Subject: Re: [midcom] STUN-obtaining a Shared Secret- Verbiage

From: Jonathan Rosenberg <[email-masked]>
Date: Sat, 02 Nov 2002 14:48:55 -0500

My apologies for the delay in responding.

You are correct. IN fact, this is one of the changes since -03. The 
second paragraph now reads:

  First, the client determines the IP address and port that it will
    open a TCP connection to. This is done using the discovery procedures
    in Section 9.1. The client opens up the connection to that address
    and port, and immediately begins TLS negotiation [2]. The client MUST
    verify the identity of the server. To do that, it follows the
    identification procedures defined in Section 3.1 of RFC 2818 [6].
    Those procedures assume the client is derefencing a URI. For purposes
    of usage with this specification, the client treats the domain name
    or IP address used in Section 9.1 as the host portion of the URI that
    has been dereferenced.

-Jonathan R.

Panayiotis A. Thermos wrote:
> Section 9.2 page 16 of draft-ietf-midcom-stun-02.txt paragraph 2,
> states "The client MUST authorize the server".
> 
> Authorization is associated with privileges and ability to perform
> a specific task based on your access profile.
> I do not see why the STUN client should be required to
> "authorize" any server responses.
> 
> I believe the author(s) in this case mean "Authenticate"
> or "Verify" the server's response.
> 
> So the sentence should read,
> "The client MUST authenticate the server."
> 
> If I miss something please let me know.
> 
> Peter T.
> 
> _______________________________________________
> midcom mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/midcom
> 

-- 
Jonathan D. Rosenberg, Ph.D.                72 Eagle Rock Ave.
Chief Scientist                             First Floor
dynamicsoft                                 East Hanover, NJ 07936
[email-masked]                     FAX:   (973) 952-5050
http://www.jdrosen.net                      PHONE: (973) 952-5000
http://www.dynamicsoft.com

_______________________________________________
midcom mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/midcom