SSCA Registration Process 3 — Questions and Answers
Question 1: When a registrar challenges a REGISTER request for credentials, which response code does it return?
- 403 Forbidden
- 401 Unauthorized (Correct answer)
- 407 Proxy Authentication Required
- 400 Bad Request
Correct answer: 401 Unauthorized
A registrar (not a proxy) challenges REGISTER with 401 Unauthorized, which includes a WWW-Authenticate header.
Question 2: Which authentication scheme does SIP define for protecting the REGISTER method?
- Digest Authentication (Correct answer)
- Basic Authentication
- OAuth 2.0
- NTLM
Correct answer: Digest Authentication
RFC 3261 mandates Digest Authentication for SIP, which avoids sending passwords in cleartext by using MD5 hashing.
Question 3: After receiving a 401 challenge, what header does the UA include in its re-submitted REGISTER request?
- WWW-Authenticate
- Proxy-Authorization
- Authorization (Correct answer)
- Authentication-Info
Correct answer: Authorization
The UA places its computed credentials in the Authorization header when responding to a 401 Unauthorized challenge from a registrar.
Question 4: What is the 'nonce' value used for in SIP Digest Authentication during registration?
- It identifies the realm of the registrar
- It is a server-generated random value used to prevent replay attacks (Correct answer)
- It contains the MD5 hash of the user's password
- It specifies the algorithm used for hashing
Correct answer: It is a server-generated random value used to prevent replay attacks
The nonce is a random, server-generated string included in the challenge; including it in the hashed response prevents replaying captured credentials.
Question 5: When a SIP proxy (not the registrar) requires authentication during registration, which response code is sent?
- 401 Unauthorized
- 403 Forbidden
- 407 Proxy Authentication Required (Correct answer)
- 408 Request Timeout
Correct answer: 407 Proxy Authentication Required
407 Proxy Authentication Required is sent by an intermediate proxy that requires credentials, accompanied by a Proxy-Authenticate header.
Question 6: What algorithm does SIP Digest Authentication use by default to compute the credential hash?
- SHA-256
- MD5 (Correct answer)
- SHA-1
- HMAC-SHA1
Correct answer: MD5
RFC 3261 specifies MD5 as the default algorithm for Digest Authentication, though newer RFCs support SHA-256.
Question 7: In SIP Digest Authentication, the 'realm' parameter in the WWW-Authenticate header serves what purpose?
- It specifies the encryption key for the session
- It tells the UA which user credential set to use for the challenge (Correct answer)
- It lists the supported authentication algorithms
- It provides the registrar's IP address
Correct answer: It tells the UA which user credential set to use for the challenge
The realm identifies the protection space (usually the SIP domain) so the UA knows which stored username/password to apply.
SSCA Registration Process 3
When a registrar challenges a REGISTER request for credentials, which response code does it return?