Subject: RE: [midcom] New I-D on SIP NAT and Firewall Scenarios and Soluti ons

From: Jonathan Rosenberg <[email-masked]>
Date: Sun, 18 Nov 2001 23:19:11 -0500

> -----Original Message-----
> From: Shai Mohaban [mailto:[email-masked]]
> Sent: Saturday, November 17, 2001 11:36 PM
> To: Jonathan Rosenberg; [email-masked]
> Cc: [email-masked]
> Subject: RE: [midcom] New I-D on SIP NAT and Firewall Scenarios and
> Solutions
> 
> 
> Jonathan,
> 
> I find this nice and simple for a change...:-)
> One comment regarding the security considerations (section 
> 11). You are
> saying: "TURN has the important property that compromise of 
> the TURN servers
> cannot cause security breaches when the client is within an 
> enterprise." and
> I am not sure this is true. Correct me if I am wrong but it 
> seems that a
> malicious TURN server can decide to send to the client any 
> traffic it likes
> as long as it is coming from the mapped address and port. 

Yes, thats true. What it means is that it won't be able to attack other
hosts inside the enterprise.

> More than that,
> the server can decide when a "call" (or whatever the data 
> stream stands for)
> starts and ends and can fake "calls" in general (one at a 
> time, though),
> including their content...
> I guess we should at least add that authenticating the server 
> is highly
> recommended...

Yeah, thats why mutual authentication is provided.

-Jonathan R.

---
Jonathan D. Rosenberg, Ph.D.                72 Eagle Rock Ave.
Chief Scientist                             First Floor
dynamicsoft                                 East Hanover, NJ 07936
[email-masked]                     FAX:   (973) 952-5050
http://www.jdrosen.net                      PHONE: (973) 952-5000
http://www.dynamicsoft.com

_______________________________________________
midcom mailing list
[email-masked]
http://www1.ietf.org/mailman/listinfo/midcom