Problems with Session Traversal Utilities for NAT (STUN) Long-Term Authentication for Traversal Using Relays around NAT (TURN)
RFC 7376
|
| Document |
Type |
|
RFC - Informational
(September 2014; No errata)
|
|
Last updated |
|
2015-10-14
|
|
Stream |
|
IETF
|
|
Formats |
|
plain text
pdf
html
bibtex
|
|
Reviews |
|
|
| Stream |
WG state
|
|
Submitted to IESG for Publication
|
|
Document shepherd |
|
Gonzalo Camarillo
|
|
Shepherd write-up |
|
Show
(last changed 2014-09-12)
|
| IESG |
IESG state |
|
RFC 7376 (Informational)
|
|
Consensus Boilerplate |
|
Yes
|
|
Telechat date |
|
|
|
Responsible AD |
|
Spencer Dawkins
|
|
Send notices to |
|
(None)
|
| IANA |
IANA review state |
|
IANA OK - No Actions Needed
|
|
IANA action state |
|
No IANA Actions
|
Internet Engineering Task Force (IETF) T. Reddy
Request for Comments: 7376 R. Ravindranath
Category: Informational Cisco
ISSN: 2070-1721 M. Perumal
Ericsson
A. Yegin
Samsung
September 2014
Problems with Session Traversal Utilities for NAT (STUN)
Long-Term Authentication for Traversal Using Relays around NAT (TURN)
Abstract
This document discusses some of the security problems and practical
problems with the current Session Traversal Utilities for NAT (STUN)
authentication for Traversal Using Relays around NAT (TURN) messages.
Status of This Memo
This document is not an Internet Standards Track specification; it is
published for informational purposes.
This document is a product of the Internet Engineering Task Force
(IETF). It represents the consensus of the IETF community. It has
received public review and has been approved for publication by the
Internet Engineering Steering Group (IESG). Not all documents
approved by the IESG are a candidate for any level of Internet
Standard; see Section 2 of RFC 5741.
Information about the current status of this document, any errata,
and how to provide feedback on it may be obtained at
http://www.rfc-editor.org/info/rfc7376.
Reddy, et al. Informational [Page 1]
RFC 7376 STUN Authentication for TURN: Problems September 2014
Copyright Notice
Copyright (c) 2014 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must
include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License.
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2
2. Notational Conventions . . . . . . . . . . . . . . . . . . . 4
3. Scope . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
4. Problems with STUN Long-Term Authentication for TURN . . . . 4
5. Security Considerations . . . . . . . . . . . . . . . . . . . 5
6. References . . . . . . . . . . . . . . . . . . . . . . . . . 6
6.1. Normative References . . . . . . . . . . . . . . . . . . 6
6.2. Informative References . . . . . . . . . . . . . . . . . 6
Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . . . 7
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 8
1. Introduction
Traversal Using Relays around NAT (TURN) [RFC5766] is a protocol that
is often used to improve the connectivity of Peer-to-Peer (P2P)
applications (as defined in Section 2.7 of [RFC5128]). TURN allows a
connection to be established when one or both sides are incapable of
a direct P2P connection. The TURN server is also a building block to
support interactive, real-time communication using audio, video,
collaboration, games, etc., between two peer web browsers using the
Web Real-Time Communication (WebRTC) [WebRTC-Overview] framework.
A TURN server is also used in the following scenarios:
o For privacy, users of WebRTC-based web applications may use a TURN
server to hide host candidate addresses from the remote peer.
o Enterprise networks deploy firewalls that typically block UDP
traffic. When SIP user agents or WebRTC endpoints are deployed
behind such firewalls, media cannot be sent over UDP across the
firewall but must instead be sent using TCP (which causes a
Reddy, et al. Informational [Page 2]
RFC 7376 STUN Authentication for TURN: Problems September 2014
different user experience). In such cases, a TURN server deployed
in the DeMilitarized Zone (DMZ) might be used to traverse
firewalls.
o The use case explained in Section 3.3.5 of [WebRTC-Use-Cases]
("Simple Video Communication Service, enterprise aspects") refers
to deploying a TURN server in the DMZ to audit all media sessions
from inside an Enterprise premises to any external peer.
o A TURN server could also be deployed for RTP Mobility
[TURN-Mobility], etc.
o A TURN server may be used for IPv4-to-IPv6, IPv6-to-IPv6, and
Show full document text