Subject: RE: [AAA-WG]: [Issue] TLS usage issues

From: "Fredrik Johansson" <[email-masked]>
Date: Wed, 2 Jan 2002 13:58:06 +0100

what about using TLS between two diameter servers, one of them has to act as
a tls client and the other as a tls server. Or should we only use IPsec
between diameter servers?

/fredrik

>-----Original Message-----
>From: [email-masked] [mailto:[email-masked]]On Behalf Of
>Bernard Aboba
>Sent: den 29 december 2001 22:00
>To: [email-masked]
>Subject: [AAA-WG]: [Issue] TLS usage issues
>
>
>Submitter: Bernard Aboba <[email-masked]>
>Date: December 28, 2001
>Reference:
>Document: BASE-08
>Comment type: T
>Priority: S
>Section: 2.2
>Rationale/Explanation of issue:
>There is no discussion of how TLS authentication is used with
>Diameter. For example:
>
> a. Are both peers required to support certificates?
> b. If not, how is it decided which peer authenticates to who?
>
>Proposed change:
>
>Add:
>
>"Diameter clients act as TLS clients according to [RFC2246], and Diameter
>servers act as TLS servers. Diameter clients and servers implementing
>TLS for security MUST mutually authenticate as part of TLS session
>establishment. In order to ensure mutual authentication, Diameter servers
>MUST request certificates from Diameter clients, and the client MUST be
>prepared to supply a certificate on request."
>

---

From: Don Zick <[email-masked]>
Date: Wed, 02 Jan 2002 08:54:56 -0500

I agree with the proposed changes.  I'd also like to see some comments
concerning TLS cipher suites.  I don't think that Diameter implementations
should be required to support all TLS cipher suites listed in RFC 2246.  Not
all cipher suites are supported by available TLS tool kits and one cipher
suite contains the proprietary IDEA encryption algorithm that you have to get
permission to use.  Therefore, to ensure inter operability, I think it is
necessary to specify which cipher suites must be supported.

Proposed change:

Add:

Diameter nodes must be able to negotiate the following TLS cipher suites:
    TLS_RSA_WITH_RC4_128_MD5
    TLS_RSA_WITH_RC4_128_SHA
    TLS_RSA_WITH_3DES_EDE_CBC_SHA

---

From: Bernard Aboba <[email-masked]>
Date: Wed, 2 Jan 2002 06:25:49 -0800 (PST)

> between diameter servers?

Since the spec says that TLS MUST be implemented by Diameter Servers, it's
a reasonable question to ask how two servers would use it to secure their
communication. Perhaps the Diameter peer originating the connection always
acts as the TLS client? That way, you can leverage the existing election
procedure. 

I'm also interested in what authentication modes are used, both for TLS
and IPsec. Are we assuming that both sides in the TLS conversation use
certificates to authenticate? This isn't stated in the spec. If not, then
how is the TLS client authenticated? 

For IPsec, pre-shared keys are probably a viable (though not particularly
scalable) authentication mode, but we need to clarify the identities used
to determine the appropriate pre-shared key. Is this just the IP
address? If so, then Main Mode is ok, no need for aggressive mode. If
other identity payloads can be used (e.g. NAS-Identifier), then we should
probably articulate what those are.

---

From: Jari Arkko <[email-masked]>
Date: Wed, 02 Jan 2002 16:59:08 +0200

> how is the TLS client authenticated?

Web-like one-sided auth followed by client auth is not really
appropriate here. We must require that both sides use certs.

Jari