Re: [rtcweb] Fwd: New Version Notification for draft-uberti-behave-turn-rest-00.txt

[Adam Roach <[e-mail]>]

On 7/18/13 07:28, Rajmohan Banavi wrote:
> Hi  Justin, comments inline with additional comments at the end.
>
>     Correct, but that is a significant advantage, especially when the
>     web and TURN servers are separate entities.
>
>
> IMHO, the standard spec should not be based on any specific 
> implementation method. Now I agree that the TURN server validation 
> becomes easier using this method because it does not have to do some 
> sort of lookup. However, some another TURN server implementer can 
> achieve the same functionality by providing REST API but using 
> randomly generated pasword (rather than use HMAC) and using some sort 
> of lookup for TURN username when TURN ALLOCATE request is received.

I think the value here -- the value in defining a common scheme for 
password generation -- is that I could get an off-the-shelf TURN server 
from arbitrary vendor A, and run an off-the-shelf credential server from 
abitrary vendor B, and it would all work together. What you propose 
requires collusion between the TURN server provider and the credential 
server provider, using a not-yet-defined (and, if I read your proposal, 
never-publicly-defined) protocol to share credential information via a 
back-channel.

What Justin proposes gets us this inter-vendor interop cheaply and 
easily. What you're counterproposing forces people into a single-vendor 
(or, at least, partnered) solution, which kinda defeats the purpose of 
defining this in an SDO in the first place.

/a