ides the best means to preserve the confi- dentiality of signaling as it can also guarantee that messages are not modified by any malicious intermediaries. However, SIP requests and responses cannot be naively encrypted end-to-end in their entirety because message fields such as the Request-URI, Route, and VIA need to be visible to proxies in most net- work architectures SO that SIP requests are routed correctly. Note that proxy servers also need to modify some features of messages (such as adding VIA header field values) in order for SIP to function. Therefore the trust levels on proxy servers must be high. For this purpose, low-layer security mechanisms for SIP are recommended. Low-layer security mechanisms encrypt the entire SIP requests or responses on the wire on a hop-by-hop basis. They also allow endpoints to verify the identity of proxy servers to whom they send requests. SIP components also need to identify one another in a secure manner. When an SIP endpoint provides the identity of its user to a peer UA or to a proxy server, that identity should be verifiable. A cryptographic authentica- tion mechanism is used in SIP to address this requirement. An independent security mechanism for the body for an IP message provides an alternative means of end-to-end mutual authentication. It also provides a limit on the degree to which user agents must trust intermediaries. 22.3.4.2.1 Network layer security mechanisms In transport or net- work layer security, the signaling traffic is encrypted, guaranteeing message confidentiality and integrity. Often, certificates are used for establishing lower- layer security. The certificates may also be used to provide a means of authen- tication. Two popular alternatives for providing security at the transport and net- work layer are, respectively, TLS [14] and IPSec [15]. IPSec is a set of network- layer protocol tools that collectively can be used as a secure replacement for traditional IP. IPSec is most commonly used in architectures in which a set of hosts or administrativ