e clarity of the specifica- tion. The new structure included a redefinition of the SIP finite state machine (FSM) into three layers: transport, transaction, and transaction user (TU). Additional timers and time-outs were also defined. The core specification also had related topics such as SDP handling and DNS Procedures removed and published as separate specifications RFC 3264 and RFC 3263. This appendix describes some of the key differences between the two RFCs. Many of these differences have been mentioned throughout the book-others have not been mentioned. Some parts of RFC 2543 were removed or deprecated from RFC 3261. In the area of security, HTTP Basic authentication was removed, as it allowed the transport of passwords in the clear (HTTP Digest does not do this and is still supported in RFC 3261). Also deprecated was Pretty Good Privacy (PGP) encryption in favor of S/MIME encryption. PGP had not been implemented and the S/MIME approach is the one currently favored by the IETF to secure bodies end-to-end of the Internet. The Authentication header field (which was used for PGP encryption) was deprecated. The Response-Key and Hide header fields were also deprecated due to security problems associ- ated with their use. SIP: Understanding the Session Initiation Protocol The new RFC also deprecates the use of Via header field loop detection in favor of a required Max-Forwards header field in every request. This is because of the difficulty and processing burden on proxies to parse long sets of Via headers. Perhaps the most major change outside of security relates to the introduc- tion of loose routing concepts in place of the strict routing used with Route headers in RFC 2543. In the old RFC, for example, a request containing three Route headers could only route to those three proxies then to the end point-no deviations were allowed. Also, a Route header could only be built from a received Record-Route header field. In RFC 3261, a request con- taining three loose Route headers must route through those three prox