Subject: RE: [midcom] WGLC - Alternatives for 'securing' STUN

From: "Christian Huitema" <[email-masked]>
Date: Thu, 9 May 2002 17:30:51 -0700

> And, TLS is useless for UDP devices, which many, many IP phone vendors 
> (including yourselves and ourselves) wouldn't presumably throw away in the 
> time-span of pre-Midcom. 

UDP only devices are basically unsafe, unless you use IPSEC, or strong encryption inside the UDP payload. In order to use strong encryption, you basically need to do some public key operation -- relying on a shared secret exposes you to dictionary attacks. So, if you want any kind of secure operation, you will need TLS equivalent or greater complexity.

Indeed, if you accept to run an insecure UDP device, then all this discussion is moot -- you don't need to worry yourself with the attacks against the STUN servers.
 
> And, finally, I don't see the reason for not being able to add the 
> necessary STUN attributes and worry about the secret download later (or in > parallel).

I don't think that the IETF should endorse an option that we know will lead to people exposing their passwords to third parties. Today, I only use my SIP password over a secure TLS connection to our server; using the same password within STUN would expose me to a dictionary attack, which instead of merely compromising a single phone call would compromise my entire account. This does not look very defendable.

-- Christian Huitema

_______________________________________________
midcom mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/midcom

---

From: "Cullen Jennings" <[email-masked]>
Date: Thu, 9 May 2002 21:17:56 -0700

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]On Behalf Of
> Christian Huitema
> Sent: Thursday, May 09, 2002 5:31 PM
> To: Sanjoy Sen; Melinda Shore; [email-masked]
> Subject: RE: [midcom] WGLC - Alternatives for 'securing' STUN
>
>
> UDP only devices are basically unsafe, unless you use IPSEC, or
> strong encryption inside the UDP payload. In order to use strong
> encryption, you basically need to do some public key operation --
> relying on a shared secret exposes you to dictionary attacks. So,
> if you want any kind of secure operation, you will need TLS
> equivalent or greater complexity.
>

I think it is possible to have situations where this is not true, for
example, one time password systems.