[rtcweb] FW: I-D Action: draft-muthu-behave-consent-freshness-01.txt

The draft has been updated based on the mailing list discussions and Eric's security presentation at the RTCWEB interim meeting. The sections that have been updated/added:

1. Abstract
   Adds session liveness

2. Introduction 
   Adds session liveness

3. Definitions
   Defines session liveness

4. Solution Overview
   Discusses the combined consent freshness and session liveness 
   test (slide "Combined Consent/Liveness Proposal II" from the 
   RTCWEB interim).

5. Design Considerations
   Discusses the pros and cons of reusing the STUN Binding request/response

6. Open Items
   Lists the current open issues.

While we have been discussing on a separate ICE spec/profile for RTCWEB, I would like to close on the smaller problem of our next steps for this draft. Issues we need consensus on to move forward:

1. Should we reuse the STUN Binding request/response for consent freshness and session liveness, considering interoperability with existing ICE and ICE-lite implementations even at the incurred cost of the SHA-1 computation for the message integrity on gateways? Seems to be a "yes" from the mailing list discussions so far. Any concerns?

2. Where does this draft really belong to? Considering that the use-case is relevant to WebRTC and we many not significantly change any BEHAVE protocol, should it be resubmitted to RTCWEB?

Muthu

-----Original Message-----
From: i-d-announce-bounces@ietf.org [mailto:i-d-announce-bounces@ietf.org] On Behalf Of internet-drafts@ietf.org
Sent: Monday, July 16, 2012 9:39 PM
To: i-d-announce@ietf.org
Subject: I-D Action: draft-muthu-behave-consent-freshness-01.txt

A New Internet-Draft is available from the on-line Internet-Drafts directories.

	Title           : STUN Usage for Consent Freshness and Session Liveness
	Author(s)       : Muthu Arul Mozhi Perumal
                          Dan Wing
                          Hadriel Kaplan
	Filename        : draft-muthu-behave-consent-freshness-01.txt
	Pages           : 9
	Date            : 2012-07-16

Abstract:
   Verification of peer consent is necessary in WebRTC deployments to
   ensure that a malicious JavaScript cannot use the browser as a
   platform for launching attacks.  A related problem is session
   liveness.  WebRTC applications may want to detect connection failure
   and take appropriate actions.  This document describes a STUN usage
   that enables a WebRTC browser to perform the following on a candidate
   pair ICE is using for a media component after session establishment:

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-muthu-behave-consent-freshness

There's also a htmlized version available at:
http://tools.ietf.org/html/draft-muthu-behave-consent-freshness-01

A diff from previous version is available at:
http://tools.ietf.org/rfcdiff?url2=draft-muthu-behave-consent-freshness-01

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

_______________________________________________
I-D-Announce mailing list
I-D-Announce@ietf.org
https://www.ietf.org/mailman/listinfo/i-d-announce
Internet-Draft directories: http://www.ietf.org/shadow.html
or ftp://ftp.ietf.org/ietf/1shadow-sites.txt