Authentication

SIP provides challenge-based Digest authentication, which is defined in HTTP authentication (RFC 2617^[2]). It challenges one direction between user agent client (UAC) and user agent server (UAS) including registrar, or between user agent (UA) and proxy server.

When UAS, proxy, or registrar receives a request, it may challenge the request to provide the assurance of the originator’s identity. The originator can reply with its credential with encryption (for example, Message Digest Algorithm 5 [MD5]), or reject the challenge. When the credential is received, the server verifies and sends back respective response codes like 401 (Unauthorized) or 200 (OK).