Re: [secdir] Secdir review of draft-ietf-behave-turn-13

[Philip Matthews <[e-mail]>]

On Wed, 11-Mar-09, at 11:11 , Paul Hoffman wrote:

> At 10:16 AM -0400 3/11/09, Russ Housley wrote:
>> Does this mean MUST implement and SHOULD use?
>
> Good question, and I think the answer is that the document does not  
> *require* that authentication be implemented. That is, I couldn't  
> find a place where it said one way or another. I will defer to the  
> document authors to answer that one.


Section 4 (General Behavior) says:

    In addition, the server SHOULD demand that all requests from the
    client be authenticated, using the Long-Term Credential mechanism
    described in [RFC5389], and the client MUST be prepared to
    authenticate requests if required.

Thus clients will interoperate with a server, regardless of whether it  
requires authentication or not. There is no statement about what  
servers must implement, just what they should do. However, I think  
that most people recognize that the security of TURN is pretty poor  
without authentication, unless TLS transport is used.

- Philip