all-ID but an incremented CSeq count. User agent, redirect, or registrar servers typically use 401 Unauthorized response to challenge authentication containing a WWW-Authenticate header field, and expect the a new INVITE to contain an Authorization header field containing the user agent's credentials. A user agent's credentials are usually an encrypted username and password, as in the example of Section 10.1. The Authentication-1 Info header field also allows a user agent to authenticate a proxy server using HTTP Digest. However, HTTP Digest does not provide integrity protection-for this, TLS or S/MIME must be used. A call flow involving both proxy and user agent authentication is shown in Figure 3.7. If TLS is used as transport, as discussed in Section 2.5.3, the two servers can exchange and verify certificates for authentication. 2. The ability to forge From header fields is present in SMTP, where it is virtually a feature. A preference setting in an e-mail program sets your name and e-mail address, which need not correspond to the address or domain that is used to send the message. This allows a user to send multiple e-mail addresses from the same e-mail account by simply changing the From address before sending a message. Only a detailed examination of a full set of SMTP header fields will show that the e-mail was sent from another address. SIP Clients and Servers Stateful proxy INVITE 407 Proxy-authorization required Proxy-authenticate: 1 INVITE INVITE Authorization: 1 100 Trying 401 Unauthorized 401 Unauthorized WWW-Authenticate: 2 WWW-Authenticate: 2 INVITE INVITE Authorization: 1, 2 Authorization: 2 100 Trying 200 OK 200 OK Authorization: 1, 2 Authorization: 2 Media session Figure 3.7 Digest authentication call flow. 3.9 S/MIME Encryption While authentication is used as a means of access control and identity confirma- tion, encryption is used for privacy. SIP messages intercepted during session setup reveal considerable information, including: Both parties' SIP URIs and IP addresses; The fact that the two