Subject: RE: [midcom] Working group last call - STUN (security)

From: "Sanjoy Sen"<[email-masked]>
Date: Tue, 23 Apr 2002 17:34:47 -0500

Actually the STUN service provider in many many deployment scenarios will
already have a pre-shared secret (password) that it uses to authorize the
user for other services. This can re-used by the service provider as a
symmetric shared secret for authenticating itself through a Digest-ish
mechanism.

> -----Original Message-----
> From: Christian Huitema [mailto:[email-masked]]
> Sent: Tuesday, April 23, 2002 3:07 PM
> To: Peterson, Jon; Melinda Shore
> Cc: [email-masked]
> Subject: RE: [midcom] Working group last call - STUN (security)
> 
> 
> > 
> > And I must reiterate that midcom-stun-00 already assumes enough of a
> > pre-existing relationship that a client is provisioned with 
> the domain
> of
> > a
> > server - and if that's the case, that's all the relationship we need
> for
> > the
> > client to also be provisioned with a shared secret. 
> 
> Not true. I can provision the client by copying the same 
> string in each
> of them, e.g. "stun.example.com." The string can be copied from a user
> manual. Do you suggest to copy the shared secret from that 
> same manual?
> 
> -- Christian Huitema
> 
> _______________________________________________
> midcom mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/midcom
>

---

From: "Cullen Jennings" <[email-masked]>
Date: Tue, 23 Apr 2002 16:14:06 -0700

Would someone be willing to propose an strawman email on how we could do
this using TLS?

---

From: "Pete Cordell" <[email-masked]>
Date: Wed, 24 Apr 2002 18:41:35 +0100

Thinking aloud (i.e. without thinking it through!) another alternative would
be to devise a scheme that allowed a client to test a mapping.

For example, it might be able to open another socket, and send a packet to
the mapped address.  In theory this ought exit the NAT and loop back in on
the NATted address and be sent back to the client.  If the client gets it
back, it knows the mapping is genuine.

I recall that someone (possible Christian) said that NATs don't generally
support this type of loop back.  Is there another way of doing it?  I
considered echo, but that doesn't seem to be widely deployed.

Pete.

=============================================
Pete Cordell
Tech-Know-Ware
[email-masked]
+44 1473 635863
=============================================

----- Original Message -----
From: "Cullen Jennings" <[email-masked]>
To: "Sanjoy Sen" <[email-masked]>; "'Christian Huitema'"
<[email-masked]>; "Peterson, Jon" <[email-masked]>;
"Melinda Shore" <[email-masked]>
Cc: <[email-masked]>
Sent: 24 April 2002 00:14
Subject: [midcom] Stun Security using TLS?

---

From: "Pete Cordell" <[email-masked]>
Date: Thu, 25 Apr 2002 12:00:01 +0100

In addition to my suggestion of enabling the client to be able to test the
address that it has been given, it has been pointed out to me that the
client could simply check that the address that it has been given seems
reasonable (i.e. it corresponds to one of the public addresses of the
organisation.)

This would work well for fixed devices as the valid set of addresses can be
configured at installation time along with the domain.

For mobile users using hotel and airport NATs, there seems scope for getting
the information from DHCP and DNS at the same time as trying to find out the
location of the STUN server, but there might need to be a little more work
here.

These methods are orders of magnitude simpler than using CMS, and much more
in tune with the scale of STUN.  While they don't offer quite the same
protection, in some aspects they offer less, and others they offer more.

Therefore, I believe it's worth considering these options.  (Sometimes if
you find a big obstacle its best to try and find a way round it, rather than
trying to smash your way through it!)

Pete.

----- Original Message -----
From: "Pete Cordell" <[email-masked]>
To: "Cullen Jennings" <[email-masked]>; "Sanjoy Sen"
<[email-masked]>; "'Christian Huitema'"
<[email-masked]>; "Peterson, Jon" <[email-masked]>;
"Melinda Shore" <[email-masked]>
Cc: <[email-masked]>
Sent: 24 April 2002 18:41
Subject: Re: [midcom] Stun Security using TLS?