Subject: RE: [AAA-WG]: Securing Diameter Messages

From: Tuexen Michael <[email-masked]>
Date: Mon, 25 Jun 2001 16:37:58 +0200

Dear all,

just to let you know: an ID describing the use of TLS on top of SCTP has been submitted to the TSVWG last Friday.

Best regards
Michael

Michael Tuexen    Tel.:   +49 89 722 47210
Siemens AG        Fax:    +49 89 722 48212
ICN WN CS SE 5    E-mail: [email-masked]

> -----Original Message-----
> From:	[email-masked] [SMTP:[email-masked]]
> Sent:	Monday, June 25, 2001 4:34 PM
> To:	[email-masked]
> Subject:	[AAA-WG]: Securing Diameter Messages
> 
> Hi,
> 
> I have a question regarding the section 2.2, "Securing Diameter Messages" of
> the base-06, which says that:
> 
> "Diameter clients, such as Network Access Servers (NASes) and Foreign Agents
> MUST support IP Security [37], and MAY support TLS [38]. Diameter servers
> MUST support TLS, but the administrator MAY opt to configure IPSec instead
> of using TLS. Operating the Diameter protocol without any security mechanism
> is not recommended."
> 
> Is it defined on purpose like this? To me it does not sound very rational to
> mandate clients to support IPsec and servers to support TLS. Mandating one
> protocol, e.g. IPsec if acceptable for everyone, would be reasonable. Also I
> think that some text may be needed to clarify the Diameter agents and their
> required support.
> 
> I understood that there have been some concerns raised, probably in the May
> interim meeting, about the interoperability of SCTP with IPsec and TLS which
> may need to be taken into account in here.
> 
> Br, Jaakko  
> 
> PS. Sorry if this should have been submitted as an issue. I can do that if
> it is needed.