Subject: RE: [AAA-WG]: Issue 254: More details needed on Diameter IPsec usage- Need Comments

From: <[email-masked]>
Date: Wed, 27 Feb 2002 08:47:06 +0200

Hi David & Bernard,

> > > Are we suggesting that a Diameter server should be able to
> > > originate an IKE exchange that would trigger 
> establishment of an IPsec
> > > tunnel?
> > 
> > Why should a Diameter server (or client for that matter) be 
> establishing
> > IPsec tunnels?
> 
> I didn't think it would.  But if it doesn't, then it isn't 
> necessary to
> specify the IPsec requirements in the Diameter standard 
> because there would
> be nothing in those requirements for a Diameter 
> implementation to comply
> with.
> 
> > 
> > > We should describe what the real requirements are.
> > 
> > I agree. This implies a security considerations section 
> with a threat
> > model. Better late than never, I guess :(
> 
> O.K.  I guess we should cover the operational requirements in 
> the security
> considerations section.  We probably don't need to specify 
> specific IPsec
> options there except to note the minimal requirements.

I prefer David S's approach, specifying minimum PROTOCOL requirements,
operation issues are best saved for a BCP doc.  However, can
someone document these requirements?  Are they similar to Bernard's
text or subset?  Could we try to resolve it today (Wednesday)?

John