Subject: [MMUSIC] ICEbis: INTEGRITY attribute in Binding Responses clarification

From: "Pal Martinsen (palmarti)" <[email-masked]>
Date: Tue, 2 Apr 2013 09:59:17 +0000

Hi,

I was reading through the ICE RFC and trying to figure out if Binding Responses needed the INTEGRITY attribute. Usually the ICE RFC is very descriptive in what to include in the messages, but I could not find any text clearly stating that the INTEGRITY attribute must be included in the Binding Responses. 

When reading the STUN RFC it states in section 7.3.1.1:
"If the server authenticated the request using an authentication
 mechanism, then the server SHOULD add the appropriate authentication
 attributes to the response (see Section 10)."

Is this SHOULD strong enough for the connectivity checks performed by ICE? 
Should it be changed to a MUST?

To spell it out for readers like me, I propose the following changes to section 7.2 the second paragraph of the ICE RFC
(http://tools.ietf.org/html/draft-keranen-mmusic-rfc5245bis-01#section-7.2)

 The agent MUST use a short-term credential (i.e., the
 MESSAGE-INTEGRITY attribute) to authenticate and
 perform a message integrity check on the request and 
 any response to that request. 

Adding the following to section 7.1.3.1 might also help to remind the implementors:

  The agent MUST use the INTEGRITY-MESSAGE attribute in the Binding Response to authenticate the message. 

.-.
Pål-Erik Martinsen

---

From: Ari Keränen <[email-masked]>
Date: Thu, 18 Apr 2013 20:29:10 +0300

Hi Pål-Erik,

I agree that making this more explicit makes sense.

The second paragraph of 7.2 starts now with:

    The agent MUST use the short-term credential mechanism (i.e., the
    MESSAGE-INTEGRITY attribute) to authenticate the request and perform
    a message integrity check.  Likewise, the short-term credential
    mechanism MUST be used for the response.

Unless someone sees some problem with this (in that case, please 
comment), I'll make this change for the next revision.

Cheers,
Ari

On 4/2/13 12:59 PM, Pal Martinsen (palmarti) wrote:
> Hi,
>
> I was reading through the ICE RFC and trying to figure out if Binding
> Responses needed the INTEGRITY attribute. Usually the ICE RFC is very
> descriptive in what to include in the messages, but I could not find
> any text clearly stating that the INTEGRITY attribute must be
> included in the Binding Responses.
>
> When reading the STUN RFC it states in section 7.3.1.1: "If the
> server authenticated the request using an authentication mechanism,
> then the server SHOULD add the appropriate authentication attributes
> to the response (see Section 10)."
>
> Is this SHOULD strong enough for the connectivity checks performed by
> ICE? Should it be changed to a MUST?
>
> To spell it out for readers like me, I propose the following changes
> to section 7.2 the second paragraph of the ICE RFC
> MESSAGE-INTEGRITY attribute) to authenticate and perform a message
> integrity check on the request and any response to that request.
>
> .-. Pål-Erik Martinsen