Subject: RE: [AAA-WG]: Re: TLS with peer discovery broken (was Diameter shouldnot require separate TLS port)

From: <[email-masked]>
Date: Wed, 17 Apr 2002 10:38:41 +0300

Hi all,

> DNS SRV, NAPSTR, etc. can solve the problem where there is a prior
> relationship with a Diameter server within the realm, but 
> help is needed to find the server. 
> 
> This kind of situation isn't very compatible with IPsec 
> w/pre-shared keys, since if the name of the peer isn't known 
> beforehand, the pre-shared key can't be known either. 

It sounds, in summary, that there may not be addtional text needed.
However, there may be future work needed on how to securely discover 
and securely establish sessions between unknown Diameter peers,
with as little prior knowledge of anything as possible.

Do I understand it correctly?

John

---

From: Stephen Farrell <[email-masked]>
Date: Wed, 17 Apr 2002 09:33:58 +0100

> Do I understand it correctly?

Sounds right to me. And some of that work won't require protocols,
but agreements (e.g. to use a certain set of CAs).

Stephen.

-- 
____________________________________________________________
Stephen Farrell         				   
Baltimore Technologies,   tel: (direct line) +353 1 881 6716
39 Parkgate Street,                     fax: +353 1 881 7000
Dublin 8.                mailto:[email-masked]
Ireland                             http://www.baltimore.com

---

From: David Frascone <[email-masked]>
Date: Wed, 17 Apr 2002 07:54:11 -0500

You've got it.

-- 
David Frascone

           Press all the keys at once to continue...