Re: [rtcweb] Fwd: New Version Notification for draft-uberti-rtcweb-turn-rest-00.txt

[Justin Uberti <[e-mail]>]

On Jul 8, 2013 5:43 PM, "Martin Thomson" <[e-mail]> wrote:
>
> On 8 July 2013 13:09, Justin Uberti <[e-mail]> wrote:
> > The issue with using short term credentials, without a nonce, is the
> > possibility of replay attacks by an eavesdropper.
>
> It is no less vulnerable than having the long term credential set
> (username, nonce, realm, and password) overheard.  Assuming that the
> lifetime of the password is the same in both cases.  In either case,
> the link that the eavesdropper is required to attack is the HTTP link.

I don't think this is true. In the short term case, with no nonce, the
packet can be replayed verbatim.

> > Passing realm and nonce solves this [...]
>
> I was suggesting that since you have spent some very expensive
> round-trips getting this information, there are no advantages in
> spending yet another round-trip on a challenge.  I don't think that
> passing realm and nonce is a good idea in practice - it creates a
> tighter coupling between this new thing and the TURN server.
>
> In practice, a master nonce is not quite what you need, you need a
> nonce-generator function, or a line to the TURN server whereby you
> query for every request you get.  The former imposes too-strong
> constraints on implementations, the latter renders much of the
> advantages of something like this moot.

Right, the master nonce I suggested would be used to generate regular
nonces. But it's not a good idea anyway.