Re: [MMUSIC] ICEbis: INTEGRITY attribute in Binding Responses clarification

[Ari Keränen <[e-mail]>]

Hi Pål-Erik,

I agree that making this more explicit makes sense.

The second paragraph of 7.2 starts now with:

    The agent MUST use the short-term credential mechanism (i.e., the
    MESSAGE-INTEGRITY attribute) to authenticate the request and perform
    a message integrity check.  Likewise, the short-term credential
    mechanism MUST be used for the response.

Unless someone sees some problem with this (in that case, please 
comment), I'll make this change for the next revision.


Cheers,
Ari

On 4/2/13 12:59 PM, Pal Martinsen (palmarti) wrote:
> Hi,
>
> I was reading through the ICE RFC and trying to figure out if Binding
> Responses needed the INTEGRITY attribute. Usually the ICE RFC is very
> descriptive in what to include in the messages, but I could not find
> any text clearly stating that the INTEGRITY attribute must be
> included in the Binding Responses.
>
> When reading the STUN RFC it states in section 7.3.1.1: "If the
> server authenticated the request using an authentication mechanism,
> then the server SHOULD add the appropriate authentication attributes
> to the response (see Section 10)."
>
> Is this SHOULD strong enough for the connectivity checks performed by
> ICE? Should it be changed to a MUST?
>
> To spell it out for readers like me, I propose the following changes
> to section 7.2 the second paragraph of the ICE RFC
> (http://tools.ietf.org/html/draft-keranen-mmusic-rfc5245bis-01#section-7.2)
>
>  The agent MUST use a short-term credential (i.e., the
> MESSAGE-INTEGRITY attribute) to authenticate and perform a message
> integrity check on the request and any response to that request.
>
> Adding the following to section 7.1.3.1 might also help to remind the
> implementors:
>
> The agent MUST use the INTEGRITY-MESSAGE attribute in the Binding
> Response to authenticate the message.
>
>
> .-. Pål-Erik Martinsen
>