Re: [MMUSIC] ICE-tcp: TLS then STUN or STUN then TLS

inline.

EKR wrote:

> Jonathan Rosenberg <jdrosen@cisco.com> wrote:
> 
>>STUN then TLS
>>-------------
>>
>>+ avoids doing TLS handshakes except on connections that are selected by ICE
>>+ consistent with how we are doing DTLS where the STUN is clearly not
>>protected by SRTP and would happen prior to the DTLS handshaking
>>- Likely to be really hard to implement since most TLS stacks probably
>>won't let you interleave data like this
> 
> 
> Let's examine this question a bit. There are two things you have to do
> to make this work:
> 
>  1. Insert a shim layer in between the TLS stack and the network to
>     bypass the STUN. Most stacks I'm familiar with allow this. I 
>     know OpenSSL does, as does PureTLS.
>  2. Demux TLS and STUN. This is relatively easy (see the description
>     in draft-mcgrew-tls-srtp).
> 
> So, I'm not sure this is that hard to do.

Well, one idea on the demux is if we are using the contrans framing, the 
TLS runs ONTOP of the framing so the demux is trivial.

One thing I wasnt sure of is whether the stacks allow these shimes to 
exist only prior to the handshake completing or through the entire 
duration of the tls connection?

> 
> 
>>- will lose the TLS protection on STUN itself, introducing possible
>>framing attacks whereby a MITM modifies the STUN lengths to disrupt
>>frame sync
> 
> 
> Not sure I understand this issue. It's of course trivial to DoS a 
> TLS over TCP connection by disrupting its frame sync...

A concern was raised on the behave list that an attacker could modify 
the length attribute of stun messages, and disrupt framing on the tcp 
connection and consequently trash the connection. I guess your point is 
that this is possible with regular TCP/TLS too....

-Jonathan R.

-- 
Jonathan D. Rosenberg, Ph.D.                   600 Lanidex Plaza
Cisco Fellow                                   Parsippany, NJ 07054-2711
Cisco Systems
jdrosen@cisco.com                              FAX:   (973) 952-5050
http://www.jdrosen.net                         PHONE: (973) 952-5000
http://www.cisco.com

_______________________________________________
mmusic mailing list
mmusic@ietf.org
https://www1.ietf.org/mailman/listinfo/mmusic