Subject: Re: [rtcweb] Security issue: initial consent

From: Matthew Kaufman <[email-masked]>
Date: Mon, 07 Nov 2011 13:48:35 -0800

On 10/27/11 6:40 PM, Harald Alvestrand wrote:
> On 10/27/2011 04:44 PM, Matthew Kaufman wrote:
>> On 10/28/11 12:39 AM, Hadriel Kaplan wrote:
>>> ...
>>>    Heck, we could even mandate using a new TCP header option to be 
>>> reflected by the other side, similar to the TCP Timestamp option, 
>>> but put a random number in it.
>>>
>>
>> Again, the STUN connectivity test used by ICE does more than simply 
>> prove that the far end got the packet and can reflect it back. The 
>> reflection isn't even done unless the long-term credentials are valid.
> Nit: the STUN usage I have seen so far uses short-term credentials 
> (ephemeral username + password, RFC 5389 section 10.1) per RFC 5245 
> section 7.1.2.3, not long-term credentials (realm + username + 
> password, RFC 5389 section 10.2).
>
> Since "short term" and "long term" are used with specific meaning in 
> ICE, I hope we're using them in the same way in this discussion.

Correct. I had been looking at TURN code that day, sorry about the mix-up.

Matthew Kaufman