SIP 401 and 407 digest authentication challenges

See also

Sources

1. 1
   In the RFC 3665 two-proxy call flow the proxy challenges the INVITE with 407 and Proxy-Authenticate, the caller ACKs the 407, then resends INVITE with CSeq 2, a new Via branch and Proxy-Authorization.

   RFC 3665: Session Initiation Protocol (SIP) Basic Call Flow Examples · Section 3.2 Session Establishment Through Two Proxies, messages F1-F4 · Checked 2026-10-14
2. 2
   The RFC 3665 registration example challenges an unauthenticated REGISTER with 401 and WWW-Authenticate, after which the UA resends REGISTER with CSeq 2 and an Authorization header and receives 200 OK.

   RFC 3665: Session Initiation Protocol (SIP) Basic Call Flow Examples · Section 2.1 Successful New Registration, messages F1-F4 · Checked 2026-10-14
3. 3
   An element positioned as a proxy that challenges with 401 is either acting as a UAS or registrar for that request or is not following RFC 3261, which reserves 407 for proxies.inferred

   RFC 3261 — SIP: Session Initiation Protocol · Section 22.1 Framework; Section 21.4.2 · Checked 2026-10-14
4. 4
   RFC 3261 defines 401 Unauthorized as the response issued by user agent servers and registrars when a request requires user authentication; proxies use 407 for the same purpose.

   RFC 3261 — SIP: Session Initiation Protocol · Section 21.4.2 401 Unauthorized · Checked 2026-10-14
5. 5
   If an authenticated user is not authorized to modify the registration bindings, the registrar MUST return 403 Forbidden rather than a further challenge.

   RFC 3261 — SIP: Session Initiation Protocol · Section 10.3 Processing REGISTER Requests, step 4 · Checked 2026-10-14
6. 6
   RFC 3261 defines 407 Proxy Authentication Required as meaning the client must first authenticate itself with the proxy before the request can proceed.

   RFC 3261 — SIP: Session Initiation Protocol · Section 21.4.8 407 Proxy Authentication Required · Checked 2026-10-14
7. 7
   On receiving a 401 or 407, a UAC SHOULD follow the procedures of RFC 3261 sections 22.2 and 22.3 and retry the request with credentials.

   RFC 3261 — SIP: Session Initiation Protocol · Section 8.1.3.5 Processing 4xx Responses · Checked 2026-10-14
8. 8
   In digest the A1 input to the response hash is username, realm and password joined by colons, and A2 is the request method and request-URI (plus a body hash for auth-int).

   RFC 7616: HTTP Digest Access Authentication · Sections 3.4.2 A1 and 3.4.3 A2 · Checked 2026-10-14
9. 9
   If a UAC cannot answer any of the digest challenges it received, RFC 8760 says it SHOULD abandon the request unless local policy suggests a non-Digest mechanism.

   RFC 8760: The Session Initiation Protocol (SIP) Digest Access Authentication Scheme · Section 2.4 UAC Behavior · Checked 2026-10-14
10. 10
    Servers MUST NOT challenge an ACK, and credentials in an INVITE that a server accepted MUST be accepted by that server for the ACK.

    RFC 3261 — SIP: Session Initiation Protocol · Section 22.1 Framework · Checked 2026-10-14
11. 11
    A UAC with no credentials for a challenge MAY retry with the username anonymous and an empty password.

    RFC 3261 — SIP: Session Initiation Protocol · Sections 22.2 and 22.3 · Checked 2026-10-14
12. 12
    Asterisk's default digest algorithms for both UAC and UAS use are MD5 only; SHA-256 and SHA-512-256 must be enabled through supported_algorithms or the global default_auth_algorithms options.

    res_pjsip - Asterisk Documentation · auth object: supported_algorithms_uac and supported_algorithms_uas; global object: default_auth_algorithms_uac and default_auth_algorithms_uas · Checked 2026-10-14
13. 13
    Asterisk outbound registration option auth_rejection_permanent defaults to yes, so after an authentication rejection registration is not attempted again until configuration reload unless fatal_retry_interval is set.

    res_pjsip_outbound_registration: SIP resource for outbound registrations · registration object: auth_rejection_permanent and fatal_retry_interval options · Checked 2026-10-14
14. 14
    When Asterisk issues a challenge and the auth section has no realm, it uses the global default_realm, whose default value is asterisk.

    res_pjsip - Asterisk Documentation · global object: default_realm option; auth object: realm option · Checked 2026-10-14
15. 15
    In Asterisk PJSIP the endpoint outbound_auth option names the auth sections used to answer authentication challenges, while the auth option names those used to challenge inbound requests.

    res_pjsip - Asterisk Documentation · endpoint object: auth and outbound_auth options · Checked 2026-10-14
16. 16
    Asterisk auth sections can hold precomputed password_digest values pairing an algorithm (MD5, SHA-256 or SHA-512-256) with a hash of username, realm and password instead of a plaintext password.

    res_pjsip - Asterisk Documentation · auth object: password_digest option · Checked 2026-10-14
17. 17
    For outbound use an Asterisk auth section's realm must match the server's realm, or be blank or a single asterisk to use whatever realm the server sends; for inbound it is the realm Asterisk puts in WWW-Authenticate.

    res_pjsip - Asterisk Documentation · auth object: realm option · Checked 2026-10-14
18. 18
    WWW-Authenticate, Authorization, Proxy-Authenticate and Proxy-Authorization are exceptions to header-row combining: multiple values MUST NOT be combined into one header field row.

    RFC 3261 — SIP: Session Initiation Protocol · Section 7.3.1 Header Field Format · Checked 2026-10-14
19. 19
    SIP servers MUST NOT challenge with, or accept credentials using, the HTTP Basic authorization scheme; Digest is the HTTP authentication scheme SIP uses.

    RFC 3261 — SIP: Session Initiation Protocol · Section 22 Usage of HTTP Authentication (introductory text) · Checked 2026-10-14
20. 20
    Servers MUST NOT challenge CANCEL requests because CANCEL is hop-by-hop and cannot be resubmitted.

    RFC 3261 — SIP: Session Initiation Protocol · Section 22.1 Framework; Section 9.2 Server Behavior (CANCEL) · Checked 2026-10-14
21. 21
    SIP digest authentication is disabled by default on Cisco IOS voice gateways until an authentication command is configured on a dial peer or under sip-ua.

    Cisco IOS Voice Command Reference - A through C - A · authentication (dial peer) and authentication (SIP UA): Command Default · Checked 2026-10-14
22. 22
    Cisco IOS allows one authentication username per dial peer (or one globally under sip-ua) with up to five password or realm entries for that username.

    Cisco IOS Voice Command Reference - A through C - A · authentication (dial peer) and authentication (SIP UA): Usage Guidelines · Checked 2026-10-14
23. 23
    On Cisco IOS voice gateways the authentication command's realm keyword is optional: without it the password applies to all realms that challenge, and with it the username and password are valid only for that realm.

    Cisco IOS Voice Command Reference - A through C - A · authentication (dial peer) and authentication (SIP UA): Usage Guidelines · Checked 2026-10-14
24. 24
    The Cisco IOS authentication (SIP UA) command is also available in voice class tenant configuration, from 15.6(2)T and IOS XE Denali 16.3.1.

    Cisco IOS Voice Command Reference - A through C - A · authentication (SIP UA): Command Modes; Command History · Checked 2026-10-14
25. 25
    On Cisco IOS XE, removing the AES primary key makes type 6 digest passwords undecryptable, which may cause authentication failures for calls and registrations.

    Cisco IOS Voice Command Reference - A through C - A · authentication (SIP UA): Usage Guidelines · Checked 2026-10-14
26. 26
    RFC 8760 warns that offering multiple digest algorithms opens the door to downgrade attacks toward the weaker algorithm.

    RFC 8760: The Session Initiation Protocol (SIP) Digest Access Authentication Scheme · Section 3 Security Considerations · Checked 2026-10-14
27. 27
    When forked branches return multiple 401 or 407 challenges, the forking proxy is responsible for aggregating them into a single response to the UAC.

    RFC 3261 — SIP: Session Initiation Protocol · Section 22.3 Proxy-to-User Authentication · Checked 2026-10-14
28. 28
    When a digest challenge omits the algorithm parameter, MD5 is assumed.

    RFC 7616: HTTP Digest Access Authentication · Section 3.3, algorithm parameter · Checked 2026-10-14
29. 29
    RFC 8760 treats MD5 as obsolete, retained only for backward compatibility, and states its use is NOT RECOMMENDED.

    RFC 8760: The Session Initiation Protocol (SIP) Digest Access Authentication Scheme · Section 3 Security Considerations · Checked 2026-10-14
30. 30
    A server MAY send multiple challenges; challenges sharing a realm MUST each use a different digest algorithm and be ordered with the most preferred algorithm at the top.

    RFC 8760: The Session Initiation Protocol (SIP) Digest Access Authentication Scheme · Section 2.3 UAS Behavior · Checked 2026-10-14
31. 31
    The digest nc (nonce count) is the client's running count of requests sent with a nonce, starting at 00000001, and lets the server detect request replays.

    RFC 7616: HTTP Digest Access Authentication · Section 3.4 The Authorization Header Field, nc parameter · Checked 2026-10-14
32. 32
    RFC 3261 states that SIP Digest provides message authentication and replay protection only, without message integrity or confidentiality.

    RFC 3261 — SIP: Session Initiation Protocol · Section 22 Usage of HTTP Authentication (introductory text) · Checked 2026-10-14
33. 33
    A UAC MUST NOT re-attempt a request with credentials that were just rejected, though it may retry if the rejection was because the nonce was stale.

    RFC 3261 — SIP: Session Initiation Protocol · Section 22.1 Framework · Checked 2026-10-14
34. 34
    The opaque value supplied by the server in a challenge should be returned unchanged by the client in subsequent Authorization headers for the same protection space.

    RFC 7616: HTTP Digest Access Authentication · Section 3.3, opaque parameter · Checked 2026-10-14
35. 35
    Under RFC 3261 a proxy MUST NOT challenge with 401; registrars and redirect servers MAY use 401, and proxies challenge with 407 instead.

    RFC 3261 — SIP: Session Initiation Protocol · Section 22.1 Framework · Checked 2026-10-14
36. 36
    A proxy issuing 407 MUST populate it with a Proxy-Authenticate header field, and the UAC answers with a Proxy-Authorization header field.

    RFC 3261 — SIP: Session Initiation Protocol · Section 22.3 Proxy-to-User Authentication · Checked 2026-10-14
37. 37
    A Proxy-Authorization value MUST NOT be consumed by any proxy whose realm does not match the realm parameter in that value.

    RFC 3261 — SIP: Session Initiation Protocol · Section 22.3 Proxy-to-User Authentication · Checked 2026-10-14
38. 38
    Credentials supplied to a proxy MUST NOT be cached across dialogs, except for the realm of the UA's configured outbound proxy; caching within a Call-ID is recommended.

    RFC 3261 — SIP: Session Initiation Protocol · Section 22.3 Proxy-to-User Authentication · Checked 2026-10-14
39. 39
    Proxies MUST NOT add values to the Proxy-Authorization header field, and 407 responses MUST be forwarded upstream toward the UAC.

    RFC 3261 — SIP: Session Initiation Protocol · Section 22.3 Proxy-to-User Authentication · Checked 2026-10-14
40. 40
    SIP servers MUST always send a qop parameter in WWW-Authenticate and Proxy-Authenticate values, and a client that receives qop MUST send qop in its resulting authorization header.

    RFC 3261 — SIP: Session Initiation Protocol · Section 22.4 The Digest Authentication Scheme, item 8 · Checked 2026-10-14
41. 41
    RFC 3261 requires realm strings to be globally unique and recommends they be human-readable.

    RFC 3261 — SIP: Session Initiation Protocol · Section 22.1 Framework · Checked 2026-10-14
42. 42
    In SIP digest the realm string alone defines the protection domain, so credentials are selected by realm.

    RFC 3261 — SIP: Session Initiation Protocol · Section 22.1 Framework · Checked 2026-10-14
43. 43
    A fresh 401 or 407 returned to a request that already carried credentials, without stale=true, points to rejected credentials (username, password or realm) rather than nonce expiry.inferred

    RFC 7616: HTTP Digest Access Authentication · Section 3.3, stale parameter (read with RFC 3261 section 22.1) · Checked 2026-10-14
44. 44
    A SIP registrar SHOULD authenticate the UAC sending a REGISTER; absent any mechanism it MAY take the From address as the asserted identity.

    RFC 3261 — SIP: Session Initiation Protocol · Section 10.3 Processing REGISTER Requests, step 3 · Checked 2026-10-14
45. 45
    When a UAC resubmits a request with credentials after a 401 or 407, it MUST increment the CSeq header field value.

    RFC 3261 — SIP: Session Initiation Protocol · Section 22.2 User-to-User Authentication · Checked 2026-10-14
46. 46
    RFC 7616 obsoletes RFC 2617 for digest access authentication while remaining generally backward compatible with it.

    RFC 7616: HTTP Digest Access Authentication · Document header (Obsoletes: 2617); Section 1 · Checked 2026-10-14
47. 47
    RFC 8760 (March 2020) updates RFC 3261 to add SHA-256 and SHA-512/256 as SIP digest algorithms and allows any algorithm in the RFC 7616 hash-algorithm registry.

    RFC 8760: The Session Initiation Protocol (SIP) Digest Access Authentication Scheme · Abstract; Sections 2 and 2.1 · Checked 2026-10-14
48. 48
    A challenge with stale=true means the nonce was invalid but the username and password were valid, so the client may retry with a new response without asking the user again.

    RFC 7616: HTTP Digest Access Authentication · Section 3.3 The WWW-Authenticate Response Header Field, stale parameter · Checked 2026-10-14
49. 49
    Twilio error 32212 (SIP: Registration Authentication problem) is logged when an endpoint tries to register to a SIP Domain with no credential list mapped to Registration Authentication.

    32212: SIP: Registration Authentication problem · Possible causes; Possible solutions · Checked 2026-10-14
50. 50
    A Twilio SIP Domain needs at least an IP access control list or a credential list, and when both are configured both are enforced.

    Inbound - Sending SIP to Twilio · Authentication section · Checked 2026-10-14
51. 51
    When a credential list is configured on a Twilio SIP Domain, inbound SIP INVITEs to Twilio are challenged with 407 Proxy Authentication Required.

    Inbound - Sending SIP to Twilio · Credential Lists section · Checked 2026-10-14
52. 52
    Twilio stores credential-list passwords MD5-hashed per the digest specification rather than in cleartext, and a stored password cannot be retrieved.

    Inbound - Sending SIP to Twilio · Credential Lists section · Checked 2026-10-14
53. 53
    Twilio credential-list passwords must be at least 12 characters with mixed case and at least one digit.

    SIP Security · Digest Authentication section · Checked 2026-10-14
54. 54
    Twilio authenticates SIP endpoint REGISTER requests against the credential lists mapped to the SIP Domain for registration, and the endpoint username must exactly match a credential-list username.

    SIP registration · SIP Endpoint Registration Authentication section · Checked 2026-10-14
55. 55
    A UAC SHOULD cache credentials it supplied, keyed by the To header field value and the realm, for reuse on later requests to that destination.

    RFC 3261 — SIP: Session Initiation Protocol · Section 22.2 User-to-User Authentication · Checked 2026-10-14
56. 56
    When a UAC is challenged for a realm it has no credentials for, it SHOULD render the realm parameter value to the user.

    RFC 3261 — SIP: Session Initiation Protocol · Section 22.1 Framework · Checked 2026-10-14
57. 57
    Facing several challenges for one realm, a UAC SHOULD answer the topmost one whose algorithm it supports, and MUST ignore challenges it does not understand.

    RFC 8760: The Session Initiation Protocol (SIP) Digest Access Authentication Scheme · Section 2.4 UAC Behavior · Checked 2026-10-14
58. 58
    Because the realm is hashed into A1, a client that computes its response with a different realm than the challenge carried produces a response the server rejects even when the password is correct.inferred

    RFC 7616: HTTP Digest Access Authentication · Sections 3.4.1-3.4.2 (response and A1 computation) · Checked 2026-10-14
59. 59
    A 401 response MUST carry a WWW-Authenticate header field, and the UAC answers it with an Authorization header field.

    RFC 3261 — SIP: Session Initiation Protocol · Section 22.2 User-to-User Authentication · Checked 2026-10-14

Documents

Cite this page

WarmTransfer. (2026, October 14). SIP 401 and 407 digest authentication challenges. WarmTransfer. https://warmtransfer.net/knowledge/sip-401-407-digest-auth

@misc{warmtransfer-sip-401-407-digest-auth,
  title  = {SIP 401 and 407 digest authentication challenges},
  author = {{WarmTransfer}},
  year   = {2026},
  url    = {https://warmtransfer.net/knowledge/sip-401-407-digest-auth},
  note   = {Verified 2026-10-14}
}