SIP Security

311

There are three important issues to be considered when a certificate is used for authentication:

1.Is the certificate trustworthy? For example, Web browsers have a list of CAs they inherently trust, and administrators can add additional trusted CAs. A browser will only trust a certificate issued and signed by a CA that is trusted. Otherwise, anyone could make up a certificate and use it for authentication.

2.Is the certificate valid? The certificate signature can be validated using the CA public key, which needs to be stored locally in the browser. Also, the certificate can be checked for revocation or replacement by consulting a certificate revocation list (CRL) or another certificate validation protocol. A certificate also must be checked to ensure that it has not expired.

3.What identity assertion does the certificate make? In its simplest form, the certificate will assert an identity, such as a DNS name, or a business name or address. A certificate issued by a trustworthy CA that is valid can only be used for authentication if the identity assertion matches the context in which the certificate is used. For example, if a Web browser opens a secure Web (https) connection for example.com, and during the TLS handshake receives a certificate asserting the identity of the Web server as example.net, authentication has not succeeded.

While this section has discussed certificates in terms of their common usage in Web browsing, the SIP usage of certificates is similar to the Web usage, and is discussed in Section 14.4.2.

14.2 Threats

A security analysis of a protocol or application is usually done by first compiling a list of threats, then examining how security mechanisms can be used to defend against them. This section will briefly discuss a few of them for SIP. With SIP and Internet communications, two of the biggest threats are denial of service (DOS) and man in the middle (MitM).

Denial of service is an attack by a third party who tries to interrupt service of a protocol or a service. For example, a simple denial of service attack is a packet flood, where an attacker sends a flood of IP packets, which overloads the target. This type of DOS attack is not specific to SIP or Internet communication. When launched from multiple hosts, the attack is called a distributed denial of service attack (DDOS).