Subject: [tram] Stephen Farrell's Discuss on draft-ietf-tram-turn-mobility-07: (with DISCUSS)

From: "Stephen Farrell" <[email-masked]>
Date: Thu, 01 Sep 2016 05:55:37 -0700

Stephen Farrell has entered the following ballot position for
draft-ietf-tram-turn-mobility-07: Discuss

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-tram-turn-mobility/

----------------------------------------------------------------------
DISCUSS:
----------------------------------------------------------------------

Apologies if these discuss points are off-base, I was pressed
for time when reviewing this:-(

(1) section 6 correctly says that encryption and integrity
protection are needed to prevent attacks, but the wording
seems ambiguous. Does the MUST here mean that a) TURN servers
MUST use strong crypto whenever they send tickets or b) if a
TURN server does not use strong crypto then tickets can be
abused? I hope it's the former, but in any case I think you
need to clearly say.

(2) I guess the use of (D)TLS is fairly clear here. But I'm
less clear that things are ok for the other cases when the
ticket is (I guess?) visible to a network attacker. Don't you
need to say that in those other cases the server MUST NOT
honour the ticket unless the authentication mechanisms have
worked out ok?

---

From: "Tirumaleswar Reddy (tireddy)" <[email-masked]>
Date: Thu, 1 Sep 2016 13:38:19 +0000

> -----Original Message-----
> From: tram [mailto:[email-masked]] On Behalf Of Stephen Farrell
> Sent: Thursday, September 1, 2016 6:26 PM
> To: The IESG <[email-masked]>
> Cc: [email-masked]; [email-masked]; draft-ietf-tram-turn-
> [email-masked]; [email-masked]
> Subject: [tram] Stephen Farrell's Discuss on draft-ietf-tram-turn-mobility-07:
> (with DISCUSS)
> 
> When responding, please keep the subject line intact and reply to all email
> addresses included in the To and CC lines. (Feel free to cut this introductory
> paragraph, however.)
> 
> 
> Apologies if these discuss points are off-base, I was pressed for time when
> reviewing this:-(
> 
> (1) section 6 correctly says that encryption and integrity protection are
> needed to prevent attacks, but the wording seems ambiguous. Does the MUST
> here mean that a) TURN servers MUST use strong crypto whenever they send
> tickets or b) if a TURN server does not use strong crypto then tickets can be
> abused? I hope it's the former, but in any case I think you need to clearly say.

Yes, it is a). How about adding the following line to Section 6 ?
TURN server MUST ensure that the tickets is authenticated and encrypted using strong cryptographic algorithm 
to prevent modification or eavesdropping by an attacker.

> 
> (2) I guess the use of (D)TLS is fairly clear here. But I'm less clear that things
> are ok for the other cases when the ticket is (I guess?) visible to a network
> attacker. Don't you need to say that in those other cases the server MUST
> NOT honour the ticket unless the authentication mechanisms have worked
> out ok?

Yes, I can update the draft to say the following:
TURN client and server MUST use STUN long-term credential mechanism [RFC5389] or STUN Extension for Third-Party Authorization [RFC7635] or (D)TLS connection to avoid malicious users trying to impersonate the client using the ticket for TURN mobility.

-Tiru

> 
> 
> 
> 
> _______________________________________________
> tram mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tram

---

From: Stephen Farrell <[email-masked]>
Date: Thu, 1 Sep 2016 15:00:42 +0100

Hiya,

On 01/09/16 14:38, Tirumaleswar Reddy (tireddy) wrote:
>> -----Original Message----- From: tram
>> [mailto:[email-masked]] On Behalf Of Stephen Farrell Sent:
>> Thursday, September 1, 2016 6:26 PM To: The IESG <[email-masked]> 
>> [email-masked]; [email-masked] Subject: [tram] Stephen
>> Farrell's Discuss on draft-ietf-tram-turn-mobility-07: (with
>> DISCUSS)
>> 
>> When responding, please keep the subject line intact and reply to
>> all email addresses included in the To and CC lines. (Feel free to
>> cut this introductory paragraph, however.)
>> 
>> 
>> Please refer to
>> https://www.ietf.org/iesg/statement/discuss-criteria.html for more
>> information about IESG DISCUSS and COMMENT positions.
>> 
>> 
>> protection are needed to prevent attacks, but the wording seems
>> ambiguous. Does the MUST here mean that a) TURN servers MUST use
>> strong crypto whenever they send tickets or b) if a TURN server
>> does not use strong crypto then tickets can be abused? I hope it's
>> the former, but in any case I think you need to clearly say.
> 
> TURN server MUST ensure that the tickets is authenticated and
> encrypted using strong cryptographic algorithm to prevent
> modification or eavesdropping by an attacker.

That'd be great thanks.

But are the tickets encrypted if (D)TLS is not used? I think
in any case strong authentication is what's needed, even if
encryption is also a good idea.

> 
>> 
>> (2) I guess the use of (D)TLS is fairly clear here. But I'm less
>> clear that things are ok for the other cases when the ticket is (I
>> guess?) visible to a network attacker. Don't you need to say that
>> in those other cases the server MUST NOT honour the ticket unless
>> the authentication mechanisms have worked out ok?
> 
> Yes, I can update the draft to say the following: TURN client and
> server MUST use STUN long-term credential mechanism [RFC5389] or STUN
> Extension for Third-Party Authorization [RFC7635] or (D)TLS
> connection to avoid malicious users trying to impersonate the client
> using the ticket for TURN mobility.

That's also good, thanks. You could add that clients and server
MUST fail if the authentication fails. I guess that's implicit
already when you say "MUST use" but it might be no harm to call
out. (Programmers do sometimes make the most inventive errors:-)

Cheers,
S.

> 
> -Tiru
> 
>> 
>> 
>> 
>> 
>> _______________________________________________ tram mailing list 
>> [email-masked] https://www.ietf.org/mailman/listinfo/tram

---

From: "Tirumaleswar Reddy (tireddy)" <[email-masked]>
Date: Thu, 1 Sep 2016 14:12:04 +0000

> From: Stephen Farrell [mailto:[email-masked]]
> Sent: Thursday, September 1, 2016 7:31 PM
> To: Tirumaleswar Reddy (tireddy) <[email-masked]>; The IESG
> <[email-masked]>
> Subject: Re: [tram] Stephen Farrell's Discuss on draft-ietf-tram-turn-mobility-
> 07: (with DISCUSS)
> 
> 
> Hiya,
> 
> But are the tickets encrypted if (D)TLS is not used ? 

Yes, ticket is always encrypted.
NEW:
TURN server MUST always ensure that the tickets is authenticated and encrypted using strong cryptographic algorithm to prevent modification or eavesdropping by an attacker.

> I think

Sure, will also add the following line:
If (D)TLS is not used or (D)TLS handshake fails and authentication also fails then TURN client and server MUST fail, and not proceed with TURN mobility.

Cheers,
-Tiru

---

From: Stephen Farrell <[email-masked]>
Date: Thu, 1 Sep 2016 15:18:20 +0100

Hi Tiru,

Those are all good. Shoot out a rev and I'll clear,

Thanks,
S.