Subject: [AVT] Comment on Section 4.1 of draft-ietf-avt-ports-for-ucast-mcast-rtp-09.txt

From: "Glen Zorn" <[email-masked]>
Date: Thu, 16 Dec 2010 14:42:19 +0700

The description of the Random Nonce field of the Port Mapping Request
message says:

Random Nonce (64 bits):  Field that contains a random nonce value generated
by the client following the procedures of [RFC4086].

1) A naïve reader might imagine from this sentence that RFC 4086 describes
one or more methods for generating a nonce but it doesn't.  In fact, the
word "nonce" doesn't occur in that document at all.

2) Is there really a need for randomness in this nonce?  The next sentence
says:

      This nonce is taken into account by the server when generating a Token
for the client to enable better security for clients that share the same IP
address.  

This statement doesn't provide much rationale for randomness.  For example,
if the clients are from the same code base, using a conventional PRNG with a
hard-coded seed value (or a seed value from a shared configuration file,
etc.), they will all generate the same sequence of tokens; in this case, and
assuming that the clients are running in different processes, the
combination of IP address, process ID and wall-clock time would produce a
nonce guaranteed to be temporally and globally unique, which generally the
point of a nonce.

	If the Port Mapping Request message is transmitted multiple times
for redundancy reasons, the random 
	nonce value MUST remain the same in these duplicated messages.
However, the client MUST generate a new random nonce for every new Port
Mapping Request message.

Maybe it's just me, but I find this passage less than crystalline; suggest
changing it to:

	If the same Port Mapping Request message is transmitted multiple
times for redundancy reasons, the random
      nonce value MUST remain the same in these duplicated messages.
However, the client MUST generate a new random nonce for every new Port
Mapping Request message.

---

From: "Ali C. Begen (abegen)" <[email-masked]>
Date: Thu, 16 Dec 2010 03:27:48 -0800

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of Glen Zorn
> Sent: Thursday, December 16, 2010 2:42 AM
> To: [email-masked]
> Subject: [AVT] Comment on Section 4.1 ofdraft-ietf-avt-ports-for-ucast-mcast-rtp-09.txt
> 

We can change it to:

Random Nonce (64 bits):  Field that contains a random value generated by the client following the procedures of [RFC4086].
 
> nonce guaranteed to be temporally and globally unique, which generally the

The goal was to cover the cases when multiple clients were running on the same hardware/software. So the latter part above explains it better. We can put that text after the definition for nonce.
 
> However, the client MUST generate a new random nonce for every new Port

Sounds better.

Thanks.
-acbegen
 
> _______________________________________________
> Audio/Video Transport Working Group
> [email-masked]
> https://www.ietf.org/mailman/listinfo/avt