Are SIP REGISTER transactions w/ HTTP Digest subject to replay attacks?

Question

It is my understanding that the authentication during a SIP registration is done through some kind of an MD5 hashing algorithm known as HTTP Digest, and doing a tcpdump of the actual traffic I've noticed that a cnonce (client nonce) is used.

The way commonly implemented by service providers and in off-the-shelf server and client software, including softphones like Groundwire by Acrobits on iOS, CSipSimple on Android, and Bria by CounterPath on the desktop, are SIP REGISTER and related authentication transactions subject to replay attacks? Or could they be, depending on what kind of HTTP Digest authentication is used by the client?

Otherwise, or in addition to this, what kind of other Man in the Middle attacks are possible against SIP registration credentials?

Answer 1

The digest authentication, described in RFC 2617 (it's for HTTP but SIP uses the exact same flow) is safe against repeat attacks.
The cnonce (client nonce) value and more importantly - the nonce value are what makes the message appear different every time it is transmitted.
As for man in the middle - it is safe from this sort of attack but if your clients support basic authentication (plain text) they can be tricked by a man in the middle to send clear text passwords.
Most clients do not allow basic authentication.
Additionally, poorly written servers that do not change the nonce value or use a preconfigured set of nonce values are exposed to repeat attack, but since it's a very simple task to create a nonce - I doubt if such poorly written servers exist.
The biggest cavity of digest authentication is that the server needs to be able to retrieve the unencrypted password in order to verify the response (the password is not transmitted outside the server though).

Answer 2

The only redeeming quality of HTTP digest over sending just the password as is (or a hash thereof) is precisely to resist basic replay attacks. That's the point of the nonce sent by the server: the attacker cannot replay an old message for a new connection because the server will use another nonce value.

A man-in-the-middle laughs at HTTP digest, or just anything with plain HTTP. By definition, a MitM is in position to hijack the data streams at any point. The only thing that HTTP digest offers here is that the MitM will have to hijack a connection every time he wants to play with the server; the attacker does not directly learn the password. However, the attacker learns a simple hash value computed over the concatenation of known values, and the password, so he will be able to "try passwords" at home, at a rate of several billions per second if he has a couple good GPU; very few human-chosen passwords resist such treatment.