I'll agree with you, my point was the original comment was flawed you can't make the requirement stronger, because proxies down the line can't do anything. The authentication in the ACK is nice and if the UAS really wants it a BYE would be the correct answer if it's missing. For proxies to stop ACKs lacking authentication is just plain the wrong thing to do.
No authentication scheme in 3261 allows cut and paste (or trivial modification of) the authentication from INVITE to ACK (just replay of the INVITE). James > -----Original Message----- > From: Jiri Kuthan [mailto:[EMAIL PROTECTED]] > Sent: 25 July 2002 15:33 > To: Shan Lu; James Undery; [EMAIL PROTECTED] > Cc: [EMAIL PROTECTED] > Subject: RE: [Sip] Authentication and ACK > > > [moved to sip-implementers] > > At 03:39 PM 7/25/2002, Shan Lu wrote: > >I don't think hop by hop is a problem. > > I do not think it is a big problem either, as ACKs for negative > replies server primarily a transport role (stop reply > retransmissions). > Not so bad, if someone else makes them stop. > > 200-ACKs are presumably worse, as they can carry more sensitive > information, SDP particularly. > > [...] > > >I agree it is subject to replay attack. But isn't it better > than blindly > >proxy each and every ACK that is received at stateless server ? > > If you are interested in security, you better go for secure transport. > I do not see any great security benefit in copy'n'paste of INVITE's > credentials. > > Note that none of these issues is related to whether a server > is stateful or stateless. > > -Jiri > > _______________________________________________ Sip-implementors mailing list [EMAIL PROTECTED] http://lists.cs.columbia.edu/mailman/listinfo/sip-implementors
