TLS, SRTP, identity, and abuse

Rooms

1. 401, 407, and digest

   A 401 from a UAS is answered with Authorization. A 407 from a proxy is answered with Proxy-Authorization.

2. TLS and domain certificates

   SIP over TLS is RFC 3261 section 18. The certificate has to identify the SIP domain, per RFC 5922.

3. SRTP and two keying methods

   SRTP is RFC 3711. SDES a=crypto is RFC 4568. DTLS-SRTP is RFC 5764. An SBC must not assume peers share one method.

4. Privacy and asserted identity

   Privacy is RFC 3323. P-Asserted-Identity and P-Preferred-Identity are for trusted networks, not cryptographic identity.

5. STIR, PASSporT, and SHAKEN

   STIR is RFC 8224, PASSporT is RFC 8225, certificates are RFC 8226, and the SHAKEN extension is RFC 8588. Attestation levels are ATIS.

6. Scanning, hijack, and toll fraud

   Scanning, registration hijack, and toll fraud are classes of abuse. The response is authentication, exposure control, and alerting.

7. Hardening a SIP edge

   A defensive edge limits peers, requires digest and TLS, strips PAI, and does not share SRTP keying across legs.

Ecosystem

SIP does not replace workforce management, quality monitoring, CRM, emergency policy, or a messaging registry. It is the session seam those systems hang from. Compliance notes on this page are educational and are not legal advice.

Open the map