IETF Logo Mail Archive

Re: [BEHAVE] FW: New Version Notification for draft-reddy-behave-turn-auth-00.txt

Simon Perreault <simon.perreault@viagenie.ca> Wed, 24 April 2013 08:23 UTC

Return-Path: <simon.perreault@viagenie.ca>
X-Original-To: behave@ietfa.amsl.com
Delivered-To: behave@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9DC9E21F8F0F for <behave@ietfa.amsl.com>; Wed, 24 Apr 2013 01:23:46 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.135
X-Spam-Level:
X-Spam-Status: No, score=-2.135 tagged_above=-999 required=5 tests=[AWL=0.465, BAYES_00=-2.599, NO_RELAYS=-0.001]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wBpy0y8mxmKn for <behave@ietfa.amsl.com>; Wed, 24 Apr 2013 01:23:46 -0700 (PDT)
Received: from jazz.viagenie.ca (jazz.viagenie.ca [IPv6:2620:0:230:8000::2]) by ietfa.amsl.com (Postfix) with ESMTP id ED8AA21F8F1E for <behave@ietf.org>; Wed, 24 Apr 2013 01:23:45 -0700 (PDT)
Received: from [IPv6:::1] (unknown [IPv6:2001:660:3001:4012:75b7:d54f:7e76:34ca]) by jazz.viagenie.ca (Postfix) with ESMTPSA id 62AB640432 for <behave@ietf.org>; Wed, 24 Apr 2013 04:23:44 -0400 (EDT)
Message-ID: <5177968F.6050805@viagenie.ca>
Date: Wed, 24 Apr 2013 10:23:43 +0200
From: Simon Perreault <simon.perreault@viagenie.ca>
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/20130328 Thunderbird/17.0.5
MIME-Version: 1.0
To: behave@ietf.org
References: <913383AAA69FF945B8F946018B75898A149778C5@xmb-rcd-x10.cisco.com>
In-Reply-To: <913383AAA69FF945B8F946018B75898A149778C5@xmb-rcd-x10.cisco.com>
Content-Type: text/plain; charset="ISO-8859-1"; format="flowed"
Content-Transfer-Encoding: 8bit
Subject: Re: [BEHAVE] FW: New Version Notification for draft-reddy-behave-turn-auth-00.txt
X-BeenThere: behave@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: mailing list of BEHAVE IETF WG <behave.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/behave>, <mailto:behave-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/behave>
List-Post: <mailto:behave@ietf.org>
List-Help: <mailto:behave-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/behave>, <mailto:behave-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 24 Apr 2013 08:23:47 -0000

Le 2013-04-24 05:22, Tirumaleswar Reddy (tireddy) a écrit :
> This draft discusses some of the problems with current TURN authentication so that it can serve as the basis for stronger TURN authentication mechanisms.
>
> comments and suggestions are welcome.

And here are some...

- "TURN authentication" doesn't exist. It's "STUN authentication" that 
you're talking about. TURN just uses STUN auth.

- In section "4. Problems with TURN Authentication", what's the 
difference between problems 1 and 2?

- Problem 4 could also include the REALM attribute, which could be 
snooped and harvested similarly.

- About the above: wasn't this all well known and accepted at the time 
STUN auth was being designed?

- I have encountered another problem: it's impossible to host multiple 
realms on a single IP address. When the server needs to send the REALM 
attribute in response to an unauthenticated request, it has no useful 
information for determining which realm it should send, except the 
destination address of the request. This sucks, IPv4 addresses being not 
exactly free...

I'm very interested in hearing about any solution you may have in mind...

Simon

v2.23.0 | Report a Bug | By Email