Subject: Re: [rtcweb] Consent alternative

From: "Tirumaleswar Reddy (tireddy)" <[email-masked]>
Date: Wed, 22 Jan 2014 17:01:22 +0000

Hi Martin,

Please see inline

> -----Original Message-----
> From: Martin Thomson [mailto:[email-masked]]
> Sent: Wednesday, January 22, 2014 8:11 PM
> To: Tirumaleswar Reddy (tireddy)
> Cc: Muthu Arul Mozhi Perumal (mperumal); Cullen Jennings (fluffy);
> [email-masked]
> Subject: Re: [rtcweb] Consent alternative
> 
> On 22 January 2014 13:29, Tirumaleswar Reddy (tireddy)
> <[email-masked]> wrote:
> > If we consider B attacker is also capable of sniffing packets on wire,
> > DTLS heartbeat does not have any benefit over STUN consent because B
> > can sniff the DTLS heartbeat request sent by A and generate response.
> 
> This is not correct, but not really important either.  DTLS ensures that an on-
> path attacker is unable to observe or insert packets.  If B is on-path and able
> to read signaling, it can return STUN consent.
> But we've already determined that on-path attackers aren't interesting when
> it comes to DoS.

I am still referring to off-path attacker only who can sniff packets and spoof IP address but cannot modify or consume packets.

-Tiru.

---

From: Martin Thomson <[email-masked]>
Date: Thu, 23 Jan 2014 05:13:19 +0100

> I am still referring to off-path attacker only who can sniff packets and spoof IP address but cannot modify or consume packets.

How exactly is this attacker able to generate a valid heartbeat?