Subject: RE: [AAA-WG]: [issue] Usage of TLS and IPsec

From: <[email-masked]>
Date: Tue, 19 Feb 2002 15:28:11 +0200

Jari,

Then, if the text for 2.2 is the following: 

  2.2  Securing Diameter Messages

  Diameter clients, such as Network Access Servers (NASes) and Mobility 
  Agents MUST support IP Security [SECARCH], and SHOULD support TLS [TLS]. 
  Diameter servers MUST support TLS and IPSec. Operating the Diameter 
  protocol without any security mechanism is not recommended.

  It is suggested that IPsec can be used primarily at the
  edges and in intra-domain traffic, such as using pre-shared
  keys between a NAS a local AAA proxy. This also eases
  the requirements on the NAS to support certificates. It is
  also suggested that inter-domain traffic would primarily use
  TLS.

Is it OK with everyone?

John

---

From: <[email-masked]>
Date: Wed, 20 Feb 2002 10:23:06 +0200

Hi Bernard, 

> This makes sense to me. Making security mandatory to implement but not
> mandatory to use doesn't make sense in this case. After all, 
> with RADIUS security was mandatory to use. 

Agreed & I feel like we are gaining consensus on this issue.

John