Subject: [tram] Questions on STUN credentials and MD5

From: "Duckworth, Mark" <[email-masked]>
Date: Tue, 22 Jul 2014 18:42:55 -0700

Hello,
I am a complete beginner regarding STUN and TURN, but I'm interested in one of the issues in draft-ietf-tram-auth-problems-02.  Section 4 paragraph 2 describes the problem with using MD5 for STUN long term credentials.  A few questions about that -

1.       Does draft-ietf-tram-turn-third-party-authz solve the problem, because it provides a different way to do authentication which does not require MD5, and which can be FIPS 140-2 compliant?

2.       There was previous discussion about replacing MD5, possibly with SHA256, for the key calculation and storage.  http://www.ietf.org/mail-archive/web/tram/current/msg00466.html.  Is that still a possibility, or did the group decide against that?

3.       At first I thought maybe draft-ietf-tram-stun-dtls could also solve the problem, because the hashed key would be further protected by DTLS.  But that wouldn't help with the issue of storing the MD5 hashed keys on the TURN server side, would it?  Do I understand correctly?
Thanks for the help.
Mark Duckworth