Subject: [AAA-WG]: RE: [Diameter SIP Application] Digest auth-int protection issue

From: <[email-masked]>
Date: Thu, 12 Feb 2004 15:23:47 +0200

Hi Miguel,

I think the proposal is reasonable.

Would it be possible to keep it even more clear and define the SIP-Authentication-Context AVP as grouped AVP, which has (at least) two possible sub-AVPs; one for the entity-body and another for the hash of the entity-body? 

E.g.

SIP-Authentication-Context :: = < AVP Header : TBD >
                               [ Entity-Body]
					 [ Entity-Body-Hash]	                           
                             * [ AVP ]

Regards,
Kalle 

> -----Original Message-----
> From: Garcia Miguel.An (Nokia-NRC/Helsinki) 
> Sent: 12 February, 2004 14:59
> To: AAA mailing list (E-mail)
> Cc: Miguel-Angel Pallares (E-mail); Mari Carmen Belinchon (E-mail);
> [email-masked]'; [email-masked]'; Rajaniemi Jaakko
> (Nokia-NET/Espoo); Tammi Kalle (Nokia-NET/Tampere);
> [email-masked]'; [email-masked]'
> Subject: [Diameter SIP Application] Digest auth-int protection issue
> 
> 
> Hi:
> 
> There has been some discussion in the RADIUS EXT mailing list 
> about an issue that may affect the Diameter SIP application, 
> due to Radius compatibility. 
> 
> I would like to get your opinion on the way to move forward.
> 
> The problem comes from the support of the HTTP Digest 
> authentication in SIP. If the Digest authentication includes 
> a quality of protection set to "auth-int", and the Diameter 
> server is authenticating the SIP user, then the Diameter 
> server needs to receive the entity-body in order to perform a 
> hash and authenticate the request. We have defined the 
> SIP-Authentication-Context AVP in the draft to convey this 
> information.
> 
> As those of you familiar with SIP may know, SIP bodies may be 
> large in size. They are typically SDP bodies, but could be 
> XML (read: even larger) if used for, e.g., presence publication.
> 
> Radius seems to have a maximum message size of 4k. Therefore, 
> most likely these bodies may not fit into a RADIUS message. 
> The proposal in draft-sterman-aaa-sip-01 is that instead of 
> transferring the whole entity-body, which is not actually 
> needed, only the hash of the entity-body is sent (if MD5 that 
> is 128 bits). The SIP server is calculating the hash of the 
> entity-body and it sends it to the server. This saves 
> considerable amount of bandwidth and fis into the RADIUS messages.
> 
> It has been proposed that we change the semantics of the 
> SIP-Authentication-Context AVP in the Diameter SIP 
> application, so that if the authentication mechanism is 
> Digest with qop=auth-int, then it conveys the hash of the 
> entity-body rather than the whole body.
> 
> I find this proposal attractive, since it would make easier 
> the interoperability with RADIUS systems. I don't think 
> anyone should be proposing different incompatible 
> interoperable mechanisms. Therefore, if I don't hear any 
> voice against it, I would propose to adopt this proposal in 
> the next version of the Diameter SIP application draft (to be 
> submitted soon).
> 
> Please, raise your voice if you have some comments.
> 
> /Miguel
> 
> ---
> Miguel A. Garcia           tel:+358-50-4804586    
> Nokia Research Center      Helsinki, Finland
>