Subject: [AAA-WG]: Issue 191: How to know when to use TLS

From: Pat Calhoun <[email-masked]>
Date: Sun, 14 Oct 2001 08:05:50 -0700

Following the recommendation to add this to the URI, here is the 
proposed text. I do, however, have some objections to the proposal
that was made in the issue submission. Basically, the issue proposed
two new URI fields, where TLS could be independently set for either
transport protocols (e.g. TCP, SCTP). This would allow for a secure
communication over one medium, and unsecure over the other. Of course,
a malicious node would use the unsecure one.

So, here is my proposed addition to the URI:

            security           = ( "none" | "TLS" )
                                 ; Specifies whether TLS is to be used
                                 ; when communicating with the peer. The
                                 ; default value is none.

PatC

---

From: "Kevin Purser" <[email-masked]>
Date: Tue, 16 Oct 2001 09:51:38 -0700

Hey Pat,

Just a nit, but since the URI will also identify access devices, we should
probably add "IPSec" to the option list.

-Kev

---

From: Pat Calhoun <[email-masked]>
Date: Tue, 16 Oct 2001 11:07:48 -0700

> probably add "IPSec" to the option list.

But this implies that there is an interface to the local policy manager from the
Diameter process, which I doubt exists. So, how would the Diameter react if IPSec
was on or off? I think that IPSec is a different beast.

PatC

---

From: "Kevin Purser" <[email-masked]>
Date: Tue, 16 Oct 2001 11:49:03 -0700

> was on or off? I think that IPSec is a different beast.

I see your point... I was just thinking in terms of being explicit in
describing the connection properties in the URI.  In other words, it just
seems a little counterintuitive to me when a diameter server is
communicating with an access device through IPSec, and the corresponding URI
for the access device says "security = none".

-Kev

---

From: Pat Calhoun <[email-masked]>
Date: Tue, 16 Oct 2001 11:48:55 -0700

> for the access device says "security = none".

right I hear you, but having "security = ipsec" does nothing to the implementation.
Further, as far as Diameter is concerned, when IPSec is used, there is NO app 
level security. In fact, Diameter has no way of knowing whether there is a local
policy to protect Diameter traffic.

PatC

---

From: "Kevin Purser" <[email-masked]>
Date: Tue, 16 Oct 2001 13:43:34 -0700

> > > But this implies that there is an interface to the local policy
manager
> > from the
> > > Diameter process, which I doubt exists. So, how would the Diameter
react
> > if IPSec

After re-reading the original issue, my comment becomes more of an editorial
one- why not use something like:

            tls           = ( "no" | "yes" )
                                 ; default value is no.

which is really what the original issue was trying to accomplish, right?  Or
better yet, to leave future transport layer mechanisms available:

            transport-security           = ( "none" | "TLS" | ...)
                                 ; Specifies whether TLS [or other eventual
transport layer mechanisms] is to be used
                                 ; when communicating with the peer. The
                                 ; default value is none.

Simply put, if this option in the URI is only intended to describe transport
layer mechanisms, why not make that obvious in the URI option name, rather
than using a term as broad as "security".

-Kev

---

From: Pat Calhoun <[email-masked]>
Date: Tue, 16 Oct 2001 20:04:46 -0700

> than using a term as broad as "security".

I agree.

PatC

---

From: "Jari Arkko" <[email-masked]>
Date: Wed, 17 Oct 2001 08:12:08 +0300

> > than using a term as broad as "security".

Looks good from my point of view as well.

Jari