Subject: [Dime] Obsolete TLS wording in Diameter protocol

From: Julien ÉLIE <[email-masked]>
Date: Mon, 9 Jan 2017 14:46:39 +0100

Hi all,

The Diameter specification (RFC 6733) mentions in Section 13.1 that the 
TLS_RSA_WITH_RC4_128_MD5 and TLS_RSA_WITH_RC4_128_SHA cipher suites are 
required ("Diameter nodes MUST be able to negotiate [them]"), and 
Section 5.2 does not give latest recommendations for certificate validation.

Shouldn't it be updated in favour of following RFC 7525 (BCP for TLS) 
and RFC 6125 (guideline for certificate validation)?

-- 
Julien ÉLIE

« The following two statements are usually both true:
   There's not enough documentation.
   There's too much documentation. » (Larry Wall)

---

From: <[email-masked]>
Date: Mon, 9 Jan 2017 14:59:29 +0000

Hi Julien,

The first point on cipher suites has been already raised. The prohibition of the use of the RC4-based cipher suites (RFC7465) came after the publication of the RFC6733. But the RFC7465 is anyway an update of the RFC5246 that is a normative reference in the RFC6733. So anyone implementing TLS should be aware of this update. There is no need of an errata report but it will be covered in a future update of the RFC6733 if any.

For the RFC6125, it should be first worthwhile to mention that the RFC6733 indicates that, for the time being, there is no Diameter server Certification Authorities. However, the RFC5280 is given as normative reference and this one is not superseded by RFC6125 so far. And RFC6125 could be also seen as orthogonal to the implementation of the Diameter base protocol. It could be part of an update if there would be a real need to clarify something left outside of RFC5280.

At least, it is my current understanding.
I hope that it clarifies your concerns.

Regards,

Lionel    

> -----Message d'origine-----
> De : DiME [mailto:[email-masked]] De la part de Julien ÉLIE
> Envoyé : lundi 9 janvier 2017 14:47
> À : [email-masked]
> Objet : [Dime] Obsolete TLS wording in Diameter protocol
> 
> Hi all,
> 
> TLS_RSA_WITH_RC4_128_MD5 and TLS_RSA_WITH_RC4_128_SHA cipher suites
> are required ("Diameter nodes MUST be able to negotiate [them]"), and Section
> 5.2 does not give latest recommendations for certificate validation.
> 
> Shouldn't it be updated in favour of following RFC 7525 (BCP for TLS) and RFC
> 6125 (guideline for certificate validation)?
> 
> --
> Julien ÉLIE
> 
> _______________________________________________
> DiME mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dime

_________________________________________________________________________________________________________________________

Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,
Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.

This message and its attachments may contain confidential or privileged information that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and delete this message and its attachments.
As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.
Thank you.

---

From: Julien ÉLIE <[email-masked]>
Date: Mon, 9 Jan 2017 22:14:06 +0100

Hi Lionel,

First of all, thanks for your answer.

> The first point on cipher suites has been already raised. The
> prohibition of the use of the RC4-based cipher suites (RFC7465) came
> after the publication of the RFC6733. But the RFC7465 is anyway an
> update of the RFC5246 that is a normative reference in the RFC6733.
> So anyone implementing TLS should be aware of this update. There is
> no need of an errata report but it will be covered in a future
> update of the RFC6733 if any.

I agree that TLS implementations are now required to follow the 
requirement of RFC 7465 "TLS clients MUST NOT include RC4 cipher suites 
in the ClientHello message", so using TLS with Diameter nodes should 
normally be safe.

However, the consequence is that there is no longer any 
Diameter-compliant implementations with regards to nodes using TLS.  As 
a matter of fact, without updating RFC 6733 that requires that "diameter 
nodes MUST be able to negotiate the following TLS/TCP and DTLS/SCTP 
cipher suites: TLS_RSA_WITH_RC4_128_MD5, TLS_RSA_WITH_RC4_128_SHA, 
TLS_RSA_WITH_3DES_EDE_CBC_SHA", that requirement can no longer be 
fulfilled.  So, unfortunately, RFC-compliance for Diameter 
implementations using TLS no longer exists!

As a side note, an erratum could be reported for the wording "the 
following TLS/TCP and DTLS/SCTP cipher suites" because RC4 does not 
exist for DTLS.  It is specific to TLS according to RFC 4347, Section 
4.1.2.2:  "The only stream cipher described in TLS 1.1 is RC4, which 
cannot be randomly accessed.  RC4 MUST NOT be used with DTLS."

> For the RFC6125, it should be first worthwhile to mention that the
> RFC6733 indicates that, for the time being, there is no Diameter
> server Certification Authorities. However, the RFC5280 is given as
> normative reference and this one is not superseded by RFC6125 so
> far.

The problem is that RFC 6733 references RFC 5280 only for the Extended 
Key Usage extension.  (And for the time being, there is no CA for 
authorization.)
But there are certificates for authentication and TLS negotiation.  It 
is required by RFC 6733.  See Section 13.1: "the Diameter node acting as 
the TLS/TCP and DTLS/SCTP server MUST request a certificate from the 
Diameter node acting as TLS/TCP and DTLS/SCTP client, and the Diameter 
node acting as the TLS/TCP and DTLS/SCTP client MUST be prepared to 
supply a certificate on request."
That's why I suggested that RFC 6733 could reference RFC 5280 (Section 
6) and RFC 6125 to make clear how to verify certificates.
That's what is for instance done in:
   https://tools.ietf.org/html/rfc7817

> At least, it is my current understanding. I hope that it clarifies
> your concerns.

Well, I am not under the impression that all these points are limpid in 
RFC 6733.  And for the first point about TLS, it means that there aren't 
any RFC-compliant Diameter implementations because a MUST is not 
fulfilled...

-- 
Julien ÉLIE

« Ambo florentes aetatibus, Arcades ambo » (Virgile, _Églogue VII_)