RE: : ISSUE: SIP application policy considered unmanageable

Miguel Garcia <mailto:[email protected]> supposedly scribbled:

...

> A bit of history. There used to be ONLY one place to generate the
> nonces: the Diameter server.
> 
> But recently (March 2005), there were comments indicating that the
> RADIUS HTTP/SIP authentication draft was supporting another mode of
> operation where the nonces are generated in the RADIUS client. And
> the comment said that in order to provide compatibility with RADIUS,
> the Diameter SIP application had to implement that mode.    

Just a hint: in the IETF, you don't have to pay attention to random, hare-brained comments, no matter from whose mouth the may proceed ;-)
 
> Honestly speaking, I don't like the generation of nonces in the
> Diameter client, BUT, I had to implemented due to those comments. 

I think that it's a Very Bad Idea (TM) from a security POV, since it seems that the Diameter client has no way of determining on its own whether or not the AOR represents a valid user.  I suspect that this "feature" enables a rather nasty DoS attack (against the SIP server, not AAA) that doesn't exist if AORs are vadidated before authentication begins.

> 
> Is it crap? Probably, time will say. Will it be used? Probably not,
> time will say. Does it bring a configuration nightmare, due to the
> required synchronization between the server and the client? Yes. Can
> we improve this nightmare? I don't know how, perhaps removing the
> generation of nonces in the client... But if someone has a better
> proposal, I am able to listen to. I think "compatibility with RADIUS"
> is the driver here.    

If so, that's a problem: IMHO, Diameter "compatibility with RADIUS" has just been a joke for a long, long time.
 
> 
> Now, I essentially agree with your comments, but don't know how to
> change the draft. So, if you have a clear text to add, I will be
> happy to add it.  
> 
> /Miguel

Hope this helps,

~gwz

Why is it that most of the world's problems can't be solved by simply
  listening to John Coltrane? -- Henry Gabriel