Subject: [tram] [Technical Errata Reported] RFC7635 (4826)

From: RFC Errata System <[email-masked]>
Date: Mon, 10 Oct 2016 06:57:13 -0700 (PDT)

The following errata report has been submitted for RFC7635,
"Session Traversal Utilities for NAT (STUN) Extension for Third-Party Authorization".

--------------------------------------
You may review the report below and at:
http://www.rfc-editor.org/errata_search.php?rfc=7635&eid=4826

--------------------------------------
Type: Technical
Reported by: Mihály Mészáros <[email-masked]>

Section: 8.

Original Text
-------------
8.  STUN Client Behavior

   o  The client looks for the MESSAGE-INTEGRITY attribute in the
      response.  If MESSAGE-INTEGRITY is absent or the value computed
      for message integrity using mac_key does not match the contents of
      the MESSAGE-INTEGRITY attribute, then the response MUST be
      discarded.

   o  If the access token expires, then the client MUST obtain a new
      token from the authorization server and use it for new STUN
      requests.

Corrected Text
--------------
8.  STUN Client Behavior

   o  The client looks for the MESSAGE-INTEGRITY attribute in the
      response.  If MESSAGE-INTEGRITY is absent or the value computed
      for message integrity using mac_key does not match the contents of
      the MESSAGE-INTEGRITY attribute, then the response MUST be
      discarded.

9.  Application (OAuth Client) Behavior

   o  If the access token expires, then the Application (OAuth client) 
      MUST obtain a new token from the authorization server, and update
      STUN client to use it for new STUN requests.

   o  Application SHOULD pass only a subset of the received OAuth 
      parameters to the STUN client. Only parameters SHOULD be passed 
      that will be really needed and used by the STUN Client. 
      In this way, only the kid, the mac_key, and the access_token
      parameters SHOULD be passed to the STUN client.

...
Renumber the sections
...

Notes
-----
1. Remove from STUN client behaviour the access_token renewal function, 
and move this function up to application level.
2. Pass to STUN only that subset of the OAuth parameters, that will be really used by STUN Client.

Instructions:
-------------
This erratum is currently posted as "Reported". If necessary, please
use "Reply All" to discuss whether it should be verified or
rejected. When a decision is reached, the verifying party (IESG)
can log in to change the status and edit the report, if necessary. 

--------------------------------------
RFC7635 (draft-ietf-tram-turn-third-party-authz-16)
--------------------------------------
Title               : Session Traversal Utilities for NAT (STUN) Extension for Third-Party Authorization
Publication Date    : August 2015
Author(s)           : T. Reddy, P. Patil, R. Ravindranath, J. Uberti
Category            : PROPOSED STANDARD
Source              : TURN Revised and Modernized
Area                : Transport
Stream              : IETF
Verifying Party     : IESG