Subject: [AAA-WG]: Securing Diameter Messages

From: [email-masked]
Date: Mon, 25 Jun 2001 17:33:49 +0300

Hi,

I have a question regarding the section 2.2, "Securing Diameter Messages" of
the base-06, which says that:

"Diameter clients, such as Network Access Servers (NASes) and Foreign Agents
MUST support IP Security [37], and MAY support TLS [38]. Diameter servers
MUST support TLS, but the administrator MAY opt to configure IPSec instead
of using TLS. Operating the Diameter protocol without any security mechanism
is not recommended."

Is it defined on purpose like this? To me it does not sound very rational to
mandate clients to support IPsec and servers to support TLS. Mandating one
protocol, e.g. IPsec if acceptable for everyone, would be reasonable. Also I
think that some text may be needed to clarify the Diameter agents and their
required support.

I understood that there have been some concerns raised, probably in the May
interim meeting, about the interoperability of SCTP with IPsec and TLS which
may need to be taken into account in here.

Br, Jaakko  

PS. Sorry if this should have been submitted as an issue. I can do that if
it is needed.

---

From: Pat Calhoun <[email-masked]>
Date: Mon, 25 Jun 2001 07:36:25 -0700

> think that some text may be needed to clarify the Diameter agents and their

both are supported for a reason. TLS provides validation of credentials at the
app layer, which many folks thought they would need. IPSec doesn't allow an
application to know that a message was secured, unless some interface to the
policy manager exists. IPSec doesn't work through firewalls, which was a concern.

However, IPSec is much more prevalent on access devices than is TLS, and therefore
cannot be ignored. So we felt that both should be supported.

> may need to be taken into account in here.

right and a group of folks will be submitting the SCTP/TLS extensions in the next
week or so.

PatC