Subject: Re: [tram] Alexey Melnikov's Discuss on draft-ietf-tram-turn-server-discovery-09: (with DISCUSS)

From: Alexey Melnikov <[email-masked]>
Date: Thu, 1 Sep 2016 08:18:33 +0100

Hi,

On 1 Sep 2016, at 04:48, Tirumaleswar Reddy (tireddy) <[email-masked]> wrote:

>> -----Original Message-----
>> From: Alexey Melnikov [mailto:[email-masked]]
>> Sent: Wednesday, August 31, 2016 9:11 PM
>> To: The IESG <[email-masked]>
>> Cc: [email-masked]; Simon Perreault
>> <[email-masked]>; [email-masked]; [email-masked];
>> [email-masked]
>> Subject: Alexey Melnikov's Discuss on draft-ietf-tram-turn-server-discovery-
>> 09: (with DISCUSS)
>> 
>> Alexey Melnikov has entered the following ballot position for
>> draft-ietf-tram-turn-server-discovery-09: Discuss
>> 
>> When responding, please keep the subject line intact and reply to all email
>> addresses included in the To and CC lines. (Feel free to cut this introductory
>> paragraph, however.)
>> 
>> 
>> Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
>> for more information about IESG DISCUSS and COMMENT positions.
>> 
>> 
>> The document, along with other ballot positions, can be found here:
>> https://datatracker.ietf.org/doc/draft-ietf-tram-turn-server-discovery/
>> 
>> 
>> 
>> ----------------------------------------------------------------------
>> DISCUSS:
>> ----------------------------------------------------------------------
>> 
>> In Section 9:
>> 
>> o  For certificate-based authentication, a pre-populated trust anchor
>>      store [RFC6024] allows a TURN client to perform path validation
>>      for the server certificate obtained during the (D)TLS handshake.
>> 
>>      If the client used a domain name to discover the TURN server, that
>>      domain name also provides a mechanism for validation of the TURN
>>      server.  The client MUST use the rules and guidelines given in
>>      section 6 of [RFC6125] to validate the TURN server identity.
>> 
>> I am glad that you are referencing RFC 6125, but unfortunately you don't
>> provide enough details. Please add details as specified in Section 3 of RFC
>> 6125 to your document.
> 
> Sure, will add the following lines:
> Certification authorities that issue TURN server certificates SHOULD support the DNS-ID and SRV-ID identifier types. TURN service providers SHOULD include the DNS-ID and SRV-ID identifier types in certificate requests.

What about use of CN-IDs and URI-IDs? Wildcards?

---

From: "Tirumaleswar Reddy (tireddy)" <[email-masked]>
Date: Fri, 2 Sep 2016 03:02:13 +0000

> Sent: Thursday, September 1, 2016 12:49 PM
> To: Tirumaleswar Reddy (tireddy) <[email-masked]>
> Cc: The IESG <[email-masked]>; [email-masked];
> Simon Perreault <[email-masked]>; [email-masked]; [email-masked]
> Subject: Re: Alexey Melnikov's Discuss on draft-ietf-tram-turn-server-
> discovery-09: (with DISCUSS)
> 
> Hi,
> 
> >> When responding, please keep the subject line intact and reply to all
> >> email addresses included in the To and CC lines. (Feel free to cut
> >> this introductory paragraph, however.)
> >>
> >>
> >> Please refer to
> >> https://www.ietf.org/iesg/statement/discuss-criteria.html
> >> I am glad that you are referencing RFC 6125, but unfortunately you
> >> don't provide enough details. Please add details as specified in
> >> Section 3 of RFC
> >> 6125 to your document.
> >
> > Certification authorities that issue TURN server certificates SHOULD support
> the DNS-ID and SRV-ID identifier types. TURN service providers SHOULD
> include the DNS-ID and SRV-ID identifier types in certificate requests.
> 
> What about use of CN-IDs and URI-IDs? 

Yes, added.

> Wildcards ?

I don't think wildcards are required.

-Tiru

---

From: Alexey Melnikov <[email-masked]>
Date: Fri, 2 Sep 2016 09:32:08 +0100

Hi,

>> What about use of CN-IDs and URI-IDs?

Just to clarify: you can pick which ones of the 4 types you want to use, you can disallow some. You just have to be explicit.
> I don't think wildcards are required.

Please say so in the document.

---

From: "Tirumaleswar Reddy (tireddy)" <[email-masked]>
Date: Tue, 6 Sep 2016 02:05:04 +0000

> Sent: Friday, September 2, 2016 2:02 PM
> >> Cc: The IESG <[email-masked]>;
> >> [email-masked];
> >> On 1 Sep 2016, at 04:48, Tirumaleswar Reddy (tireddy)
> >> <[email-masked]>
> >> wrote:
> >>
> >>>> When responding, please keep the subject line intact and reply to
> >>>> all email addresses included in the To and CC lines. (Feel free to
> >>>> cut this introductory paragraph, however.)
> >>>>
> >>>>
> >>>> Please refer to
> >>>> https://datatracker.ietf.org/doc/draft-ietf-tram-turn-server-discov
> >>>> er
> >>>> y/
> >>>>
> >>>>
> >>>>
> >>>> -------------------------------------------------------------------
> >>>> --
> >>>> -
> >>>> DISCUSS:
> >>>> -------------------------------------------------------------------
> >>>> --
> >>>> -
> >>>>
> >>>> In Section 9:
> >>>>
> Just to clarify: you can pick which ones of the 4 types you want to use, you can
> disallow some. You just have to be explicit.

Okay.

> Please say so in the document.

Sure, will update.

-Tiru