Re: [tram] signature based 3rd party scheme

[Stephen Farrell <[e-mail]>]

On 30/04/15 14:14, Tirumaleswar Reddy (tireddy) wrote:
> TURN server and AS could be in the same administrative domain and
> pre-arrangement is simple in this case. The other deployment scenario
> is WebRTC service provider has tie-up with TURN service provider to
> use its service; pre-arrangement helps accounting 

I don't see that that is necessarily true. It depends on who
is accounting for what to whom.

> and in future
> support for token introspection
> https://tools.ietf.org/html/draft-ietf-oauth-introspection-08. (There
> is no WG consensus yet if token introspection is required)
> 
>>> 
>>> So what you consider a downside may actually be another advantage
>>> of a signature based scheme - if you need to worry about attacks
>>> on the STUN protocol, then you can choose how you handle that
>>> "locally" (between the browser and TURN server, e.g. using DTLS
>>> as you suggest) and not have to depend on the establishment of
>>> yet another Web PKI equivalent.
> Yes and in this scenario WebRTC server must force the client to pick
> DTLS.

Again, that depends. If the TURN server is run by an enterprise then
it might just be fine with allowing calls setup by any WebRTC server
that can be held accountable or could use a white or block list of
WebRTC servers.

S.