Re: [rtcweb] Fwd: New Version Notification for draft-uberti-behave-turn-rest-00.txt

[Philipp Hancke <[e-mail]>]

Am 17.07.2013 20:56, schrieb Rajmohan Banavi:
> Hi Justin,
>
> I reviewed draft-uberti-behave-turn-rest-00 and have the following comments.
[...]
>     2. Sec 4.3 last paragraph - "Because the password is derived from the
>     USERNAME, successful verification of the MESSAGE-INTEGRITY ensures that the
>     username is trustworthy". I believe this validation is taken care of in the
>     TURN RFC itself. In order to generate the MESSAGE-INTEGRITY, the TURN
>     client generates a long term key which is computed as => key =
>     MD5(username ":" realm ":" SASLprep(password)). This key is used to perform
>     hmac on the message. The same is done on the TURN server end as well. If
>     the MESSAGE-INTEGRITY is verified, then it implies that the username is
>     trustworthy.

Let me try to address that with a lenghty example:
The web server returns
password = BASE64(HMAC-SHA1(username, sharedsecret))
to the browser.

For example, with username = "12334939:mbzrxpgjys" and sharedsecret 
"secret", the password given to the browser would be
"+4pCXR06gx/cqAikLYnBajtZW6E=" (hopefully)




The browser passes the username, uri and password to it's webrtc stack.
The password is exposed to the user of the browser (which might be 
anyone surfing your website) during that process.

That stack does long term authentication and uses this password string 
as input for calculating MESSAGE-INTEGRITY with
key = MD5(username ":" realm ":" SASLprep(password))

For the example this would be
key =MD5("12334939:mbzrxpgjys" ":" realm ":" 
SASLprep("+4pCXR06gx/cqAikLYnBajtZW6E=")




On the TURN server, the key for MESSAGE-INTEGRITY is calculated using
key = MD5(username ":" realm ":" SASLprep(BASE64(HMAC-SHA1(USERNAME, 
sharedsecret))

So for the example this would be
  = MD5("12334939:mbzrxpgjys" ":" realm ":" 
SASLprep(BASE64(HMAC-SHA1("12334939:mbzrxpgjys", "secret"))
  = MD5("12334939:mbzrxpgjys" ":" realm ":" 
SASLprep("+4pCXR06gx/cqAikLYnBajtZW6E=")

So the browser and turn server use the same input to the M-I. This can 
be done by looking at the request alone given the shared secret.


Does that make it clearer?

philipp,
who only understood it after implementing it