Subject: Re: [midcom] STUN issue #7: recommended stateless server procedures

From: "Panayiotis A. Thermos" <[email-masked]>
Date: Wed, 20 Nov 2002 10:12:47 -0500

I assume that the prefix would be a random string of length 12 characters
or more
to strengthen the "username" value.

Peter

                    Jonathan                                                                           
                    Rosenberg              To:     [email-masked]                                     
                    <jdrosen@dynami        cc:     (bcc: Panayiotis A. Thermos/Telcordia)              
                    csoft.com>             Subject:     [midcom] STUN issue #7: recommended stateless  
                                           server procedures                                           
                    11/19/2002                                                                         
                    03:34 AM                                                                           

The STUN specification doesn't give any specific algorithm for doing a
stateless server. Stateless operation requires some way to hand out
usernames and passwords without storing them.

Since it is easy to do this wrong, Steve Bellovin recommedned an
algorithm. The algorithm also allows for determination of the source IP
address used for the TLS exchange, needed to handle another one of the
open issues. His algorithm is:

username = <prefix,rounded-time,clientIP,hmac>

where prefix is some string (I honestly don't know what this is needed
for - I have a note in asking him), rounded-time is the time rounded
off, clientIP is the IP address where the TLS exchange came from, and
hmac is the hmac over the prefix, rounded-time and client IP, using a
server key.

password = <hmac(USERNAME,anotherprivatekey)>

This allows the server to verify the password against the username,
determine the staleness of the username, and determine the client IP
used in the TLS exchange, all without state.

I recommend we document this algorithm in the spec.

-Jonathan R.

--
Jonathan D. Rosenberg, Ph.D.                72 Eagle Rock Ave.
Chief Scientist                             First Floor
dynamicsoft                                 East Hanover, NJ 07936
[email-masked]                     FAX:   (973) 952-5050
http://www.jdrosen.net                      PHONE: (973) 952-5000
http://www.dynamicsoft.com

_______________________________________________
midcom mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/midcom

_______________________________________________
midcom mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/midcom

---

From: Jonathan Rosenberg <[email-masked]>
Date: Thu, 21 Nov 2002 03:37:13 -0500

> to strengthen the "username" value.

Strengthen, as in, provides some security properties? Maybe I'm just too 
tired, but all that would do is add some salt to the input to an hmac. I 
don't think that provides any security benefits.

-Jonathan R.

---

From: "Pete Cordell" <[email-masked]>
Date: Thu, 21 Nov 2002 10:47:32 -0000

I guess using a different prefix each time could make sure that the same
user name and password are not given out to two different hosts behind the
same NAT box.

That would be very possible if the IP part didn't include the port.  Vaguely
possible if the IP part did include the port.

Pete.

---

From: Jonathan Rosenberg <[email-masked]>
Date: Thu, 21 Nov 2002 11:24:08 -0500

OK, this is a plausible explanation on use.

-Jonathan R.

Pete Cordell wrote:
>>>I assume that the prefix would be a random string of length 12
>>
> characters
> 
>>>or more