Re: [pntaw] FW: New Version Notification for draft-reddy-behave-turn-auth-03.txt

["Tirumaleswar Reddy (tireddy)" <[e-mail]>]

Hi Harald,

Please see inline

> -----Original Message-----
> From: Harald Alvestrand [mailto:[e-mail]]
> Sent: Wednesday, September 04, 2013 3:11 PM
> To: Tirumaleswar Reddy (tireddy)
> Cc: [e-mail]
> Subject: Re: [pntaw] FW: New Version Notification for draft-reddy-behave-turn-
> auth-03.txt
> 
> On 09/04/2013 10:41 AM, Tirumaleswar Reddy (tireddy) wrote:
> > Hi Harald,
> >
> > Thanks for the comments. Please see inline
> 
> Thanks for the rapid turnaround!
> >> 4) section 4 bullet 2 assumes that one needs a credentials database at
> >> the TURN server to verify the credentials. This is incorrect, as
> >> draft-uberti shows; all that is required is that the credentials are
> >> verifiable.
> > TURN server needs access to a credential database with username, realm and
> MD5 hash computed over the username, realm, and password. TURN server needs
> key derived from username and password (key = MD5(username ":" realm ":"
> SASLprep(password))) to validate message integrity for TURN request and also
> to calculate message-integrity for TURN response.
> 
> For the case where the "password" is machine-generated, not user-chosen,
> there are more options (this was a surprise for me the first time I
> encountered it, too!)
> 
> For instance, if
> 
> username = <string, maybe chosen by user>
> password = base64(HMAC(site-wide secret key + username))
> 
> the server that only knows the site-wide secret key can compute what the
> password should have been for any given <string chosen by user>, and
> thereby complete the verification.
> 
> (this particular scheme probably has cryptographic weaknesses; most
> schemes not designed by cryptographers are breakable)

Yes, draft-uberti-behave-turn-rest-00 is a new approach that solves some of the problems discussed in the draft. It is addressing third party authorization which will be useful in scenarios where WebRTC service and TURN server are provided by the same provider. 

The other scenario to consider is - If Enterprises want to deploy TURN server and want to use first party authentication (let's say "log-in" username and password for auditing, policy enforcement on usage of TURN resources etc)  then there is still a problem. In those cases either TLS or DTLS can be used to carry the TURN messages and addresses the problems in the draft, but WebRTC specific problem will be exposing the credential to java script.
 
-Tiru.

> 
> You don't need a database, you just need to be able to validate the MAC
> - a database is one implementation.


>