Subject: Re: [midcom] WGLC - Alternatives for 'securing' STUN

From: [email-masked]
Date: Thu, 25 Apr 2002 13:28:54 -0400

The range of addresses which are reasonable might even be the 'shared
secret' that is spoken of in other messages to this list.  These can either
be pre-configured or delivered by a protocol. Why not, it would make STUN
completely indifferent to cryptography?

Melinda Shore <[email-masked]>@ietf.org on 04/25/2002 12:22:22 PM

Sent by:  [email-masked]

To:   "Pete Cordell" <[email-masked]>
cc:   <[email-masked]>

Subject:  Re: [midcom] WGLC - Alternatives for 'securing' STUN

At 04:57 PM 4/25/02 +0100, Pete Cordell wrote:
>For something that is so much simpler than the other candidates, it needs
>slightly more consideration than simply saying that it's gooby.  Rome
wasn't
>built in a day.  Who knows, Rome might have been gooby in the beginning
>also.

I was referring to enterprises running their own STUN servers.

At any rate, while what you're proposing is a good idea in certain
deployments it's not a substitute for securing the STUN protocol,
which we *must* do.

Melinda

_______________________________________________
midcom mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/midcom

_______________________________________________
midcom mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/midcom

---

From: Melinda Shore <[email-masked]>
Date: Thu, 25 Apr 2002 13:43:02 -0400

>completely indifferent to cryptography?

It would be a nearly no-entropy secret.  That's not a secret.

Melinda

---

From: Keith Moore <[email-masked]>
Date: Thu, 25 Apr 2002 14:11:54 -0400

> completely indifferent to cryptography?

because it would also make STUN indifferent to security?