Subject: RE: [midcom] WGLC - Alternatives for 'securing' STUN

From: Melinda Shore <[email-masked]>
Date: Tue, 30 Apr 2002 08:57:59 -0400

At 07:27 PM 4/29/02 -0500, Peterson, Jon wrote:
>STUN's job as a protocol
>should be to use that shared secret in the STUN authentication process,
>regardless of how clients happen to learn the secret. 

It's probably more common than not that public keys are
used to protect sessions that are created to either reach
key agreement or simply send keys (public key cryptography
being more expensive computationally than symmetric key
cryptography), and Christian's proposal is very much in
keeping with how keying is done in IETF and other protocols.

Are there other opinions on this proposal?

Melinda

_______________________________________________
midcom mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/midcom

---

From: Jonathan Rosenberg <[email-masked]>
Date: Tue, 30 Apr 2002 15:11:56 -0400

> Are there other opinions on this proposal?

I'm not sure I fully understand the difference between Jon's proposal
and Christians, but I like the idea of using TLS to obtain some kind of
keying material to use on the actual stun response. I think it would be
worth fleshing out the details.

-Jonathan R.

-- 
Jonathan D. Rosenberg, Ph.D.            72 Eagle Rock Avenue
Chief Scientist                         First Floor
dynamicsoft                             East Hanover, NJ 07936
[email-masked]                 FAX: (973) 952-5050
http://www.jdrosen.net                  PH:  (973) 952-5000
http://www.dynamicsoft.com

---

From: Melinda Shore <[email-masked]>
Date: Tue, 30 Apr 2002 15:25:44 -0400

>worth fleshing out the details.

It would be great if someone could volunteer to turn the proposal
into draft text, but I would like to get a handle on the level
of either support or objection.  I'd rather not find ourselves in 
last call again facing strong objections to something we'd already 
discussed and, I thought, resolved.

Melinda