Subject: [AAA-WG]: Issue 356: Security issues with TLS up-negotiation

From: Bernard Aboba <[email-masked]>
Date: Tue, 10 Sep 2002 05:24:35 -0700 (PDT)

Issue 356: Security issues with TLS up-negotiation
Submitter: Bernard Aboba
Submitter email address: [email-masked]
Date first submitted: September 9, 2002
Reference:
Document: BASE-12
Comment type: T
Priority: S
Section: 5.6
Rationale/Explanation of issue:

"For TLS usage, a TLS handshake will begin when both ends
are in the open state. If the TLS handshake is successful,
all further messages will be sent via TLS. If the handshake
fails, both ends move to the closed state."

Unfortunately, this model of TLS up-negotiation depends on
the Diameter connection being brought up without any security,
followed by an exchange of CER/CEA (including the security
model) in the clear.

The Inband-Security-ID AVP includes a value of NO_INBAND_SECURITY,
and nothing in the specification requires that a value of TLS
MUST be exchanged by the peers if the connection is not protected
by IPsec.

So it would appear legal for the Diameter connection to reach the
open state after negotiation of NO_INBAND_SECURITY.

To fix this, add the following text to section 13, first paragraph:

"Diameter clients, such as Network Access Servers (NASes) and Mobility
Agents MUST support IP Security [SECARCH] and MAY support TLS [TLS].
Diameter servers MUST support TLS and IPsec. Diameter implementations
MUST use transmission-level security of some kind (IPsec or TLS) on
each connection.

If a Diameter connection is not protected by IPsec,
then the CER/CEA exchange MUST include an Inband-Security-ID AVP
with a vaue of TLS. For TLS usage, a TLS handshake will begin when both
ends
are in the open state, after completion of the CER/CEA exchange.
If the TLS handshake is successful, all further messages will
be sent via TLS. If the handshake fails, both ends move to the
closed state.

It is suggested that IPsec be used primarily at the edges for
intra-domain exchanges. For NAS devices without certificate support,
pre-shared keys can be used between the NAS and a local AAA proxy.

For protection of inter-domain exchanges, TLS is recommended. See
sections 13.1 and 13.2 for more details on IPsec and TLS usage."

---

From: <[email-masked]>
Date: Wed, 11 Sep 2002 09:38:24 +0300

Hi Bernard,

> open state after negotiation of NO_INBAND_SECURITY.

Good catch.  I'll add this.

John