Re: [tram] Artart telechat review of draft-ietf-tram-stunbis-16

Marc Petit-Huguenin <> Mon, 16 April 2018 23:43 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 0A82E12D77B; Mon, 16 Apr 2018 16:43:38 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -1.108
X-Spam-Status: No, score=-1.108 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RDNS_NONE=0.793, SPF_PASS=-0.001] autolearn=no autolearn_force=no
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id g7WVbaKAuQe4; Mon, 16 Apr 2018 16:43:36 -0700 (PDT)
Received: from (unknown [IPv6:2001:4b98:dc0:45:216:3eff:fe7f:7abd]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 7778C12D72F; Mon, 16 Apr 2018 16:43:36 -0700 (PDT)
Received: from [IPv6:2601:648:8301:730f:f993:3fc0:2548:9f56] (unknown [IPv6:2601:648:8301:730f:f993:3fc0:2548:9f56]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client CN "Marc Petit-Huguenin", Issuer "" (verified OK)) by (Postfix) with ESMTPS id 03A18AE844; Tue, 17 Apr 2018 01:43:32 +0200 (CEST)
To: Peter Saint-Andre <>,
References: <>
From: Marc Petit-Huguenin <>
Message-ID: <>
Date: Mon, 16 Apr 2018 16:43:25 -0700
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.7.0
MIME-Version: 1.0
In-Reply-To: <>
Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="wrT326OxbEtRBMlcX6rsyVx2RhvLD8BXB"
Archived-At: <>
Subject: Re: [tram] Artart telechat review of draft-ietf-tram-stunbis-16
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: "Discussing the creation of a Turn Revised And Modernized \(TRAM\) WG, which goal is to consolidate the various initiatives to update TURN and STUN." <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Mon, 16 Apr 2018 23:43:38 -0000

Hi Peter,

Thanks for the review and sorry for the delay in responding, I was traveling for the last 4 weeks.

See my responses inline.

On 04/02/2018 03:59 PM, Peter Saint-Andre wrote:
> Reviewer: Peter Saint-Andre
> Review result: Ready with Nits
> Section 1 states:
>    Implementations and deployments of a STUN usage using TLS or DTLS
>    should follow the recommendations in [RFC7525].
> Wouldn't the security considerations be a better location for that text?

Moved there.

> And given that this specification cites RFC 8174, I suggest changing
> "should" to "SHOULD".


> (I suggest that the authors review the usage of lowercase and uppercase
> requirements keywords, because there might be inconsistencies, e.g., in
> the first paragraphs of Section 6.1 and Section 6.2.)

These sections are identical to RFC 5389 and so I am reluctant to modify them as they already went through an IESG review.  I reviewed the lowercase keywords in these two sections and did not find any specific case that would create an interoperability issue, but please let me know if you think otherwise.

> In Section 4, please consider spelling out "SIP" on first use and
> including a reference to RFC 3261.


> The first paragaraph of Section 6.2.3 restates recommendations from RFC
> 7525; why not simply reference that specification?

The original text in RFC5389 said this:

" When STUN is run by itself over TLS-over-TCP, the
  TLS_RSA_WITH_AES_128_CBC_SHA ciphersuite MUST be implemented at a
  minimum. [...]"

The new text is an attempt at updating it in the same spirit of giving minimal instructions and complementing them with a reference to RFC 7525 - which was the reason for the reference to RFC 7525 there.

So I kept the text there, followed by the following paragraph, in addition of moving the original last paragraph in the Security Consideration section:

" These recommendations are just a part of the the recommendations in
  [RFC7525] that implementations and deployments of a STUN usage using
  TLS or DTLS SHOULD follow."

> Section 6.3.4 states:
>    o  If the error code is 500 through 599, the client MAY resend the
>       request; clients that do so MUST limit the number of times they do
>       this.
> It is reasonable to provide guidance as to the number of re-sends?

Same issue here, that's a section that is unmodified from RFC 5389.  As long as the client does not enter an endless loop of retransmission, choosing different numbers of re-sends does not affect interoperability.

> Section 9.1.1 and other sections invoke the OpaqueString profile of the
> PRECIS FreeformClass; it might be helpful to mention that the profile is
> used to handle Unicode characters outside the ASCII range, and that no
> changes result if only ASCII characters are used.

Hmm.  But in that case the application has first to test that the string is in the ASCII range.  Isn't that better to always assume that the input string will contain Unicode, and let the implementation of OpaqueString short-circuit the processing in the case of an all-ASCII string?

> In Section 14.2, please consider spelling out "ALG" on first use.


> A reference to RFC 6151 seems appropriate regarding the fact that this
> specification retains the use of MD5; in particular, the usage here is
> actually HMAC-MD5, which is still sanctioned by RFC 6151.


Marc Petit-Huguenin