest. And if necessary, it could be also extended to carry other sub-AVPs in other cases. I believe this is the same what Wolfgang proposed. 

The definition of the AVP could be then e.g.

SIP-Authentication-Context :: = < AVP Header : TBD >
 					  [ Entity-Body-Hash]	                            
                              * [ AVP ]

Of course, if the SIP-Authentication-Context AVP is seen to have only one dedicated task to carry the digest of entity body, then there is probably no need to specify the SIP-Authentication-Context AVP as grouped AVP.

Regards,
Kalle

> -----Original Message-----
> From: ext Beck01, Wolfgang [mailto:[email-masked]]
> Sent: 12 February, 2004 16:05
> To: Garcia Miguel.An (Nokia-NRC/Helsinki); Tammi Kalle
> (Nokia-NET/Tampere); [email-masked]
> Cc: [email-masked];
> [email-masked]; [email-masked];
> [email-masked]; Rajaniemi Jaakko (Nokia-NET/Espoo);
> [email-masked]
> Subject: AW: [Diameter SIP Application] Digest auth-int 
> protection issue
> 
> 
> 
> 
> Miguel wrote:
> > And this is more or less Wolfang Beck's suggestion as a non 
> desired option...
> 
> > Wolfgang was suggesting just to add a second AVP to carry 
> the digest of the body. 
> > He didn't suggest the grouped AVP though. Wolfgang, any comment?
> 
> Kalle wrote:
> > 
> > Would it be possible to keep it even more clear and define 
> > the SIP-Authentication-Context AVP as grouped AVP, which has 
> > (at least) two possible sub-AVPs; one for the entity-body and 
> > another for the hash of the entity-body? 
> > 
> > E.g.
> > 
> > SIP-Authentication-Context :: = < AVP Header : TBD >
> >                                [ Entity-Body]
> > 					 [ Entity-Body-Hash]	
> >                            
> >                              * [ AVP ]
> I am not strongly opposed to it. But implementors will wonder why
> there are two options for one function. On the other hand, 
> Entity-Body-Hash
> can only contain LHEX characters when using HTTP digest. 
> Entity-Body has to
> allow CR, LF and lot of other characters. Considering the 
> different data types, 
> grouped AVPs make sense. How about this: whether to use Entity-Body or
> Entity-Body-Hash depends on the authentication mechanism being used.
> Eg. when using HTTP digest, SIP-Authentication-Context must contain an
> Entity-Body-Hash AVP carrying the body-digest. 
> 
> Wolfgang
>