Re: [BEHAVE] Discusses regarding security mechanism usage for TURN

[Magnus Westerlund <[e-mail]>]

Hi,

We ADs has discussed the deployment case where you deploy the TURN
server on the border between a private domain and the Internet. And
because of the clients being controlled and required to be coming from
that private domain an per client authentication is not required for
using the TURN server.

We note that this may fulfill the security requirements. However, the
current draft is substantially lacking in description of the details
that are needed to handle this case. Both how you reliably determine
that a client really is connecting from the trusted domain and how you
ensure that the client know if it needs to use the authentication
mechanism or not.

I personally don't think documenting this model can be done quickly. I
would note that TURN can be extended in various ways, that include
adding additional security models. So starting work on a separate
document for this solution sounds like a possible way forward.

TURN has been under development under a long time. It is time we publish
TURN. I do note that TURN drafts currently are hold up the following
documents from being published:

C3  AUTH48      draft-ietf-sipping-app-interaction-framework
C3  AUTH48      draft-ietf-sipping-gruu-reg-event
C3  MISSREF     draft-ietf-sipping-v6-transition
C3  AUTH48      draft-ietf-sip-gruu
C3  MISSREF     draft-ietf-mmusic-ice
C3  AUTH48      draft-shacham-sipping-session-mobility
C3  MISSREF*    draft-ietf-sip-ice-option-tag
C3  REF         draft-ietf-behave-stun-test-vectors
C3  AUTH48      draft-ietf-sip-sips
C3  MISSREF     draft-ietf-sip-ua-privacy
C3  AUTH48      draft-ietf-sip-outbound
C3  AUTH48      draft-ietf-sip-record-route-fix

I will give the proponents for the above describe security solution time
to answer. Then I intended to push forward to get TURN approved.

Regards

Magnus Westerlund

IETF Transport Area Director
----------------------------------------------------------------------
Multimedia Technologies, Ericsson Research EAB/TVM
----------------------------------------------------------------------
Ericsson AB                | Phone  [phone]
Färögatan 6                | Mobile [phone]
SE-164 80 Stockholm, Sweden| mailto: [e-mail]
----------------------------------------------------------------------