Subject: [AAA-WG]: Issue 256: TLS Usage Issues

From: <[email-masked]>
Date: Tue, 26 Feb 2002 22:45:43 +0200

Hi all,

The proposed text seems sensible.  Unless there are objections, I
shall add this.

John

Issue 256: TLS Usage Issues 
Submitter name: Bernard Aboba [email-masked] 
Submitter email address: [email-masked] 
Date first submitted: 28-Dec-01 
Reference: 
Document: base 08 
Comment type: Technical 
Priority: S 
Section: 2.2 
Rationale/Explanation of issue: 
There is no discussion of how TLS authentication is used with 
Diameter. For example: 

a. Are both peers required to support certificates? 
b. If not, how is it decided which peer authenticates to who? 

Proposed change: 

Add: 

"Diameter clients act as TLS clients according to [RFC2246], and Diameter 
servers act as TLS servers. Diameter clients and servers implementing 
TLS for security MUST mutually authenticate as part of TLS session 
establishment. In order to ensure mutual authentication, Diameter servers 
MUST request certificates from Diameter clients, and the client MUST be 
prepared to supply a certificate on request."

---

From: Don Zick <[email-masked]>
Date: Tue, 26 Feb 2002 16:15:44 -0500

The proposed text states that Diameter Clients act as TLS clients and that
Diameter Servers act as TLS servers.  I don't think this is quite right.  I
think the connection initiator acts as the TLS client and the connection
acceptor acts as the TLS server.  When two Diameter servers connect, the
Diameter server that initiates the connection acts as the TLS client.  If a
Diameter client accepts a connetion from a Diameter server then I think the
Diameter client should act as the TLS server.

I think the connection initiator should be responsible for initiating TLS
negotiations just as it is responsible for sending the initial CER message.

Don Z.