RE: [SIP] DNS SRV and authentication challenges

[adam.roach@ericsson.com]

> -----Original Message-----
> From: Rich Schaaf [mailto:rschaaf@pingtel.com]

  [Description of problem deleted. Synopsis: DNS points to
   two servers with the same q-values; one issues a challenge
   and the other receives the response]
 
> So, if my reading of the spec is correct, the SIP client is behaving
> correctly.  The SIP proxy behavior and DNS configuration also seem
> reasonable.  However, the end result is that the call fails to get set
> up.
> 
> Please let me know if my reasoning is correct and I welcome any
> suggestions on what _should_ happen in this situation.

I would contend that, in these cirucumstances, you would
need to have some sort of coordination between these
"equivalent" nodes. They can share a back-end database
or a deterministic algorithm for generating challenges
based on, say, a synchronized clock.

(I'm not a security expert, so you might want to run
the second idea past someone who has a better idea of
what the implications of a deterministic challenge
algorithm might be if you intend to use it).

/a


_______________________________________________
Sip mailing list
Sip@ietf.org
http://www.ietf.org/mailman/listinfo/sip