Subject: [AAA-WG]: [issue] Mandate required TLS cipher suites

From: Don Zick <[email-masked]>
Date: Tue, 08 Jan 2002 09:58:17 -0500

Issue Number: To be assigned by Pat Calhoun
Description of issue: Mandate required TLS cipher suites
Submitter name: Don Zick
Date first submitted: 1/8/2
Document: base
Comment type: T
Priority: S
Section: 2.2 Securing Diameter Messages
Rationale/Explanation of issues:

Diameter implementations should not be required to support all TLS
cipher suites listed in RFC 2246.  Not all cipher suites are supported
by available TLS tool kits and one cipher suite contains the proprietary
IDEA encryption algorithm that you have to get permission to use.
Therefore, to ensure inter operability, it is necessary to specify which
cipher suites must be supported.

Requested change:

Add:

Diameter nodes MUST be able to negotiate the following TLS cipher
suites:
    TLS_RSA_WITH_RC4_128_MD5
    TLS_RSA_WITH_RC4_128_SHA
    TLS_RSA_WITH_3DES_EDE_CBC_SHA
Diameter nodes MAY negotiate other TLS cipher suites.

---

From: Jari Arkko <[email-masked]>
Date: Sun, 13 Jan 2002 18:31:35 +0200

> Diameter nodes MAY negotiate other TLS cipher suites.

Agree.

Jari