It is my understanding that the authentication during a SIP registration is done through some kind of an MD5 hashing algorithm known as HTTP Digest, and doing a
tcpdump of the actual traffic I've noticed that a
cnonce (client nonce) is used.
The way commonly implemented by service providers and in off-the-shelf server and client software, including softphones like Groundwire by Acrobits on iOS, CSipSimple on Android, and Bria by CounterPath on the desktop, are SIP
REGISTER and related authentication transactions subject to replay attacks? Or could they be, depending on what kind of HTTP Digest authentication is used by the client?
Otherwise, or in addition to this, what kind of other Man in the Middle attacks are possible against SIP registration credentials?