IETF Logo Mail Archive

Re: [tram] signature based 3rd party scheme

"Tirumaleswar Reddy (tireddy)" <tireddy@cisco.com> Thu, 30 April 2015 16:36 UTC

Return-Path: <tireddy@cisco.com>
X-Original-To: tram@ietfa.amsl.com
Delivered-To: tram@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 496201B2DB7 for <tram@ietfa.amsl.com>; Thu, 30 Apr 2015 09:36:31 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -14.511
X-Spam-Level:
X-Spam-Status: No, score=-14.511 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vukkPo7pIwnV for <tram@ietfa.amsl.com>; Thu, 30 Apr 2015 09:36:29 -0700 (PDT)
Received: from alln-iport-6.cisco.com (alln-iport-6.cisco.com [173.37.142.93]) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B46431B2DAC for <tram@ietf.org>; Thu, 30 Apr 2015 09:36:29 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=2554; q=dns/txt; s=iport; t=1430411789; x=1431621389; h=from:to:subject:date:message-id:references:in-reply-to: content-transfer-encoding:mime-version; bh=UEvHvB4PDWcGEc0mizGbcnaDcgowKarlnH6GciwYOiE=; b=jrtfQozeoO9Tb0d4R4k81eV+sLEPFhpbws6x/zVNvL+tIUBeowZsgGMo W9e2qI/2HG56lSD8gWi+3YPKeb0seFw35q/iYafyNa+2FSYwWVhmFQ5Uv RxZYcalMvwkXLclmciZ6SOXi67RUdHq30BGAEYFDIDsLNpfXk7AlTC5VZ c=;
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: A0C3BACHWUJV/4wNJK1SCoMMU1wFgxbBTmYJgVOGBAIcgTk4FAEBAQEBAQGBCoQgAQEBAwEjEVEEAgEIEQQBAQECAgYdAwICAjAUAQgIAQEEARIIiBsIDbUAk0wBAQEBAQEBAQEBAQEBAQEBAQEBAQETBIEhiheEKBIaFiIGgmIvgRYFkWqECZw8I4Flgg9vgUSBAQEBAQ
X-IronPort-AV: E=Sophos;i="5.11,677,1422921600"; d="scan'208";a="146033419"
Received: from alln-core-7.cisco.com ([173.36.13.140]) by alln-iport-6.cisco.com with ESMTP; 30 Apr 2015 16:36:29 +0000
Received: from xhc-aln-x08.cisco.com (xhc-aln-x08.cisco.com [173.36.12.82]) by alln-core-7.cisco.com (8.14.5/8.14.5) with ESMTP id t3UGaSWJ018276 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=FAIL); Thu, 30 Apr 2015 16:36:29 GMT
Received: from xmb-rcd-x10.cisco.com ([169.254.15.218]) by xhc-aln-x08.cisco.com ([173.36.12.82]) with mapi id 14.03.0195.001; Thu, 30 Apr 2015 11:36:28 -0500
From: "Tirumaleswar Reddy (tireddy)" <tireddy@cisco.com>
To: Stephen Farrell <stephen.farrell@cs.tcd.ie>, "tram@ietf.org" <tram@ietf.org>
Thread-Topic: [tram] signature based 3rd party scheme
Thread-Index: AdCCKHW9CjsMzThwTKab4ELJ3vVgMQAXWEQAADAwUsAACvq2AAAE52Og
Date: Thu, 30 Apr 2015 16:36:28 +0000
Message-ID: <913383AAA69FF945B8F946018B75898A47822E1B@xmb-rcd-x10.cisco.com>
References: <913383AAA69FF945B8F946018B75898A47821E90@xmb-rcd-x10.cisco.com> <55409F56.3090003@cs.tcd.ie> <913383AAA69FF945B8F946018B75898A47822B94@xmb-rcd-x10.cisco.com> <55422C68.8010505@cs.tcd.ie>
In-Reply-To: <55422C68.8010505@cs.tcd.ie>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-originating-ip: [10.65.68.186]
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
MIME-Version: 1.0
Archived-At: <http://mailarchive.ietf.org/arch/msg/tram/6cZ5K6B2qkoWRlFdetrWQ2vdi5E>
Subject: Re: [tram] signature based 3rd party scheme
X-BeenThere: tram@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "Discussing the creation of a Turn Revised And Modernized \(TRAM\) WG, which goal is to consolidate the various initiatives to update TURN and STUN." <tram.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tram>, <mailto:tram-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/tram/>
List-Post: <mailto:tram@ietf.org>
List-Help: <mailto:tram-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tram>, <mailto:tram-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 30 Apr 2015 16:36:31 -0000

> -----Original Message-----
> From: Stephen Farrell [mailto:stephen.farrell@cs.tcd.ie]
> Sent: Thursday, April 30, 2015 6:52 PM
> To: Tirumaleswar Reddy (tireddy); tram@ietf.org
> Subject: Re: [tram] signature based 3rd party scheme
> 
> 
> 
> On 30/04/15 14:14, Tirumaleswar Reddy (tireddy) wrote:
> > TURN server and AS could be in the same administrative domain and
> > pre-arrangement is simple in this case. The other deployment scenario
> > is WebRTC service provider has tie-up with TURN service provider to
> > use its service; pre-arrangement helps accounting
> 
> I don't see that that is necessarily true. It depends on who is accounting for
> what to whom.

The WebRTC server could be accounting the resource server (TURN server) used by the client for the call.

> 
> > and in future
> > support for token introspection
> > https://tools.ietf.org/html/draft-ietf-oauth-introspection-08. (There
> > is no WG consensus yet if token introspection is required)
> >
> >>>
> >>> So what you consider a downside may actually be another advantage of
> >>> a signature based scheme - if you need to worry about attacks on the
> >>> STUN protocol, then you can choose how you handle that "locally"
> >>> (between the browser and TURN server, e.g. using DTLS as you
> >>> suggest) and not have to depend on the establishment of yet another
> >>> Web PKI equivalent.
> > Yes and in this scenario WebRTC server must force the client to pick
> > DTLS.
> 
> Again, that depends. If the TURN server is run by an enterprise then it might
> just be fine with allowing calls setup by any WebRTC server that can be held
> accountable or could use a white or block list of WebRTC servers.

Yes, third party authorization can be used by the TURN server in the Enterprise network to identify the WebRTC server.
 
-Tiru

> 
> S.

v2.23.0 | Report a Bug | By Email