[BEHAVE] MESSAGE-INTEGRITY in STUN error responses

All,

Apologies if this has been discussed, but I have some doubts
regarding the processing of STUN error responses which requests had
included MESSAGE-INTEGRITY attribute.

Few doubts:

  - In 8.3.2.  Processing Responses, it says

      "All responses that were not discarded, whether success
       responses or error responses, MUST first be authenticated
       by the client."

    I'm assuming that this means STUN response (success or error)
    with missing or incorrect M-I will be discarded before it
    reaches client transaction FSM.

    And if so, I'm assuming that client would continue retransmitting
    the request, as if it had not receive any response.

  - If the above are true, then I think there need to be some
    exception for some error responses which by definition cannot
    contain M-I, so they cannot be authenticated.

    Reading Section 9.1.1. "Receive Request Message", I reckon these
    error responses cannot contain M-I thus client should not
    authenticate them:

      401 (Unauthorized)
      432 (Missing Username)
      434 (Missing Realm)
      436 (Unknown Username)
      431 (Integrity Check Failure)

   And probably 420 (Unknown Attribute), and few others (I can look
   for them, but for now I just want to be sure that what I'm
   saying makes sense at all).

Comments?

cheers,
  -benny

-- 
Benny Prijono
http://www.pjsip.org

_______________________________________________
Behave mailing list
Behave@ietf.org
https://www1.ietf.org/mailman/listinfo/behave