Re: [secdir] secdir review of draft-ietf-behave-turn-uri-03.txt

[Marc Petit-Huguenin <[e-mail]>]

Hi Juergen,

Thanks for the review.  See my response below.

Juergen Schoenwaelder wrote:
> I have reviewed this document as part of the security directorate's
> ongoing effort to review all IETF documents being processed by the
> IESG.  These comments were written primarily for the benefit of the
> security area directors.  Document editors and WG chairs should treat
> these comments just like any other last call comments.
> 
> The document introduces the turn: and turns: URI schemes. The security
> considerations point to the relevant documents, one of them being RFC
> 3958. Section 8 of RFC 3958 states that S-NAPTR application protocols
> "should define some form of end-to-end authentication to ensure that
> the correct destination has been reached." I think it would be useful
> to spell how TURN meets this or whether there are reasons why TURN
> does not need such a sanity check. (1-2 sentences should be enough.)

I propose to replace the second paragraph of section 6 by the following text.
Let me know if it addresses your comment:

"The Application Service Tag and Application Protocol Tags defined in
this document do not introduce any specific security issues beyond
the security considerations discussed in [RFC3958].  [RFC3958]
requests that an S-NAPTR application defines some form of end-to-end
authentication to ensure that the correct destination has been
reached.  This is achieved by the mandatory Long-Term Credential
Mechanism defined by [RFC5389] and additionally for a "turns" URI by
the usage of TLS."

-- 
Marc Petit-Huguenin
Personal email: [e-mail]
Professional email: [e-mail]
Blog: http://blog.marc.petit-huguenin.org