Subject: [AAA-WG]: RE: [Diameter SIP Application] Digest auth-int protection issue

From: <[email-masked]>
Date: Thu, 12 Feb 2004 15:39:49 +0200

And this is more or less Wolfang Beck's suggestion as a non desired option...

Wolfgang was suggesting just to add a second AVP to carry the digest of the body. He didn't suggest the grouped AVP though. Wolfgang, any comment?

/Miguel

> -----Original Message-----
> From: Tammi Kalle (Nokia-NET/Tampere) 
> Sent: 12 February, 2004 15:24
> To: Garcia Miguel.An (Nokia-NRC/Helsinki); [email-masked]'
> Cc: 'Miguel-Angel Pallares (E-mail)'; 'Mari Carmen Belinchon 
> (E-mail)';
> [email-masked]'; [email-masked]'; Rajaniemi Jaakko
> (Nokia-NET/Espoo); [email-masked]'; [email-masked]'
> Subject: RE: [Diameter SIP Application] Digest auth-int 
> protection issue
> 
> 
> Hi Miguel,
> 
> I think the proposal is reasonable.
> 
> Would it be possible to keep it even more clear and define 
> the SIP-Authentication-Context AVP as grouped AVP, which has 
> (at least) two possible sub-AVPs; one for the entity-body and 
> another for the hash of the entity-body? 
> 
> E.g.
> 
> SIP-Authentication-Context :: = < AVP Header : TBD >
>                                [ Entity-Body]
> 					 [ Entity-Body-Hash]	
>                            
>                              * [ AVP ]
> 
> Regards,
> Kalle 
> 
> > -----Original Message-----
> > From: Garcia Miguel.An (Nokia-NRC/Helsinki) 
> > Sent: 12 February, 2004 14:59
> > To: AAA mailing list (E-mail)
> > Cc: Miguel-Angel Pallares (E-mail); Mari Carmen Belinchon (E-mail);
> > [email-masked]'; [email-masked]'; 
> Rajaniemi Jaakko
> > (Nokia-NET/Espoo); Tammi Kalle (Nokia-NET/Tampere);
> > [email-masked]'; [email-masked]'
> > Subject: [Diameter SIP Application] Digest auth-int protection issue
> > 
> > 
> > Hi:
> > 
> > There has been some discussion in the RADIUS EXT mailing list 
> > about an issue that may affect the Diameter SIP application, 
> > due to Radius compatibility. 
> > 
> > I would like to get your opinion on the way to move forward.
> > 
> > The problem comes from the support of the HTTP Digest 
> > authentication in SIP. If the Digest authentication includes 
> > a quality of protection set to "auth-int", and the Diameter 
> > server is authenticating the SIP user, then the Diameter 
> > server needs to receive the entity-body in order to perform a 
> > hash and authenticate the request. We have defined the 
> > SIP-Authentication-Context AVP in the draft to convey this 
> > information.
> > 
> > As those of you familiar with SIP may know, SIP bodies may be 
> > large in size. They are typically SDP bodies, but could be 
> > XML (read: even larger) if used for, e.g., presence publication.
> > 
> > Radius seems to have a maximum message size of 4k. Therefore, 
> > most likely these bodies may not fit into a RADIUS message. 
> > The proposal in draft-sterman-aaa-sip-01 is that instead of 
> > transferring the whole entity-body, which is not actually 
> > needed, only the hash of the entity-body is sent (if MD5 that 
> > is 128 bits). The SIP server is calculating the hash of the 
> > entity-body and it sends it to the server. This saves 
> > considerable amount of bandwidth and fis into the RADIUS messages.
> > 
> > It has been proposed that we change the semantics of the 
> > SIP-Authentication-Context AVP in the Diameter SIP 
> > application, so that if the authentication mechanism is 
> > Digest with qop=auth-int, then it conveys the hash of the 
> > entity-body rather than the whole body.
> > 
> > I find this proposal attractive, since it would make easier 
> > the interoperability with RADIUS systems. I don't think 
> > anyone should be proposing different incompatible 
> > interoperable mechanisms. Therefore, if I don't hear any 
> > voice against it, I would propose to adopt this proposal in 
> > the next version of the Diameter SIP application draft (to be 
> > submitted soon).
> > 
> > Please, raise your voice if you have some comments.
> > 
> > /Miguel
> > 
> > ---
> > Miguel A. Garcia           tel:+358-50-4804586    
> > Nokia Research Center      Helsinki, Finland
> > 
>