Subject: [midcom] STUN 05 - clarification

From: "Panayiotis A. Thermos" <[email-masked]>
Date: Fri, 10 Jan 2003 12:34:22 -0500

greetings,

can someone clarify the following sentence in draft-ietf-midcom-stun-05?

Section 8.1, page 14  the paragraph before the last paragraph:

"If the username present in the request was not allocated using a Shared
Secret Request, the REFLECTED-FROM attribute MUST contain the
source address and port of the entity which obtained the username,
as best can be verified with the mechanism used to allocate the username."

How we can assert which entity obtained the username?
Can someone give an example?

What does it mean "as best can be verified with the mechanism used to
allocate the username"?

If the username was not assigned by the respective STUN server that handles
the request how it can verify the username (besides performing another
message
exchange with another STUN  server which presumably assigned the username,
which may require additional authentication )?

Thanks for your help

Peter

_______________________________________________
midcom mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/midcom

---

From: Jonathan Rosenberg <[email-masked]>
Date: Sat, 11 Jan 2003 22:53:17 -0500

inline.

> How we can assert which entity obtained the username?

It depends on the mecahnism used to allocate them. For example, if its 
kerberos, then the IP address of the entity to which the ticket was 
granted will suffice.

> Can someone give an example?

See above.

> What does it mean "as best can be verified with the mechanism used to

Presumably, the mechanism has a way to verify that the username request 
is not coming from a spoofed IP address. An "anonymous" challenge, which 
requires the client to reflect a nonce handed it by the server, can be 
used to verify the return routability. That is, the client whose source 
IP was X in the request is capable of receiving IP packets sent to that 
IP address.

> which may require additional authentication )?

This was just leaving a hook for other mechanisms to be used.

-Jonathan R.
-- 
Jonathan D. Rosenberg, Ph.D.                72 Eagle Rock Ave.
Chief Scientist                             First Floor
dynamicsoft                                 East Hanover, NJ 07936
[email-masked]                     FAX:   (973) 952-5050
http://www.jdrosen.net                      PHONE: (973) 952-5000
http://www.dynamicsoft.com