\section{SIP Security Using PGP}
\label{sec:pgp}

\subsection{PGP Authentication Scheme}

The ``pgp'' authentication scheme is based on the model that the client
authenticates itself with a request signed with the client's private
key.  The server can then ascertain the origin of the request if it has
access to the public key, preferably signed by a trusted third party. 
Implementations supporting this scheme {\MUST} implement the definitions
and default algorithms of RFC 2440 \cite{rfc2440} and {\MAY} implement
the older version, based upon PGP 2.6, described in RFC 1991
\cite{rfc1991}.

\subsubsection{The \header{WWW-Authenticate} Response Header}

\begin{syntax}
WWW-Authenticate & = & "WWW-Authenticate" ":" "pgp" pgp-challenge\\
pgp-challenge    & = & 1\# pgp-params\\
pgp-params       & = & realm $|$ pgp-version $|$ pgp-micalgorithm \\
                 &$|$& pgp-pubalgorithm $|$ nonce\\
realm            & = & "realm" "=" realm-value\\
realm-value      & = & quoted-string\\
pgp-version      & = & "version" "=" \\
                 &   & $<$"$>$ digit *( "." digit ) *alpha $<$"$>$\\
pgp-micalgorithm & = & "algorithm" "=" ( "md5" $|$ "sha1" $|$ token\\
                 &   & $|$ "ripemd160" $|$ "MD2" $|$ "TIGER192" $|$ "HAVAL-5-160")\\
pgp-pubalgorithm & = & "pubkey" "=" ( "rsa" $|$ "rsa-encrypt" \\
                 &   & $|$ "rsa-sign" $|$ "elgamal" $|$ "dsa" $|$ token )\\
nonce            & = & "nonce" "=" nonce-value\\
nonce-value      & = & quoted-string
\end{syntax}

The meanings of the values of the parameters used above are as follows:

\begin{description}
\item[\header{realm}:] A string to be displayed to users so they know
which identity to use.  This string {\SHOULD} contain at least the name
of the host performing the authentication and {\MAY} additionally
indicate the collection of users who might have access.  An example
might be ``\texttt{Users with call-out privileges}''.

\item[\header{pgp-micalgorithm}:] The value of this parameter indicates
the PGP message integrity check (MIC) to be used to produce the
signature.  The currently defined values are ``md5'' for the MD5
checksum, and ``sha1'' for the SHA.1 algorithm.  If this parameter is
not present, it is assumed to be ``sha1''. 

\item[\header{pgp-pubalgorithm}:] The value of this parameter indicates
the PGP public-key algorithm to be used for signing and encrypting
messages.  The currently defined values are ``rsa'' for the RSA
algorithm and ``dsa'' for the DSA algorithm.  If this parameter is not
present, it is assumed to be ``dsa''.

\item[\header{pgp-version}:] The version of PGP that the client {\MUST}
use.  Common values are ``2.6.2'' and ``5.0''. The default is 5.0.

\item[\header{nonce}:] A server-specified data string which should be
uniquely generated each time a 401 response is returned.  It is
{\RECOMMENDED} that this string be base64 \cite{rfc2045} or hexadecimal
data.  Specifically, since the string is passed in the header lines as a
quoted string, the double-quote character is not allowed.  The contents
of the nonce are implementation dependent.  The quality of the
implementation depends on a good choice.  Since the nonce is used only
to prevent replay attacks and is signed, a time stamp in units
convenient to the server is sufficient. 

\motivation{Replay attacks within the duration of the call setup are of
limited interest, so that timestamps with a resolution of a few seconds
are often sufficient.  In that case, the server does not have to keep a
record of the nonces.}

\end{description}

Example:
\begin{verbatim}
WWW-Authenticate: pgp version="5.0"
  realm="Your Startrek identity, please", algorithm=md5, 
  nonce="913082051"
\end{verbatim}

\subsubsection{The \header{Authorization} Request Header}

The client is expected to retry the request, passing an
\header{Authorization} header line, which is defined as follows.

\begin{syntax}
Authorization & = & "Authorization" ":" "pgp" \# pgp-response\\
pgp-response  & = & realm $|$ pgp-version $|$ pgp-signature\\
              &   & $|$ signed-by $|$ nonce\\
pgp-signature & = & "signature" "=" quoted-string\\
signed-by     & = & "signed-by" "=" $<$"$>$ URI $<$"$>$\\
\end{syntax}

The client {\MUST} increment the \header{CSeq} header before
resubmitting the request.  The signature {\MUST} correspond to the
\header{From} header of the request unless the \header{signed-by}
parameter is provided.

\begin{description}
\item[\header{pgp-signature}:] The PGP ASCII-armored signature
\cite{rfc1991} and \cite{rfc2440}, as it appears between the ``BEGIN PGP
MESSAGE'' and ``END PGP MESSAGE'' delimiters, without the version
indication.  The signature is included without any linebreaks.

The signature is computed, in order, across the nonce (if present),
realm, request method, request version and header fields following the
\header{Authorization} header and the message body, in the same order as
they appear in the message.  The nonce, realm, request method and
version are prepended to the header fields without any white space.  The
signature is computed across the headers as sent, and the terminating
CRLF.  The CRLF following the \header{Authorization} header is NOT
included in the signature.

UACs {\MAY} attempt to authenticate themselves without a nonce on the
first {\INVITE} request rather than waiting for a 401 response if the
UAC knows, e.g., from past requests or local configuration, that the UAS
supports PGP authentication.  A server {\MAY} be configured not to
generate nonces only if replay attacks are not a concern. 

\motivation{Not generating nonces avoids the additional set of request,
401 response and {\ACK} messages and reduces delay by one round-trip
time.}

\motivation{Using the ASCII-armored version is about 25\% less
space-efficient than including the binary signature, but it is
significantly easier for the receiver to piece together.  Versions of
the PGP program always include the full (compressed) signed text in
their output unless ASCII-armored mode ({\tt -sta}) is specified. 
Typical signatures are about 200 bytes long.  -- The PGP signature
mechanism allows the client to simply pass the request to an external
PGP program.  This relies on the requirement that proxy servers are not
allowed to reorder or change header fields.}

\item[\header{realm}:] The \header{realm} is copied from the
corresponding \header{WWW-Authenticate} header field parameter.

\item[\header{signed-by}:] If and only if the request was not signed by
the entity listed in the \header{From} header, the \header{signed-by}
header indicates the name of the signing entity, expressed as a URI.

\end{description}

Receivers of signed SIP messages {\SHOULD} discard any end-to-end header
fields above the \header{Authorization} header, as they may have been
maliciously added en route by a proxy.

Example:
\begin{verbatim}
Authorization: pgp version="5.0",
  realm="Your Startrek identity, please",
  nonce="913082051",
  signature="iQB1AwUBNNJiUaYBnHmiiQh1AQFYsgL/Wt3dk6TWK81/b0gcNDf
  VAUGU4rhEBW972IPxFSOZ94L1qhCLInTPaqhHFw1cb3lB01rA0RhpV4t5yCdUt
  SRYBSkOK29o5e1KlFeW23EzYPVUm2TlDAhbcjbMdfC+KLFX
  =aIrx"
\end{verbatim}

\subsection{PGP Encryption Scheme}
\label{sec:pgp-encryption}

The PGP encryption scheme uses the following syntax:

\begin{syntax}
Encryption   & = & "Encryption" ":" "pgp" pgp-eparams\\
pgp-eparams  & = & 1\# ( pgp-version $|$ pgp-encoding )\\
pgp-encoding & = & "encoding" "=" "ascii" $|$ token
\end{syntax}

\begin{description}
\item[\header{encoding}:] Describes the encoding or ``armor'' used by
PGP.  The value "ascii" refers to the standard PGP ASCII armor, without
the lines containing ``BEGIN PGP MESSAGE'' and ``END PGP MESSAGE'' and
without the version identifier.  By default, the encrypted part is
included as binary.

\end{description}

Example:
\begin{verbatim}
Encryption: pgp version="2.6.2", encoding="ascii"
\end{verbatim}

\subsection{\header{Response-Key} Header Field for PGP}
\label{sec:pgp-response}

\begin{syntax}
Response-Key & = & "Response-Key" ":" "pgp" pgp-rparams\\
pgp-rparams  & = & 1\# ( pgp-version $|$ pgp-encoding $|$ pgp-key)\\
pgp-key      & = & "key" "=" quoted-string
\end{syntax}

If ASCII encoding has been requested via the \header{encoding}
parameter, the \header{key} parameter contains the user's public key as
extracted from the pgp key ring with the ``pgp -kxa {\it user}''. 

Example:
\begin{verbatim}
Response-Key: pgp version="2.6.2", encoding="ascii", 
  key="mQBtAzNWHNYAAAEDAL7QvAdK2utY05wuUG+ItYK5tCF8HNJM60sU4rLaV+eUnkMk
  mOmJWtc2wXcZx1XaXb2lkydTQOesrUR75IwNXBuZXPEIMThEa5WLsT7VLme7njnx
  sE86SgWmAZx5ookIdQAFEbQxSGVubmluZyBTY2h1bHpyaW5uZSA8c2NodWx6cmlu
  bmVAY3MuY29sdW1iaWEuZWR1Pg==
  =+y19"
\end{verbatim}
