Subject: [MMUSIC] draft-ietf-mmusic-ice-05 (connectivity check binding request quer ies)

From: Vavilapalli Srikanth-A19563 <[email-masked]>
Date: Tue, 6 Sep 2005 14:36:21 +0530

Hi

Can anyone clarify me the following questions? Appreciate your help.

1.	In section 7.4.1.1 of draft-ietf-mmusic-ice-05.txt, it was mentioned
that the STUN Binding request used for connectivity check may contain the
MESSAGE-INTEGRITY attribute, computed according to RFC3489. But what is the
key (or shared secret password) used for computing HMAC?

2.	In section 12, it was mentioned that the attacker can not answer the
STUN request without access to the username and password, which are
exchanged as part of SIP signaling
a.	Where is the password exchanged in signaling? I read that the
concatenation of transport-ids exchanged in the signaling form the USERNAME
attribute for STUN binding request. But I didn't see anywhere about PASSWORD
being generated.
b.	Also why does attacker need USERNAME/PASWORD attribute to send a
binding response back to the source IP? 

Please let me know if I am missing some thing in the document.

Regards
Srikanth Vavilapalli

_______________________________________________
mmusic mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mmusic