Subject: [Gen-art] Gen-ART LC review of draft-ietf-tram-auth-problems-02

From: Brian E Carpenter <[email-masked]>
Date: Sun, 27 Jul 2014 03:00:27 +1200

I am the assigned Gen-ART reviewer for this draft. For background on
Gen-ART, please see the FAQ at
<http://wiki.tools.ietf.org/area/gen/trac/wiki/GenArtfaq>.

Please resolve these comments along with any other Last Call comments
you may receive.

Document: draft-ietf-tram-auth-problems-02.txt
Reviewer: Brian Carpenter
Review Date: 2014-07-26
IETF LC End Date: 2014-08-08
IESG Telechat date:

Summary:  Almost ready
--------

Minor issues:
-------------

In Problem 2, would it be useful to reference RFC 6151, which indicates why
MD5 is problematic?

Problem 6 (Hosting multiple realms on a single IP address is challenging...)
doesn't really seem to be a problem with authentication as such, so while
it's clearly a problem, is it in scope? It isn't quite clear to me that
there's a security threat there.

---

From: Simon Perreault <[email-masked]>
Date: Sun, 27 Jul 2014 11:09:26 -0400

> there's a security threat there.

IMHO the draft is not limited to *security* problems, but any kind of 
problem caused by STUN's current authentication mechanism. Problem 6 is 
indeed a "missing functionality" problem.

Simon

---

From: Brian E Carpenter <[email-masked]>
Date: Mon, 28 Jul 2014 08:40:40 +1200

Bonjour Simon,

> indeed a "missing functionality" problem.

Sure. In the introduction, the draft says
   This note focuses on listing the problems with current STUN
   authentication for TURN so that it can serve as the basis for
   stronger authentication mechanisms.
That made me think that the scope was intended to be security
issues, that's all. Not a big deal, but you could clarify the scope,
e.g.

   This note focuses on listing security and practical problems with current STUN
   authentication for TURN so that it can serve as the basis for
   stronger authentication mechanisms.

 Brian

---

From: Simon Perreault <[email-masked]>
Date: Sun, 27 Jul 2014 17:25:18 -0400

>   stronger authentication mechanisms.

Works for me!

Thanks,
Simon