Re: [rtcweb] Fwd: New Version Notification for draft-uberti-behave-turn-rest-00.txt

["Tirumaleswar Reddy (tireddy)" <[e-mail]>]

Hi Justin,

You may also want to consider your using OAuth 2.0 framework. For example consider draft (http://tools.ietf.org/html/draft-ietf-oauth-v2-http-mac-04#section-6.1) Where WebServer would act as Authorization Server (AS), TURN Server as Resource Server (RS) and Client will be the WebRTC Client.

The advantage of using OAuth is that

[1] If handle token is chosen, AS can revoke the credentials after the call is terminated. This would ensure that even if the temporary credentials are exposed to JavaScript, these credentials can be only used for the duration of the call. This would prevent any attacks possible of someone else using the temporary credentials even after the call is terminated.

[2] AS and RS need to not be co-located.

[3] AS and RS need not use static shared secret; OAuth provides flexibility for the AS to update the RS with session keys.

[4] I believe there are already implementations available of OAuth.

Best Regards,
--Tiru.
From: [e-mail] [mailto:[e-mail]] On Behalf Of Justin Uberti
Sent: Tuesday, July 16, 2013 3:23 AM
To: [e-mail]; [e-mail]
Subject: [rtcweb] Fwd: New Version Notification for draft-uberti-behave-turn-rest-00.txt

I have changed the WG for this draft from RTCWEB to BEHAVE. Many, but not all of the comments I received on the RTCWEB mailing list have been addressed.

BEHAVE chairs, I would like 10 minutes of agenda time to discuss this draft.
---------- Forwarded message ----------
From: <[e-mail]<mailto:[e-mail]>>
Date: Mon, Jul 15, 2013 at 5:49 PM
Subject: New Version Notification for draft-uberti-behave-turn-rest-00.txt
To: Justin Uberti <[e-mail]<mailto:[e-mail]>>



A new version of I-D, draft-uberti-behave-turn-rest-00.txt
has been successfully submitted by Justin Uberti and posted to the
IETF repository.

Filename:        draft-uberti-behave-turn-rest
Revision:        00
Title:           A REST API For Access To TURN Services
Creation date:   2013-07-15
Group:           Individual Submission
Number of pages: 8
URL:             http://www.ietf.org/internet-drafts/draft-uberti-behave-turn-rest-00.txt
Status:          http://datatracker.ietf.org/doc/draft-uberti-behave-turn-rest
Htmlized:        http://tools.ietf.org/html/draft-uberti-behave-turn-rest-00


Abstract:
   This document describes a proposed standard REST API for obtaining
   access to TURN services via ephemeral (i.e. time-limited)
   credentials.  These credentials are vended by a web service over
   HTTP, and then supplied to and checked by a TURN server using the
   standard TURN protocol.  The usage of ephemeral credentials ensures
   that access to the TURN server can be controlled even if the
   credentials can be discovered by the user, as is the case in WebRTC
   where TURN credentials must be specified in Javascript.




The IETF Secretariat