 the two communicating parties, extract the existing CMS- detached signatures from the request and response, and put a different CMS- detached signature containing the attacker's certificate (which appears to be a certificate for the correct address-of-record). Both parties will think they have exchanged keys with each other, when in fact they have the public key of the attacker. SSH is open to the similar man-in-the-middle attack on the first exchange of keys; however, it is widely accepted that while SSH is not perfect, it improves the security of connections. The use of key fingerprints can provide some help in SIP applications, just as for SSH. For example, if two end points use SIP to establish a voice communications session, each party reads off the fingerprint of the key they received from the other party which may be compared against an original. It is however more difficult for the man-in-the-middle to emulate the participants voices than their signaling (this practice is used with the Clipper chip-based secure telephone). The S/MIME mechanism allows UAs to send encrypted requests without preamble if they possess a certificate for the destination address-of-record on their key ring [18]. However, it is possible that any particular device registered for an address-of-record will not hold the certificate that has been previously employed by the device's current user, and that it will therefore be unable to process an encrypted request properly, which could lead to some avoidable error signaling. This is especially likely when an encrypted request is forked. The keys associated with S/MIME are most useful when associated with particular user (an address-of-record) rather than a device (a UA). When users © 2009 by Taylor & Francis Group, LLC SIP Security and Quality of Service Performance move between devices, it may be difficult to transport private keys securely between UAs. Another difficulty with the S/MIME mechanism is that it can result in very large messages, especially when SIP tunneling is used. For