Subject: [Ietf-behave] REALM in draft-ietf-behave-rfc3489bis-03

From: Greg Daley <[email-masked]>
Date: Mon, 8 May 2006 09:14:20 -0700 (PDT)

Hi,

I've got a question about use of REALM in RFC3489bis-03,
which was raised by one of our developers.
Is it necessary to test for the REALM attribute in
received Request messages, even if Short Term credentials
are being used?
When using method two from Section 8.1.2:

   2.  use a short term credential, as determined by the STUN usage.  In
       this case, the STUN Request or STUN Indication would contain the
       USERNAME and MESSAGE-INTEGRITY attributes.  The message would not
       contain the NONCE attribute.  The key for MESSAGE-INTEGRITY is
       the password.
There's no REALM, but in section 9.1.1 (paragraph 2 of page 18):

   If the MESSAGE-INTEGRITY attribute was present, the server checks for
   the existence of the REALM attribute.  If the attribute is not
   present, the server MUST generate an error response.  That error
   response MUST include an ERROR-CODE attribute with response code of
   434.  That error response MUST also include a NONCE and a REALM
   attribute.
This seems to conflict, in that it implies that the REALM is always
present if MESSAGE-INTEGRITY is present.
Also, it's not exactly obvious in the document, what constitutes
Short Term and Long Term authentication.  It is possible to
infer that Short Term authentication is using
Shared Secret Request, ICE or equivalent, but there's little
description of Long Term authentication (reference to 3261 section
22 is probably appropriate).
The most appropriate description of the terms I found was in:

http://permalink.gmane.org/gmane.ietf.nat.behave/776

Clarification within the document would be appreciated.

Greg Daley

---

From: Jonathan Rosenberg <[email-masked]>
Date: Wed, 5 Jul 2006 14:17:17 -0700 (PDT)

inline.

Greg Daley wrote:

Hi,

REALM is not used with short term credentials, no.

   If the MESSAGE-INTEGRITY attribute was present, the server checks for
   the existence of the REALM attribute.  If the attribute is not
   present, the server MUST generate an error response.  That error
   response MUST include an ERROR-CODE attribute with response code of
   434.  That error response MUST also include a NONCE and a REALM
   attribute.
This seems to conflict, in that it implies that the REALM is always
present if MESSAGE-INTEGRITY is present.
Yes, this was a bug. I have fixed it in -04. -03 had two sections on 
authentication which were in conflict. One focused entirely on long term 
credential authentication, and the other had the more general procedures.

Clarification within the document would be appreciated.
Hopefully -04 is clearer in this.

-Jonathan R.

--
Jonathan D. Rosenberg, Ph.D.                   600 Lanidex Plaza
Cisco Fellow                                   Parsippany, NJ 07054-2711
Cisco Systems
jdrosen@xxxxxxxxx                              FAX:   (973) 952-5050
http://www.jdrosen.net                         PHONE: (973) 952-5000
http://www.cisco.com