Subject: [AAA-WG]: Issue 256

From: Mark Eklund <[email-masked]>
Date: Sun, 27 Jan 2002 00:19:44 -0500 (EST)

Issue 256 suggests the text below.  In particular it requires TLS peer
authentication.  Is there ever a situation where you want to use the
TLS encryption capability, but don't care to authenticate your peer?

  Diameter clients act as TLS clients according to [RFC2246], and Diameter 
  servers act as TLS servers. Diameter clients and servers implementing 
  TLS for security MUST mutually authenticate as part of TLS session 
  establishment. In order to ensure mutual authentication, Diameter servers 
  MUST request certificates from Diameter clients, and the client MUST be 
  prepared to supply a certificate on request." 

-mark

---

From: "Jari Arkko" <[email-masked]>
Date: Sun, 27 Jan 2002 08:51:00 +0200

> TLS encryption capability, but don't care to authenticate your peer?

I think this issue refers to the use of the regular web TLS model,
where the servers have certs and the clients don't. However, that
model is inappropriate here because the clients would not get
authenticated. You could e.g .send any accounting data to a
server. Even in the web side, they had something to handle the
other direction (credit card number for ecommerce, simple http auth
passwords in other cases). However, I think neither of those
fixes are appropriate for DIAMETER. Therefore, I agree with
the issue 256.

Jari