Re: [BEHAVE] errata 4933: RFC 5766 prevent spoofed refresh requests when using short-term credentials

Both a/b seem sensible to me.

On Thu, Jan 16, 2020 at 5:27 PM Michael Richardson <mcr+ietf@sandelman.ca>
wrote:

>
> https://www.rfc-editor.org/errata_search.php?eid=4933
>
>     4933> Section 17.3.3 says:
>
>     4933> An attacker might attempt to disrupt service to other users of
> the
>     4933> TURN server by sending Refresh requests or CreatePermission
> requests
>     4933> that (through source address spoofing) appear to be coming from
>     4933> another user of the TURN server.  TURN prevents this by requiring
>     4933> that the credentials used in CreatePermission, Refresh, and
>     4933> ChannelBind messages match those used to create the initial
>     4933> allocation.  Thus, the fake requests from the attacker will be
>     4933> rejected.
>     4933> Notes:
>
>     4933> When using short-term, credentials expire after a specific
> amount of time
>     4933> (such as 5
>     4933> minutes) and clients get new credentials. The restriction
> imposed at section
>     4933> 17.3.3
>     4933> prevents from refreshing allocation or permission using the new
> credentials.
>
>     4933> This RFC approves RFC 5389. So one can use short-term
> credentials. But
>     4933> short-term credentials are useless if it can not be used to
> refresh
>     4933> allocation or permission.
>
>     4933> The goal of 17.3.3 can be achieved by sending 438 with the new
> nonce.
>
> a) I think we should accept this as verified.
> b) It seems that sending with the new nonce will work.  This requires some
>    text changes, and we can now perhaps use the errata patcher with XML.
>    I've asked for the XML (if there is any), and I'll suggest some changes
> to
>    the text.
>
> --
> Michael Richardson <mcr+IETF@sandelman.ca>, Sandelman Software Works
>  -= IPv6 IoT consulting =-
>
>
>
>
> --
> Michael Richardson <mcr+IETF@sandelman.ca>, Sandelman Software Works
>  -= IPv6 IoT consulting =-
>
>
>
> _______________________________________________
> Behave mailing list
> Behave@ietf.org
> https://www.ietf.org/mailman/listinfo/behave
>