Subject: [AAA-WG]: [Issue 330]: Diameter should not require separate TLS port

From: Bernard Aboba <[email-masked]>
Date: Wed, 10 Apr 2002 20:12:37 -0700 (PDT)

Issue 330:  Diameter should not require separate TLS port
Submitter name: Allison Mankin
Submitter email address: [email-masked]
Date first submitted: 04-10-2002
Reference:
Document: draft-base-10
Comment type: Technical
Priority: S
Section: 2.1 (contradicts section 13.3)

Justification: The IESG is encouraging WGs to enable their 
applications to negotiate an upgrade to TLS rather than requiring 
a separate port. Diameter cannot yet handle this "startTLS" 
up-negotiation. Do not assume that Diameter will be granted 
an addition port for use with TLS. 

Change: 
Need support for TLS up-negotiation in Diameter.

---

From: David Frascone <[email-masked]>
Date: Thu, 11 Apr 2002 07:52:50 -0500

I agree with this fully.  Peers can advertise whether or not they support
TLS in the CEA/CER.  If both peers support TLS, then after the Diameter
handshake, a TLS handshake can start.

The only gotcha is when the TLS handshake fails.  Do the peers just fall 
back to non-secure operation?

-Dave

-- 
David Frascone

    Copy from another: plagiarism. Copy from many: research.

---

From: Stephen Farrell <[email-masked]>
Date: Thu, 11 Apr 2002 15:50:05 +0100

Dave,

> back to non-secure operation?

Eh - if so, why'd they bother trying to turn on TLS? Anyone with access
to the network can tweak bits and cause the TLS handshake to fail, so
the answer to your question has to be a resounding "no".

Stephen.

-- 
____________________________________________________________
Stephen Farrell         				   
Baltimore Technologies,   tel: (direct line) +353 1 881 6716
39 Parkgate Street,                     fax: +353 1 881 7000
Dublin 8.                mailto:[email-masked]
Ireland                             http://www.baltimore.com

---

From: David Frascone <[email-masked]>
Date: Thu, 11 Apr 2002 10:02:35 -0500

Good point.

-- 
David Frascone

     I can't hear you. There's a banana republic in my ear.