\documentclass[11pt]{article}
\usepackage{times}
\usepackage{graphics}
\usepackage{ifthen}
\usepackage{i-d}
%\usepackage{rfc}
\usepackage{html}
\usepackage{txtpsfig}
\usepackage{tight}
\usepackage[dvips]{changebar}

\title{SIP Authentication: The Null Authentication Scheme}
\author{Schulzrinne}
\shorttitle{Null}
\filename{schulzrinne-sip-null}
\wg{SIP WG}
\expires{February 2000}
\address{Columbia U.}
\pubdate{\today}
%\input{rfc}

\newcommand{\motivation}[1]{{\footnotesize\begin{quotation}#1\end{quotation}}}
\newenvironment{syntax}{\begin{quotation}\begin{sf}\begin{tabular}{lcll}}{\end{tabular}\end{sf}\end{quotation}}
\newcommand{\INVITE}{\textsf{INVITE}}
\newcommand{\BYE}{\textsf{BYE}}
\newcommand{\ACK}{\textsf{ACK}}
\newcommand{\CANCEL}{\textsf{CANCEL}}
\newcommand{\OPTIONS}{\textsf{OPTIONS}}
\newcommand{\REGISTER}{\textsf{REGISTER}}
\newcommand{\header}[1]{\textsf{#1}}
\newcommand{\host}[1]{\texttt{#1}}
\newcommand{\MUST}{\textsc{must}}
\newcommand{\MUSTNOT}{\textsc{must not}}
\newcommand{\REQUIRED}{\textsc{required}}
\newcommand{\SHALL}{\textsc{shall}}
\newcommand{\SHALLNOT}{\textsc{shall not}}
\newcommand{\SHOULD}{\textsc{should}}
\newcommand{\SHOULDNOT}{\textsc{should not}}
\newcommand{\MAY}{\textsc{may}}
\newcommand{\OPTIONAL}{\textsc{optional}}
\newcommand{\RECOMMENDED}{\textsc{recommended}}
\newcommand{\NOTRECOMMENDED}{\textsc{not recommended}}

\begin{document}
\maketitle
\begin{abstract}
SIP servers may allow requests without authentication to proceed,
possibly subjecting these unauthenticated requests to different
handling. This memo describes the Null authentication method that
simplifies the provision of such a service. This ``authentication''
scheme may also be useful for other protocols using the RFC 2617
framework.
\end{abstract}

\section{Terminology}
\label{sec:terminology}

In this document, the key words ``{\MUST}'', ``{\MUSTNOT}'',
``{\REQUIRED}'', ``{\SHALL}'', ``{\SHALLNOT}'', ``{\SHOULD}'',
``{\SHOULDNOT}'', ``{\RECOMMENDED}'', ``{\MAY}'', and ``{\OPTIONAL}''
are to be interpreted as described in RFC 2119 \cite{rfc2119} and
indicate requirement levels for compliant SIP implementations.

\section{Null Authentication Scheme}

The ``null'' authentication scheme indicates that the client has no
means of authenticating itself to the server. The ``null''
authentication scheme is considered useful for all protocols that employ
RFC 2617-style authentication, such as SIP \cite{rfc2543}, RTSP
\cite{rfc2326} or HTTP \cite{rfc2617}.

The server will service the request only if no authentication is
required.  It {\SHOULD} indicate to any server logic (such as sip-cgi
\cite{draft-lennox-sip-cgi} or CPL \cite{draft-ietf-iptel-cpl}) that the
request has not been authenticated. 

For Null, the framework in RFC 2617 \cite{rfc2617} is utilized as
follows:

\begin{syntax}
challenge   &=& "Null" realm\\
credentials &=& "Null"\\
\end{syntax}

There are no optional authentication parameters.

\motivation{SIP authentication differs somewhat from the requirements
for web-page authentication.  In some cases, recipients want to allow
requests to reach the call processing logic or recipient even if they
are not authenticated.  However, such unauthenticated requests are then
treated differently by the recipient.  For example, a user might forward
all unauthenticated SIP calls to a secretary or voicemail, or may
disallow such calls during dinner hours.  Given the possibly different
treatment of authenticated and unauthenticated requests, it is useful to
allow the server to challenge the client to obtain available
credentials, yet make it possible for clients to submit requests that
indicate that no credentials are available.  If the client does not have
credentials for the \header{Request-URI}, it then returns the Null
credentials.  The client could also provide the \header{Null}
credentials immediately if it knows that it has no other credentials,
avoiding an extra round-trip delay.

The Null authentication scheme makes it possible for the server to
differentiate between clients that need to be challenged as opposed to
those that have no credentials, without keeping state.

The use of an empty \header{WWW-Authenticate} is not permitted by the
HTTP/1.1 syntax, so an explicit authentication scheme name is needed.}

Examples:
\begin{verbatim}
  WWW-Authenticate: Null
  Authorization: Null
\end{verbatim}

A server {\MAY} indicate that Null authentication is allowed in addition
to ``real'' authentication methods, as in the following example:

\begin{verbatim}
  WWW-Authenticate: Basic realm="Password, if you have it"
  WWW-Authenticate: Null
\end{verbatim}

The Null authentication scheme is the weakest of all authentication
schemes.

\section{Security Considerations}

This ``authentication'' scheme provides no security whatsoever; it only
allows the client to indicate that it has no security credentials.

\section{Author's Address}

\begin{flushleft}
Henning Schulzrinne\\
Dept. of Computer Science\\
Columbia University\\
1214 Amsterdam Avenue\\
New York, NY 10027\\
USA\\
electronic mail: {\sf schulzrinne@cs.columbia.edu}
\end{flushleft}

\bibliographystyle{ieeetr}
\bibliography{string,i-d,rfc}

\input{../copyright}

\end{document}
