Re: [Sip] Request header integrity in HTTP Digest

[James Undery <jundery@ubiquity.net>]

Corey Gates wrote:

> Jonathan,
>
> I believe you left out the "private-key" in the nonce computation in
> draft-rosenberg-sip-http-pnonce-00.txt.  The nonce should be:
>
> nonce = H(source-IP:<canonicalization of headers to be
> protected>:round-time:private-key)
>
> Without this the nonce could be generated.

I fail to see what you've gained by hashing the password into the nonce,
the nonce is only really
there so the server can be sure the client's messages aren't just being
replayed, the client will hash in the password to provide
authentication. (Obviously this explanation is very simplistic.)

James Undery


_______________________________________________
Sip mailing list
Sip@ietf.org
http://www.ietf.org/mailman/listinfo/sip