Re: [pntaw] FW: New Version Notification for draft-reddy-behave-turn-auth-03.txt

["Tirumaleswar Reddy (tireddy)" <[e-mail]>]

Hi Harald,

Thanks for the comments. Please see inline

> -----Original Message-----
> From: [e-mail] [mailto:[e-mail]] On Behalf Of
> Harald Alvestrand
> Sent: Tuesday, September 03, 2013 7:35 PM
> To: [e-mail]
> Subject: Re: [pntaw] FW: New Version Notification for draft-reddy-behave-turn-
> auth-03.txt
> 
> Quick review of this document..... I am typing this up because I spent
> time reading the draft, not because I have a particular opinion about
> what should be done with it.
> 
> 1) Please get someone to fix the grammar. For non-native English
> speakers like me, it is problematic to parse sentences like this:
> 
>     TURN server plays a vital and is a building block to support direct,
>     interactive, real-time communication using audio, video,
>     collaboration, games, etc., between two peers web-browsers in Web
>     Real-Time communication (WebRTC) [I-D.ietf-rtcweb-overview]
>     framework.
> 
> the problems of this specific sentence include:
> - no article ("the", "a") on "Turn server"
> - The sentence fragment around "peers web-browsers in..." does not parse
> for me. Either "peers using web browsers that implement" or, simpler,
> "two peers' web browsers using the" - or it's possible that the intended
> meaning wasthat "in Web Real-Time communication" was intended to group
> with "a building block". There's no way I can tell from the sentence.
> - "plays a vital" has no object

Thanks, corrected.

> 
> I could go on, but it's really distracting and error-prone to guess at
> the intended grammar before I can start guessing at the intended meaning.
> 
> (the subsequent sections are actually a bit better. But this particular
> sentence was scary to me.)
> 
> 2) The use case reference is wrong. Section 4.2.4.1 doesn't exist.
> Section 3.2.5.1 seems to fit the bill, but it's more stable to refer to
> them by name.

In version 11 of draft rtcweb-use-cases-and-requirements section numbers have changed added section name for clarity (it is Section 3.2.5.1).

> 
> 3) The password guessing attack described in section 4 bullet 1 *is* an
> offline dictionary attack. So the paragraph gives the same attack twice.

Fixed.

> 
> 4) section 4 bullet 2 assumes that one needs a credentials database at
> the TURN server to verify the credentials. This is incorrect, as
> draft-uberti shows; all that is required is that the credentials are
> verifiable.

TURN server needs access to a credential database with username, realm and MD5 hash computed over the username, realm, and password. TURN server needs key derived from username and password (key = MD5(username ":" realm ":" SASLprep(password))) to validate message integrity for TURN request and also to calculate message-integrity for TURN response. 

> 
> 5) In section 4 bullet 4 one talks about "the USERNAME of the host".
> This word is used in addition to "client" and "user, seemingly
> interchangeably. 

changed to "client" in all the places.

> The takeaway here is that reusing USERNAMEs over time
> leads to tracking of usages of the USERNAME, which may lead to tracking
> of the entity (client or user) that uses it. This is a good argument for
> a draft-uberti-like mechanism for throwaway credentials.
> 
> 6) The security section is just incorrect. The whole draft is about
> raising security concerns.

Fixed.

Thanks and Regards,
-Tiru.

> 
> I am not very happy with the idea of spending significant draft and
> review time on listing issues - but if we list issues, the issues should
> be correctly stated.
> 
> 
> On 09/03/2013 01:53 PM, Tirumaleswar Reddy (tireddy) wrote:
> > [Including pntaw mailing list]
> >
> > This draft discusses the issues with STUN Authentication for TURN. Comments
> and suggestions are welcome. In BEHAVE WG there were discussions to solve the
> problem mentioned in the draft using techniques like TURN over DTLS, draft-
> uberti-behave-turn-rest-00.
> >
> > -Tiru.
> >
> > -----Original Message-----
> > From: [e-mail] [mailto:[e-mail]]
> > Sent: Tuesday, September 03, 2013 12:10 PM
> > To: Ram Mohan R (rmohanr); Tirumaleswar Reddy (tireddy); Muthu Arul Mozhi
> Perumal (mperumal); Alper Yegin; Ram Mohan R (rmohanr); Alper E. Yegin; Muthu
> Arul Mozhi Perumal (mperumal)
> > Subject: New Version Notification for draft-reddy-behave-turn-auth-03.txt
> >
> >
> > A new version of I-D, draft-reddy-behave-turn-auth-03.txt
> > has been successfully submitted by Tirumaleswar Reddy and posted to the
> > IETF repository.
> >
> > Filename:	 draft-reddy-behave-turn-auth
> > Revision:	 03
> > Title:		 Problems with STUN Authentication for TURN
> > Creation date:	 2013-09-03
> > Group:		 Individual Submission
> > Number of pages: 7
> > URL:             http://www.ietf.org/internet-drafts/draft-reddy-behave-
> turn-auth-03.txt
> > Status:          http://datatracker.ietf.org/doc/draft-reddy-behave-turn-
> auth
> > Htmlized:        http://tools.ietf.org/html/draft-reddy-behave-turn-auth-03
> > Diff:            http://www.ietf.org/rfcdiff?url2=draft-reddy-behave-turn-
> auth-03
> >
> > Abstract:
> >     This document discusses some of the issues with STUN authentication
> >     for TURN messages.
> >
> >
> >
> >
> > Please note that it may take a couple of minutes from the time of submission
> > until the htmlized version and diff are available at tools.ietf.org.
> >
> > The IETF Secretariat
> >
> > _______________________________________________
> > pntaw mailing list
> > [e-mail]
> > https://www.ietf.org/mailman/listinfo/pntaw
> 
> _______________________________________________
> pntaw mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/pntaw