Subject: [tram] I-D Action: draft-ietf-tram-turn-third-party-authz-09.txt

From: [email-masked]
Date: Thu, 05 Feb 2015 17:17:02 -0800

A New Internet-Draft is available from the on-line Internet-Drafts directories.
 This draft is a work item of the TURN Revised and Modernized Working Group of the IETF.

        Title           : Session Traversal Utilities for NAT (STUN) Extension for Third Party Authorization
        Authors         : Tirumaleswar Reddy
                          Prashanth Patil
                          Ram Mohan Ravindranath
                          Justin Uberti
	Filename        : draft-ietf-tram-turn-third-party-authz-09.txt
	Pages           : 23
	Date            : 2015-02-05

Abstract:
   This document proposes the use of OAuth to obtain and validate
   ephemeral tokens that can be used for Session Traversal Utilities for
   NAT (STUN) authentication.  The usage of ephemeral tokens ensures
   that access to a STUN server can be controlled even if the tokens are
   compromised.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-tram-turn-third-party-authz/

There's also a htmlized version available at:
http://tools.ietf.org/html/draft-ietf-tram-turn-third-party-authz-09

A diff from the previous version is available at:
http://www.ietf.org/rfcdiff?url2=draft-ietf-tram-turn-third-party-authz-09

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: "Tirumaleswar Reddy (tireddy)" <[email-masked]>
Date: Fri, 6 Feb 2015 01:20:08 +0000

This revision addresses comments from Yaron and Tom.

-Tiru

> -----Original Message-----
> From: tram [mailto:[email-masked]] On Behalf Of internet-
> [email-masked]
> Sent: Friday, February 06, 2015 6:47 AM
> To: [email-masked]
> Cc: [email-masked]
> Subject: [tram] I-D Action: draft-ietf-tram-turn-third-party-authz-09.txt
> 
> 
> _______________________________________________
> tram mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tram

---

From: "Tirumaleswar Reddy (tireddy)" <[email-masked]>
Date: Fri, 6 Feb 2015 10:18:09 +0000

> From: Yaron Sheffer [mailto:[email-masked]]
> Sent: Friday, February 06, 2015 3:36 PM
> To: Tirumaleswar Reddy (tireddy); [email-masked]
> Cc: Tom Taylor ([email-masked])
> Subject: Re: [tram] I-D Action: draft-ietf-tram-turn-third-party-authz-09.txt
> 
> Hi Tiru,
> 
> Thanks for the new revision. One remaining comment:
> 
> Looking at 4.1.1 and the HKDF algorithm, I believe that your AUTH key is
> identical to the first 20 bytes of the AS-RS key, which is definitely not what
> you'd want. As I'm sure you know, the standard way to separate two derived
> keys is to append a string like "auth" or "as-rs" to the input.

Good catch, fixed.

-Tiru

> 
> Thanks,
> 	Yaron
> 
> On 02/06/2015 03:20 AM, Tirumaleswar Reddy (tireddy) wrote:
> >> Subject: [tram] I-D Action:
> >> draft-ietf-tram-turn-third-party-authz-09.txt
> >>
> >>
> >>          Title           : Session Traversal Utilities for NAT (STUN) Extension for
> Third
> >> Party Authorization
> >> Please note that it may take a couple of minutes from the time of
> >> submission until the htmlized version and diff are available at
> tools.ietf.org.
> >>

---

From: Yaron Sheffer <[email-masked]>
Date: Fri, 06 Feb 2015 12:06:19 +0200

Hi Tiru,

Looking at 4.1.1 and the HKDF algorithm, I believe that your AUTH key is 
identical to the first 20 bytes of the AS-RS key, which is definitely 
not what you'd want. As I'm sure you know, the standard way to separate 
two derived keys is to append a string like "auth" or "as-rs" to the input.

Thanks,
	Yaron

---

From: Tom Taylor <[email-masked]>
Date: Sat, 07 Feb 2015 16:20:33 -0500

Looks good. There is editorial work to be done, but I'll leave that to 
the RFC Ed.

Tom Taylor