Subject: Re: [tram] STUN hash agility

From: "Tirumaleswar Reddy (tireddy)" <[email-masked]>
Date: Tue, 25 Mar 2014 11:58:05 +0000

Good points, will update add them to draft-ietf-tram-auth-problems.

-Tiru

From: tram [mailto:[email-masked]] On Behalf Of Oleg Moskalenko
Sent: Tuesday, March 25, 2014 1:48 AM
To: Brandon Williams
Cc: [email-masked]
Subject: Re: [tram] STUN hash agility

I suppose that that summary is good enough - it describes the problem without suggesting a particular solution.

On Mon, Mar 24, 2014 at 12:58 PM, Brandon Williams <[email-masked]<mailto:[email-masked]>> wrote:
These two problems might want separate bullets, but they are definitely both important issues with the authentication mechanism in the RFC.

--Brandon

On 03/24/2014 02:18 PM, Simon Perreault wrote:
I don't see this problem listed in draft-ietf-tram-auth-problems. Does
it need to be?

Here's a naive attempt at a summary. Please feel free to suggest
improvements.

7. STUN authentication relies on HMAC-SHA1 [RFC2104]. There is no
mechanism for hash agility in the protocol itself, although Section 16.3
of [RFC5389] does discuss a plan for migrating to a more secure
algorithm in case HMAC-SHA1 is found to be compromised. In addition,
STUN passwords are stored server-side using unsalted MD5 hashes, which
is not considered best current practice. [RFC6151]

Simon

--
Brandon Williams; Senior Principal Software Engineer
Emerging Products Engineering; Akamai Technologies Inc.

_______________________________________________
tram mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/tram