1. Problems with STUN Authentication for TURN draft-reddy-behave-turn-auth-04 Mar 2013 IETF 89 Meeting Authors : T.Reddy, Ram. R, Muthu.P, A.Yegin draft-reddy-behave-turn-auth-04 1

2. Applications like WebRTC may choose to use TURN for privacy. NAT/Firewall traversal. TURN server could be deployed in Enterprise DMZ for Auditing etc. Mobility. TURN includes IPv4-to-IPv6, IPv6-to-IPv6, and IPv6-to-IPv4 relaying. 2 Background draft-reddy-behave-turn-auth-04

3. draft-ietf-rtcweb-use-cases-and- requirements refers to deploying a TURN server for auditing and FW traversal. 3 Related proposals draft-reddy-behave-turn-auth-04

4. TURN uses key derived from username and password to generate message integrity for TURN request/response. key = MD5(username ":" realm ":“ SASLprep(password)) draft-reddy-behave-turn-auth-04 4 STUN Auth

5. 1.“log-in” username and password will not change for extended periods of time o Password susceptible to offline dictionary attacks 2.TURN server needs to be aware of username and password (management overhead) or store the key (MD5 hash). draft-reddy-behave-turn-auth-04 5 Problems with STUN Auth

6. 6 Attackers verses TURN Servers TURN Server Internet Alice TURN Server Cloud Attacker 2 Attacker 3 3. Adversary can learn USERNAME by snooping TURN messages. Attacker can learn USERNAME of the user. Attacker 1 draft-reddy-behave-turn-auth-04

7. 4. TURN credential exposed to JavaScript. 5. TURN could be deployed in cloud and comes at a cost on SaaS provider. 6. No support for multiple realms. 7 Problems contd.. draft-reddy-behave-turn-auth-04

8. STUN authentication important to prevent un-authorized users from accessing the TURN Server. 8 Problems contd.. draft-reddy-behave-turn-auth-04

9. draft-johnston-tram-stun-origin-01 addresses the realm problem draft-petithuguenin-tram-stun-dtls-00 addresses some of the problems draft-reddy-tram-turn-third-party-authz-00 addresses the problem for third party authorization. 9 Solutions draft-reddy-behave-turn-auth-04

10. There may be a need to resolve first party authentication.  Auditing and FW traversal use case in Enterprise  ISP deploying TURN Server 10 Solutions contd.. draft-reddy-behave-turn-auth-04

11. 11 draft-reddy-behave-turn-auth-04 Next steps ?