Subject: [pntaw] FW: New Version Notification for draft-wing-pcp-third-party-authz-01.txt

From: "Tirumaleswar Reddy (tireddy)" <[email-masked]>
Date: Mon, 23 Sep 2013 07:14:30 +0000

This draft http://tools.ietf.org/html/draft-wing-pcp-third-party-authz-01 describes the mechanism for firewalls to only permit UDP media session 
associated with specific WebRTC servers. This addresses the firewall problem in Enterprise network without having to do DPI on 
WebRTC signaling protocol.

-Authors.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] 
Sent: Friday, September 13, 2013 1:55 PM
To: Prashanth Patil (praspati); Tirumaleswar Reddy (tireddy); Reinaldo Penno (repenno); Dan Wing (dwing)
Subject: New Version Notification for draft-wing-pcp-third-party-authz-01.txt

A new version of I-D, draft-wing-pcp-third-party-authz-01.txt
has been successfully submitted by Dan Wing and posted to the
IETF repository.

Filename:	 draft-wing-pcp-third-party-authz
Revision:	 01
Title:		 PCP Extension for Third Party Authorization
Creation date:	 2013-09-13
Group:		 Individual Submission
Number of pages: 16
URL:             http://www.ietf.org/internet-drafts/draft-wing-pcp-third-party-authz-01.txt
Status:          http://datatracker.ietf.org/doc/draft-wing-pcp-third-party-authz
Htmlized:        http://tools.ietf.org/html/draft-wing-pcp-third-party-authz-01
Diff:            http://www.ietf.org/rfcdiff?url2=draft-wing-pcp-third-party-authz-01

Abstract:
   It is often desirable for an application server to permit a flow
   across a firewall, as happens today when a firewall includes an
   Application Layer Gateway (ALG) function.  However, an ALG has
   several weaknesses.

   This document describes a cryptographic technique for an application
   server to permit a flow across a firewall.  This technique uses OAuth
   and a new PCP option.

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

The IETF Secretariat

---

From: <[email-masked]>
Date: Thu, 26 Sep 2013 12:16:19 +0000

Hi,

Tirumaleswar Reddy wrote:
> 
> This draft http://tools.ietf.org/html/draft-wing-pcp-third-party-authz-01
> describes the mechanism for firewalls to only permit UDP media session
> associated with specific WebRTC servers. This addresses the firewall problem
> in Enterprise network without having to do DPI on WebRTC signaling
> protocol.
> 

While adding support for TURN over TLS (or TURN over Websockets) via proxy based connections is important to make WebRTC deployable in the near term, I also believe that this type of more explicit and dynamic firewall authorization solution is valuable in the long term.

Markus

---

From: "Hutton, Andrew" <[email-masked]>
Date: Fri, 27 Sep 2013 07:51:27 +0000

Agree with Markus that this may be useful in the longer term but only for the more sophisticated enterprise deployments that are WebRTC aware.

So I see it as complementary to other solutions (E.g. Websockets, TURN/TLS etc.) not as an alternative.

Andy

> From: [email-masked] [mailto:[email-masked]] On Behalf
> Of [email-masked]
> Sent: 26 September 2013 13:16
> To: [email-masked]; [email-masked]
> Subject: Re: [pntaw] FW: New Version Notification for draft-wing-pcp-
> third-party-authz-01.txt
> 
> Hi,
> 
> While adding support for TURN over TLS (or TURN over Websockets) via
> proxy based connections is important to make WebRTC deployable in the
> near term, I also believe that this type of more explicit and dynamic
> firewall authorization solution is valuable in the long term.
> 
> Markus
> _______________________________________________
> pntaw mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/pntaw