Re: [rtcweb] Fwd: New Version Notification for draft-uberti-behave-turn-rest-00.txt

"Tirumaleswar Reddy (tireddy)" <> Mon, 22 July 2013 12:53 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 25E2911E8101; Mon, 22 Jul 2013 05:53:54 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -10.448
X-Spam-Status: No, score=-10.448 tagged_above=-999 required=5 tests=[AWL=0.150, BAYES_00=-2.599, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-8]
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id dMvUaTygEjDb; Mon, 22 Jul 2013 05:53:49 -0700 (PDT)
Received: from ( []) by (Postfix) with ESMTP id B372111E80D5; Mon, 22 Jul 2013 05:53:48 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple;;; l=16328; q=dns/txt; s=iport; t=1374497628; x=1375707228; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=DS4BgToDvmWpXeDOeTHhcHlWSodOgS93fVmyfGSnsDU=; b=H+tjn9r/Ug2g2qBKOOZOa492c8VD9XAEj7fGvSRmUFnpecTkxg9c09cX g92WGxlfmk/KkJ3qCWTzoYWhLB41KJGl4fxWAtxpHJlKNdgl61Y2+35Rm Z+74rjw7rKA6LxExaP7AaaekNw55+I70LJPx2L9gAoySPvsyECFhI76ET 8=;
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-AV: E=Sophos; i="4.89,719,1367971200"; d="scan'208,217"; a="234787165"
Received: from ([]) by with ESMTP; 22 Jul 2013 12:53:48 +0000
Received: from ( []) by (8.14.5/8.14.5) with ESMTP id r6MCrlRr011792 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=FAIL); Mon, 22 Jul 2013 12:53:47 GMT
Received: from ([]) by ([]) with mapi id 14.02.0318.004; Mon, 22 Jul 2013 07:53:47 -0500
From: "Tirumaleswar Reddy (tireddy)" <>
To: Justin Uberti <>
Thread-Topic: [rtcweb] Fwd: New Version Notification for draft-uberti-behave-turn-rest-00.txt
Thread-Index: AQHOgaXFxG8B2qhG1UKzVBv1DFSHsZlvKhOQ
Date: Mon, 22 Jul 2013 12:53:47 +0000
Message-ID: <>
References: <> <> <>
In-Reply-To: <>
Accept-Language: en-US
Content-Language: en-US
x-originating-ip: []
Content-Type: multipart/alternative; boundary="_000_913383AAA69FF945B8F946018B75898A14B9F74Dxmbrcdx10ciscoc_"
MIME-Version: 1.0
Cc: Behave WG <>, "" <>
Subject: Re: [rtcweb] Fwd: New Version Notification for draft-uberti-behave-turn-rest-00.txt
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Real-Time Communication in WEB-browsers working group list <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Mon, 22 Jul 2013 12:53:54 -0000

Hi Justin,

You may also want to consider your using OAuth 2.0 framework. For example consider draft ( Where WebServer would act as Authorization Server (AS), TURN Server as Resource Server (RS) and Client will be the WebRTC Client.

The advantage of using OAuth is that

[1] If handle token is chosen, AS can revoke the credentials after the call is terminated. This would ensure that even if the temporary credentials are exposed to JavaScript, these credentials can be only used for the duration of the call. This would prevent any attacks possible of someone else using the temporary credentials even after the call is terminated.

[2] AS and RS need to not be co-located.

[3] AS and RS need not use static shared secret; OAuth provides flexibility for the AS to update the RS with session keys.

[4] I believe there are already implementations available of OAuth.

Best Regards,
From: [] On Behalf Of Justin Uberti
Sent: Tuesday, July 16, 2013 3:23 AM
Subject: [rtcweb] Fwd: New Version Notification for draft-uberti-behave-turn-rest-00.txt

I have changed the WG for this draft from RTCWEB to BEHAVE. Many, but not all of the comments I received on the RTCWEB mailing list have been addressed.

BEHAVE chairs, I would like 10 minutes of agenda time to discuss this draft.
---------- Forwarded message ----------
From: <<>>
Date: Mon, Jul 15, 2013 at 5:49 PM
Subject: New Version Notification for draft-uberti-behave-turn-rest-00.txt
To: Justin Uberti <<>>

A new version of I-D, draft-uberti-behave-turn-rest-00.txt
has been successfully submitted by Justin Uberti and posted to the
IETF repository.

Filename:        draft-uberti-behave-turn-rest
Revision:        00
Title:           A REST API For Access To TURN Services
Creation date:   2013-07-15
Group:           Individual Submission
Number of pages: 8

   This document describes a proposed standard REST API for obtaining
   access to TURN services via ephemeral (i.e. time-limited)
   credentials.  These credentials are vended by a web service over
   HTTP, and then supplied to and checked by a TURN server using the
   standard TURN protocol.  The usage of ephemeral credentials ensures
   that access to the TURN server can be controlled even if the
   credentials can be discovered by the user, as is the case in WebRTC
   where TURN credentials must be specified in Javascript.

The IETF Secretariat