Subject: [AAA-WG]: issue 283: Usage of TLS vs. IPsec CLOSED

From: <[email-masked]>
Date: Wed, 27 Feb 2002 10:04:15 +0200

Issue #283 
Hi all,

Consensus indicated text change OK.

John

Description of issue: Usage of TLS vs. IPsec
Submitter name: John Loughney	
Submitter email address: [email-masked]	
Date first submitted: 18 Feb 2002
Reference: 
Document: Base 
Comment type: T 
Priority: 1
Section: 2.2
Rationale/Explanation of issue: 

 	Usage of TLS and IPsec. Aside from more detail on how to use TLS and
 	IPsec, it was noted that the drafts do not say that IPsec is for
 	Intra-domain use and TLS for inter-domain. In practice, IKE isn't very
 	interoperable when used with certs, and can't support the required cert
 	policies very well. TLS has this nailed. Should we say
 	that IPsec is primarily for use with pre-shared keys and only
 	intra-domain, and TLS is for cert usage and inter-domain? Should we
 	adjust the language (TLS as MUST on client, too?) Issue to be filed and
 	raised on the mailing list.

Requested change: 
Proposal 

Add the following text:

  Diameter clients, such as Network Access Servers (NASes) and Mobility
  Agents MUST support IP Security [SEC ARCH], and SHOULD support TLS [TLS]. 
  Diameter servers MUST support TLS and IPSec. Operating the Diameter 
  protocol without any security mechanism is not recommended.
  It is suggested that IPsec is primarily for use with pre-shared keys 
  and to protect intra-domain traffic.  TLS is for certificate usage and 
  to project inter-domain traffic.

John