Subject: [BEHAVE] TURN: Clarifications around nonce usage

From: Philip Matthews <[email-masked]>
Date: Mon, 9 Feb 2009 20:40:30 -0500

Brian Carpenter, in his Gen-ART review of TURN, asked:

>>> 17.1.5.  Impersonating a Server
>> ...
>>>   This attack is prevented through the digest authentication
>> mechanism,
>>>   which provides message integrity for responses in addition to
>>>   verifying that they came from the server.
>>
>> I'm no expert, but is this subject to the sort of vulnerability
>> discussed in RFC4169, if an attacker has observed previous traffic
>> and is capable of spoofing the server's IP address?

After some private e-mail discussions, it seems that the attack that  
Brian mentioned is mitigated by choosing the nonce value appropriately  
and rotating it frequently. However, Brian's comment caused us to  
realize that there is no explicit text about this in the TURN document  
(there is some discussion of this in the STUN spec, but it is pretty  
general).

Dan Wing suggested adding some specific recommendations on this point.  
His proposal, slightly modified by me, is to add the following to  
section 4 in the paragraph that discusses the use of STUN's Long-Term  
Credential mechanism:

     For each allocation, the server SHOULD generate a new random nonce
     when the allocation is first attempted following the randomness
     recommendations in [RFC4086] and SHOULD expire the nonce at least
     once every hour during the lifetime of the allocation.

I am proposing to put these requirements at the SHOULD level since  
they do not affect interoperability, since this is being added rather  
late in the process, and since the choice of "at least once every  
hour" is somewhat arbitrary and is based more on what seems right  
rather than hard evidence.

Comments?

- Philip