Lync STUN Message Integrity Attribute Unable to be Validated

Recently I've begun working on a project in which the goal is to use the Rtc.Signaling portion of UCMA to get the RDP screen sharing data from a conference and forward it to a specific TCP port for processing. I've successfully completed this task by creating a custom offer and answer class that tells Lync to send the data to a certain port. However, before I can get the desired RTP / RPD data I must first respond to a STUN ( http://tools.ietf.org/html/rfc5389) binding request.

STUN contains a message integrity attribute that is supposed to contain a SHA1 hash of the message that needs to be validated by the receiver in order for the request to be processed instead of discarded. My problem is that am unable to correctly compute this hash for the binding request I receive from Lync. I have validated that my current sample code (which can be found at the end of this post) is able to validate the RFC STUN test request (http://tools.ietf.org/html/rfc5769) without an issue. This same code, however, gets the wrong answer when given a STUN request generated by Lync. Right now I am using the password found in the original SPD request's "ice-pwd" attribute as the key to the SHA1 algorithm. Is this the correct key? If not, where can the correct key be found? Does Lync calculate the message integrity in a different manner then as specified in the RFC? I have also included the STUN binding request raw data that I got from a Lync trace and am using as test data. Thanks for any advice you can give.

SDP REQUEST



TRACE:



CODE*

var stunMsg = new STUN2Message();
stunMsg.Bytes = stunRequestRawData;

// Retrieve Message Integrity hash from attribute.
var hashAttr = ((MessageIntegrityAttribute)stunMsg.FindAttribute(StunAttributeType.MessageIntegrity));
var sentHash = hashAttr.HMAC;

// Alter original data to reduce length to exclude fingerprint attr BUT include message integrity attr.
stunRequestRawData.CopyInto((UInt16)(stunMsg.MessageLength - 8), 2);

// Include everything up to BUT EXCLUDING the message integrity attribute (24 bytes) and fingerprint attribute (8 bytes)
// as the input to the hash function.
var upTo = 20 + stunMsg.MessageLength - 24 - 8;

var computeHMAC = new MessageIntegrityAttribute();
computeHMAC.ComputeHMACShortTermCredentials(stunRequestRawData, upTo, password);

if (sentHash.SequenceEqual(computeHMAC.HMAC))
{
          Console.WriteLine(string.Format("{0} was the right answer!!!!!", password));
}
// Compute HMAC function for reference
public void ComputeHMACShortTermCredentials(byte[] bMsgBytes, int nLengthWithoutMessageIntegrity, string strPassword)
{
       byte[] bKey = System.Text.UTF8Encoding.UTF8.GetBytes(strPassword);

       using (var sha1 = new System.Security.Cryptography.HMACSHA1(bKey))
       {
                HMAC = sha1.ComputeHash(bMsgBytes, 0, nLengthWithoutMessageIntegrity);
       }
}

*For ease of use the STUNMessage and STUNAttribute classes are borrowed from the open source xmedianet (http://xmedianet.codeplex.com/) library. Please look at their source code if you want to check out how those classes are implemented.