Subject: [tram] origin-02 - Security considerations.

From: "Hutton, Andrew" <[email-masked]>
Date: Wed, 12 Nov 2014 21:29:46 +0000

The recent update to the security considerations of draft-ietf-tram-stun-origin-02 states:

"The particular STUN and TURN servers used are selected by the real-time communications service provider (i.e. the web provider for WebRTC or the SIP or XMPP service provider)"

At least in the case of WebRTC I don't think this is necessarily true given the discovery mechanisms under discussion and we may also need to take in to account the turn proxy proposed in draft-schwartz-rtcweb-return-03 assuming it is adopted.

Andy

> -----Original Message-----
> From: I-D-Announce [mailto:[email-masked]] On Behalf Of
> [email-masked]
> Sent: 27 October 2014 10:37
> To: [email-masked]
> Cc: [email-masked]
> Subject: I-D Action: draft-ietf-tram-stun-origin-02.txt
> 
> 
> A New Internet-Draft is available from the on-line Internet-Drafts
> directories.
>  This draft is a work item of the TURN Revised and Modernized Working
> Group of the IETF.
> 
>         Title           : An Origin Attribute for the STUN Protocol
>         Authors         : Alan Johnston
>                           Justin Uberti
>                           John Yoakum
>                           Kundan Singh
> 	Filename        : draft-ietf-tram-stun-origin-02.txt
> 	Pages           : 13
> 	Date            : 2014-10-27
> 
> Abstract:
>    STUN, or Session Traversal Utilities for NAT, is a protocol used to
>    assist other protocols traverse Network Address Translators or NATs.
>    STUN, and STUN extensions such as TURN, or Traversal Using Relays
>    around NAT, and ICE, Interactive Communications Establishment, have
>    been around for many years but with WebRTC, Web Real-Time
>    Communications, STUN and related extensions are about to see major
>    deployments and implementation due to these protocols being
>    implemented in browsers.  This specification defines an ORIGIN
>    attribute for STUN that can be used in similar ways to the HTTP
>    header field of the same name.  WebRTC browsers utilizing STUN and
>    TURN would include this attribute which would provide servers with
>    additional information about the STUN and TURN requests they
> receive.
>    This specification defines the usage of the STUN ORIGIN attribute
> for
>    web and SIP contexts.
> 
> 
> The IETF datatracker status page for this draft is:
> https://datatracker.ietf.org/doc/draft-ietf-tram-stun-origin/
> 
> There's also a htmlized version available at:
> http://tools.ietf.org/html/draft-ietf-tram-stun-origin-02
> 
> A diff from the previous version is available at:
> http://www.ietf.org/rfcdiff?url2=draft-ietf-tram-stun-origin-02
> 
> 
> Please note that it may take a couple of minutes from the time of
> submission
> until the htmlized version and diff are available at tools.ietf.org.
> 
> Internet-Drafts are also available by anonymous FTP at:
> ftp://ftp.ietf.org/internet-drafts/
> 
> _______________________________________________
> I-D-Announce mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/i-d-announce
> Internet-Draft directories: http://www.ietf.org/shadow.html
> or ftp://ftp.ietf.org/ietf/1shadow-sites.txt