SIP can also use certificates for authentication in the same way that web
browsers and servers use them. Acertificateis a digital document that is issued
by a third party, known as a certificate authority(CA), which makes assertions
about a user. For example, a proxy server for the example.comdomain could
use a certificate to assert that it is a valid proxy server for the example.com
domain. If TLS (Transport Layer Security) [4] is used by SIP, the client can
request the certificate of the server. If the certificate received during the TLS
Handshake protocol exchange matches the server the UA wishes to talk to, the
connection has been authenticated.
Self-signed certificates can also be useful in certain situations. For example,
the use of the SIP certificate service [5] allows a UA to generate a self-signed
certificate and upload it to a certificate server. APUBLISH with Event:
credentialis used to upload the certificate, while a SUBSCRIBEwith
Event: credentialis used to retrieve the certificate. Another UA can
retrieve the public key of the UA in a NOTIFY.
Another use of self-signed certificates is when the fingerprint of a self-signed
certificate is exchanged over a secured SIP connection. An SDP attribute exten-
sion a=fingerprintto do this is defined in [6]. Following is an example from
the specification showing a SHA-1 hash of a self-signed certificate:
m=image 54111 TCP/TLS t38
c=IN IP4 192.0.2.2
a=setup:passive
a=connection:new
a=fingerprint:SHA-1 \
4A:AD:B9:B1:3F:82:18:3B:54:02:12:DF:3E:5D:49:6B:19:E5:7C:ABThe TLS connection established with this SDP message will be authenticated
using a self-signed certificate that matches the SHA-1 hash in the fingerprint.
Confidentiality
Confidentialitymakes a message or communications session private. Encryp-
tion can be used to implement confidentiality. If two parties know a secret key,
they can use this key to encrypt messages between them so that any third
party that does not know the key cannot read the message.
SIP can utilize encryption at any layer. For example, a SIP session over an
802.11 wireless LAN employing Wireless Protected Access (WPA) [7] is confi-
dential. However, if the SIP session extends beyond the LAN, then confiden-
tiality may no longer be ensured.
Encryption at the IP layer with IPSec [8] can also be utilized. IPSec can be
established between any two Internet hosts. When used in ESP mode, IPSec
provides confidentiality. IPSec is typically performed by hosts at the operating
system/kernel level. As a result, it is difficult for an application such as SIP to
know if IPSec is in place or not.
SIP Security 163