Re: [rtcweb] I-D Action: draft-ietf-rtcweb-transports-00.txt

[Roman Shpount <[e-mail]>]

On Mon, Aug 19, 2013 at 7:20 PM, Dan Wing <[e-mail]> wrote:

>
> On Aug 19, 2013, at 2:20 PM, Harald Alvestrand <[e-mail]>
> wrote:
> Section 2.2,
> "   o  TURN, including TURN over TCP [[QUESTION: and TURN over TLS]],
>       [RFC5766]."
>
> Most -- but not all -- of the security obtained with TURN over TLS is
> achieved with TURN REST (draft-uberti-behave-turn-rest and
> draft-uberti-rtcweb-turn-rest).  I think the working group should consider
> if TURN REST satisfies the requirements, or if TURN over TLS is really,
> really necessary.
>

It is useful to support TURN over TLS for two reasons:

1. To hide the remote party IP address in TURN allocations from anybody who
is monitoring the local IP connection
2. To traverse restrictive firewalls that only allow HTTP/HTTPS connections
by placing a TURNS server on port 443

I would think that for those two reasons TURN-TLS should be MUST implement.
_____________
Roman Shpount