"So," figures I, "really should have at least some user authentication in the SIP server." Little did I realise that the Twisted code, while it supports authentication quite simply on the server, doesn't seem to have any code on the client side.

That is, the server can handle a client that knows how to authenticate, but there's no code for taking a challenge and generating a response with given credentials AFAICS. Apparently I need to be able to generate a "cnonce" (I gather a seed for the hash) on the client side. No idea what it's actually supposed to be, though.

All of the test cases for the client code are hard-coded. Nothing actually calculates a response to a challenge :( .