Re: [SIP] Re: SIP gateways and authentication

[Henning Schulzrinne]

Michael Thomas wrote:
> 

> 
>    I guess I'm missing the huge difference
>    here. Both situations the UAC is somewhat
>    clueless about what credentials it needs
>    to ship for the URI. It can guess, and may
>    do a reasonable job at that, but it looks
>    fundamentally the same to me.

No, this is very different. In the certificate (X.509, S/MIME, PGP)
case, the UAC doesn't need to know anything about the receiver. It
simply sends a cert saying "CA X believes I'm Telephant Telecom. If you
believe CA X, you'll trust that I'm indeed Telephant." For basic and
digest, the UAC has to know

- what user id's are valid at the UAS
- what secrets are associated with those userids.

Generally, a gateway calling a random SIP URL (obtained via enum, say),
would have no clue about any of these.




-- 
Henning Schulzrinne   http://www.cs.columbia.edu/~hgs