Simple discussion of the summary certification

The SIP authentication process originates from HTTP Digest authentication (HTTP Digest authentication), which is a challenge-based security mechanism: When the server receives a request, the initiator of the challenge request is asked to provide the appropriate identity information. The server-issued challenge contains a sequence of generated unique strings that can be used only for this challenge. The requestor and the server share the same password, and the requestor uses the password and the temporarily generated string sequence to get a response value. When the requestor sends a request that contains the response value again, the server can be used to authenticate the request. Using this mechanism, the password can be transmitted in a way that is not plaintext.

Does it feel like a mouthful to read the first time? Look at the picture to speak the most direct (I casually draw, can explain the meaning is good):

1) UAC first sends a SIP request message (such as invite or register) to UAS that does not contain authentication information.
1.2) UAS sends back a SIP message to the client requesting authentication, which represents a challenge. For UAS these values are included in the Www-authentcaite header field.
2) UAC regenerates a request message to UAS based on the challenge information in the message. The message contains authentication information, including the user name and the encryption result response that UAC generates for the Userid,password,nonce,key calculation.
2.1) UAS will receive the respones compared with their own calculations based on the same algorithm, if the same, the return of a 0K message indicates authentication passed.

Of course, the algorithm is ultimately determined, in the application can not completely adhere to the specification of the Digest certification, as long as the summary certification of the 2 steps to achieve the " Challenge " and " password not clear text transmission " effect can be;

Simple discussion of the summary certification