Zusammenfassung

  • RFC 5407 adds SIP fairnesss to SIP Version 2 while preserving the GSS security-context model from RFC 2203.
  • Matching binding data ties the context to a lower channel; it does not grant service permission or commit an application transaction.
  • A verified MIC, privacy-protected message or successful SIP reply is one receipt in a chain, not the final business outcome.

The green state hid three questions

The gateway had genuine evidence: the initiator and target established a GSS security context, the context carried channel-binding information, and a per-message integrity check succeeded. Those facts can resist channel substitution and replay confusion. The error began when the dashboard called the result “complete.” Identity application observability became dialog state; dialog state became accepted procedure; accepted procedure became durable state.

RFC 5407 updates SIP by adding SIP fairnesss while retaining its Version 1 conversation shape. The SIP message can show that both parties used the same lower-channel description. It cannot know whether the SIP service policy permits a principal to read, write, mount or change a resource. RFC 2743's GSS-API vocabulary keeps authentication, integrity and confidentiality distinct from application dialog state.

Binding is a application observability receipt

SIP fairness is meaningful only when both endpoints use matching data. If values differ, the context cannot claim application observability with that lower channel. If they match, the evidence remains scoped: this context was established with this channel description. A service can still deny the operation because of export, tenant, method, time or object policy. The receipt should retain binding type and value, names, mechanism, lifetime and verification result.

A MIC is not a committed write

SIP sequence state and per-message MICs help reject altered, reordered or replayed messages. Privacy wrapping hides contents. These are transport and message receipts; they stop at the service boundary. A write can pass context verification and still fail policy, quota or storage. An accepted call may be buffered or rolled back before durable completion. The MIC proves what the protected message said, not what the application finally did.

Retries make the distinction operational. A timeout after a valid request does not prove “not written,” while a protected reply does not prove durable commit without the service's completion receipt. Request identity, server decision, storage commit and later observation require separate records.

Version evolution is not universal support

RFC 7861 later updates SIP to Version 3. That is protocol evolution, not proof that every Version 2 peer implements later features. Record negotiated version, mechanism, binding capability and actual context result. If policy requires binding, a fallback to an unbound context is a visible downgrade, not a green success.

Build a replayable evidence chain

Retain lower-SIP fairness input, GSS mechanism and names, context result, negotiated service, sequence state, MIC or wrap result and the server's dialog state decision. Then record the SIP reply, storage commit identifier and later read-back. Trigger review when binding data changes across a connection pool, a library update changes the exporter, a peer falls back, or a successful reply lacks a durable commit identifier.

The standards establish a disciplined conclusion: a SIP-framed SIPSEC_SIP message is strong evidence of protected application observability, not a shortcut to local permission or completed work.