Subject: Re: [tram] [BEHAVE] errata 4933: RFC 5766 prevent spoofed refresh requests when using short-term credentials

From: Michael Richardson <[email-masked]>
Date: Thu, 16 Jan 2020 20:26:52 -0500

https://www.rfc-editor.org/errata_search.php?eid=4933

    4933> Section 17.3.3 says:

    4933> An attacker might attempt to disrupt service to other users of the
    4933> TURN server by sending Refresh requests or CreatePermission requests
    4933> that (through source address spoofing) appear to be coming from
    4933> another user of the TURN server.  TURN prevents this by requiring
    4933> that the credentials used in CreatePermission, Refresh, and
    4933> ChannelBind messages match those used to create the initial
    4933> allocation.  Thus, the fake requests from the attacker will be
    4933> rejected.
    4933> Notes:

    4933> When using short-term, credentials expire after a specific amount of time
    4933> (such as 5
    4933> minutes) and clients get new credentials. The restriction imposed at section
    4933> 17.3.3
    4933> prevents from refreshing allocation or permission using the new credentials.

    4933> This RFC approves RFC 5389. So one can use short-term credentials. But
    4933> short-term credentials are useless if it can not be used to refresh
    4933> allocation or permission.

    4933> The goal of 17.3.3 can be achieved by sending 438 with the new nonce.

a) I think we should accept this as verified.
b) It seems that sending with the new nonce will work.  This requires some
   text changes, and we can now perhaps use the errata patcher with XML.
   I've asked for the XML (if there is any), and I'll suggest some changes to
   the text.

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-

---

From: Justin Uberti <[email-masked]>
Date: Fri, 17 Jan 2020 10:00:48 -0800

Both a/b seem sensible to me.

On Thu, Jan 16, 2020 at 5:27 PM Michael Richardson <[email-masked]>
wrote:

> _______________________________________________
> Behave mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/behave
>

---

From: Magnus Westerlund <[email-masked]>
Date: Fri, 24 Jan 2020 16:28:55 +0000

Hi,

I think the primary question is if this errata points to an issue that remains
within the updated TURN specification: 

https://datatracker.ietf.org/doc/draft-ietf-tram-turnbis/

So the question to the TRAM WG people. 

Section 21.3.3. (the equivalent to 17.3.3) has the same text. However, I think
the underlying question is if the existing mechanism and especially for stale
nonce prevents an insider attacker that otherwise have the user name and
password for the user can take over an allocation when the nonce expires? 

However, I have the suspistion that the reporter has made an erronous assumption
as short-term security is not allowed with TURN. Section 4 of RFC 5766 do
requires long-term or other equal strong mechanism. Thus, another aspect is if
the nonce actually will expire? Or can a client actually loose their allocations
when the nonce expires and attacker manages to make the request first? 

Cheers

Magnus Westerlund

-- 
Cheers

Magnus Westerlund 

----------------------------------------------------------------------
Networks, Ericsson Research
----------------------------------------------------------------------
Ericsson AB                 | Phone  +46 10 7148287
Torshamnsgatan 23           | Mobile +46 73 0949079
SE-164 80 Stockholm, Sweden | mailto: [email-masked]
----------------------------------------------------------------------

---

From: "Konda, Tirumaleswar Reddy" <[email-masked]>
Date: Mon, 27 Jan 2020 12:56:23 +0000

The short-term credential mechanism for TURN is discussed in https://tools.ietf.org/html/rfc7635, it addresses both the issues raised by the reporter

a) Section 9 says,  If the access token expires, then the client MUST obtain a new token from the authorization server and use it for new
    allocations.  The client MUST use the new token to refresh existing allocations.  This way, the client has to maintain only
    one token per TURN server.
b) Section 11 discusses frequently changing the nonce.

Cheers,
-Tiru

> -----Original Message-----
> From: tram <[email-masked]> On Behalf Of Magnus Westerlund
> Sent: Friday, January 24, 2020 9:59 PM
> To: [email-masked]; juberti=[email-masked]
> Cc: [email-masked]; [email-masked]
> Subject: Re: [tram] [BEHAVE] errata 4933: RFC 5766 prevent spoofed refresh
> requests when using short-term credentials
> 
> Hi,
> 
> However, I have the suspistion that the reporter has made an erronous
> assumption as short-term security is not allowed with TURN. Section 4 of RFC
> 5766 do requires long-term or other equal strong mechanism. Thus, another
> aspect is if the nonce actually will expire? Or can a client actually loose their
> allocations when the nonce expires and attacker manages to make the
> request first?
> 
> Cheers
> 
> Magnus Westerlund
> 
> 
> > >     4933> This RFC approves RFC 5389. So one can use short-term
> credentials.
> > > But
> > >    text changes, and we can now perhaps use the errata patcher with
> XML..