Subject: Re: [sipcore] I-D Action: draft-ietf-sipcore-digest-scheme-03.txt - the challenge failure issue

From: Christer Holmberg <[email-masked]>
Date: Mon, 27 May 2019 06:35:15 +0000

Hi,

>When I said "proxy" I was thinking of both registrar and proxy.
>But I agree with you that these are obscure use cases that better left for a local policy to deal with.

I agree.

But, I want to more clearly point out that it can happen, what the possible implications are, and that the actions taken are based to local policy.

Regards,

Christer

On Sun, May 26, 2019 at 9:57 PM Paul Kyzivat <[email-masked]<mailto:[email-masked]>> wrote:
On 5/26/19 7:33 PM, Rifaat Shekh-Yusef wrote:
>
>
> On Sun, May 26, 2019 at 6:16 PM Paul Kyzivat <[email-masked]<mailto:[email-masked]>
> <mailto:[email-masked]<mailto:[email-masked]>>> wrote:
>
>     On 5/26/19 3:08 PM, Christer Holmberg wrote:
>      > Hi,
>      >
>      > ...
>      >
>      > Q4:
>      >
>      >>> Section 2.4 says:
>      >>>
>      >>> “If the UAC cannot respond to any of the challenges in the
>     response,
>      >>> then it should abandon attempts to send the request; e.g., if
>     the UAC
>      >>> does not have credentials for any of the realms.”
>      >>>
>      >>> What if it is a mid-dialog request, e..g., a BYE? If the actions
>     taken by the UAC are based on local policy, it would be good to say so.
>      >>
>      >> Is this a real use case?
>      >> If the UAC was able to establish a call then it must already
>     have the needed credentials and should be able to terminate the call.
>      >
>      > It is allowed to challenge a mid-dialog request. Whether it's
>     allowed to require new credentials mid-dialog I don't know.
>
>     Certainly credentials can expire mid-dialog.
>
>
> Why would a proxy challenge a mid-dialog request when the proxy knows
> that the UAC's credentials has expired?

I was thinking of the credentials at the UAS expiring. But I suppose it
could happen for Proxy-Authenticate as well.

It *is* unusual for a non-registrar UAS requiring credentials, but it is
possible.

>     I see no reason why they
>     can't also change mid-dialog, resulting in failure of the cached
>     credentials and a new challenge.
>
> This could happen today with the existing digest mechanism. Is there an
> existing recommendations for how to deal with such a use case?
> I guess one way to deal with this is for the proxy to accept the old
> credentials for mid-dialog requests, but require the new credentials for
> any new dialog initiating requests.

I'm not aware of any recommendations in this regard. I think it falls
into the realm of policy.

Again, I don't know why you are bringing up proxies.

But these are all somewhat obscure cases based on current practice.

        Thanks,
        Paul