25 Mar
2004
25 Mar
'04
6:31 a.m.
On Wed, 24 Mar 2004, Alex Bligh wrote:
--On 24 March 2004 10:27 -0800 Tom <tom(a)sdf.com>
wrote:
I think UA auth is well understood due to it similarity to HTTP auth.
But how does a SIP server auth itself to a PSTN gateway? Other than
host-based security, how does a PSTN gateway know that it is speaking to a
trusted SIP server?
RFC3072, which covers a number of auth issues, really deals with the
proxy auth, not UA and gateway. RF3329 deals with security between the UA
and the first hop SIP entity.
Tom
DIGEST SIP security.
How does this work?
Short answer: almost identically to HTTP authentication. IE a SIP request
is sent, server replies with "authentication required" plus a a number (the
challenge), the UA responds with a response containing a DIGEST calculation
of the number, and the password. The SIP server then compares the digest
response with its calculated digest based on the number plus the password.
If they are equal, it grants access.
Long answer: read the RFCs
Alex