Re: draft-kuthan-sip-derive

well, first of all, thank you very much for the positive comments.

secondly -- real is becoming really real :) In Germany, there has been
recently an attack that could have been better absorbed using such
a method, probably at best in combination with others. The attack
is shortly described at http://www.ipcom.at/index.php?id=565. It
was as simple as sending annoying INVITEs around, it is not clear
really what could have been the attack purpose.

In fact, the attack is really trivial: it doesn't try to make
messages appear credible, and any reasonably-configured SIP
server would drop them right away. (none of the domains belongs
to the server, the messages have little variance among them)

The victims' phones would not have been ringing at 3AM if they
tried to verify who is calling them. (even though with so
trivially formed requests a proxy server would drop them even
before reaching the UAS).

-jiri


Henry Sinnreich wrote:
>   The ‘  Dialog Event foR Identity Verification’ is meeting IMO the real 
> need for preventing forged “From” names and has the virtue of simplicity 
> as well.
> It is analog to the email verification which is  successfully deployed 
> throughout the Internet at present.
> 
>   http://www3.ietf.org/proceedings/staging/draft-kuthan-sip-derive-00.txt
> 
> Thanks, Henry
> 
> 
> ------------------------------------------------------------------------
> 
> _______________________________________________
> Sip mailing list  https://www.ietf.org/mailman/listinfo/sip
> This list is for NEW development of the core SIP Protocol
> Use [email protected] for questions on current sip
> Use [email protected] for new developments on the application of sip
_______________________________________________
Sip mailing list  https://www.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email protected] for questions on current sip
Use [email protected] for new developments on the application of sip