Subject: RE: [AAA-WG]: Issue 256: TLS Usage Issues

From: <[email-masked]>
Date: Wed, 27 Feb 2002 09:19:43 +0200

Hi Don,

Can you suggest modified text?

John

> -----Original Message-----
> From: ext Don Zick [mailto:[email-masked]]
> Sent: 26 February, 2002 23:16
> To: Loughney John (NRC/Helsinki)
> Cc: [email-masked]
> Subject: Re: [AAA-WG]: Issue 256: TLS Usage Issues
> 
> 
> The proposed text states that Diameter Clients act as TLS 
> clients and that
> Diameter Servers act as TLS servers.  I don't think this is 
> quite right.  I
> think the connection initiator acts as the TLS client and the 
> connection
> acceptor acts as the TLS server.  When two Diameter servers 
> connect, the
> Diameter server that initiates the connection acts as the TLS 
> client.  If a
> Diameter client accepts a connetion from a Diameter server 
> then I think the
> Diameter client should act as the TLS server.
> 
> I think the connection initiator should be responsible for 
> initiating TLS
> negotiations just as it is responsible for sending the 
> initial CER message.
> 
> Don Z.
> 
> [email-masked] wrote:
> 
> > Hi all,
> >
> > The proposed text seems sensible.  Unless there are objections, I
> > shall add this.
> >
> > John
> >
> > Issue 256: TLS Usage Issues
> > Submitter name: Bernard Aboba [email-masked]
> > Submitter email address: [email-masked]
> > Date first submitted: 28-Dec-01
> > Reference:
> > Document: base 08
> > Comment type: Technical
> > Priority: S
> > Section: 2.2
> > Rationale/Explanation of issue:
> > There is no discussion of how TLS authentication is used with
> > Diameter. For example:
> >
> > a. Are both peers required to support certificates?
> > b. If not, how is it decided which peer authenticates to who?
> >
> > Proposed change:
> >
> > Add:
> >
> > "Diameter clients act as TLS clients according to 
> [RFC2246], and Diameter
> > servers act as TLS servers. Diameter clients and servers 
> implementing
> > TLS for security MUST mutually authenticate as part of TLS session
> > establishment. In order to ensure mutual authentication, 
> Diameter servers
> > MUST request certificates from Diameter clients, and the 
> client MUST be
> > prepared to supply a certificate on request."
>

---

From: Don Zick <[email-masked]>
Date: Wed, 27 Feb 2002 09:17:52 -0500

Hi John,

Here's the suggested modified text.

Don Z.

Proposed change:

Add:

A Diameter node that initiates a connection to another Diameter node acts

as a TLS client according to [RFC2246], and a Diameter node that accepts
a
connection acts as a TLS server.  Diameter nodes implementing TLS for
security MUST mutually authenticate as part of TLS session establishment.

In order to ensure mutual authentication, the Diameter node acting as
TLS server must request a certificate from the Diameter node acting as
TLS client, and the Diameter node acting as TLS client MUST be prepared
to supply a certificate on request.