Re: [pntaw] FW: New Version Notification for draft-reddy-behave-turn-auth-03.txt

[Harald Alvestrand <[e-mail]>]

On 09/04/2013 10:41 AM, Tirumaleswar Reddy (tireddy) wrote:
> Hi Harald,
>
> Thanks for the comments. Please see inline

Thanks for the rapid turnaround!
>> 4) section 4 bullet 2 assumes that one needs a credentials database at
>> the TURN server to verify the credentials. This is incorrect, as
>> draft-uberti shows; all that is required is that the credentials are
>> verifiable.
> TURN server needs access to a credential database with username, realm and MD5 hash computed over the username, realm, and password. TURN server needs key derived from username and password (key = MD5(username ":" realm ":" SASLprep(password))) to validate message integrity for TURN request and also to calculate message-integrity for TURN response.

For the case where the "password" is machine-generated, not user-chosen, 
there are more options (this was a surprise for me the first time I 
encountered it, too!)

For instance, if

username = <string, maybe chosen by user>
password = base64(HMAC(site-wide secret key + username))

the server that only knows the site-wide secret key can compute what the 
password should have been for any given <string chosen by user>, and 
thereby complete the verification.

(this particular scheme probably has cryptographic weaknesses; most 
schemes not designed by cryptographers are breakable)

You don't need a database, you just need to be able to validate the MAC 
- a database is one implementation.