关于使用STUN绑定请求的ICE连接检查的消息完整性计算的澄清

Question

RFC 8445在相关部分中声明：

 7.2.2.  Forming Credentials

        A connectivity-check Binding request MUST utilize the STUN short-term
        credential mechanism.

        The username for the credential is formed by concatenating the
        username fragment provided by the peer with the username fragment of
        the ICE agent sending the request, separated by a colon (":").

        The password is equal to the password provided by the peer.

        For example, consider the case where ICE agent L is the initiating
        agent and ICE agent R is the responding agent.  Agent L included a
        username fragment of LFRAG for its candidates and a password of
        LPASS.  Agent R provided a username fragment of RFRAG and a password
        of RPASS.  A connectivity check from L to R utilizes the username
        RFRAG:LFRAG and a password of RPASS.  A connectivity check from R to
        L utilizes the username LFRAG:RFRAG and a password of LPASS.  The
        responses utilize the same usernames and passwords as the requests
        (note that the USERNAME attribute is not present in the response).

但是在STUN上的RFC 5389描述了MESSAGE-INTEGRITY字段的计算，特别是短期凭证，指出：

  For short-term credentials:
                      key = SASLprep(password)

问题：为了计算消息完整性的HMAC，密钥和计算HMAC的文本均未引用任何用户名片段。同样，用户名在指纹计算中不起作用。所以我的问题是：当请求中没有用户名的痕迹时，用户名在STUN短期凭证机制中起什么作用？当然，ufrag和upassword是通过SDP交换的，但是它们如何用于验证/验证绑定请求？

Answer 1

您是对的，用户名对MessageIntegrity没有影响，但是它应该在STUN数据包中的用户名属性下。

您可以看到here我们断言在入站消息中用户名是a.localUfrag+":"+a.remoteUfrag