Subject: [Dime] inter-domain: TLS, IPsec ?

From: julien <[email-masked]>
Date: Mon, 24 Jul 2006 22:03:53 +0200

Hello,

I am a student currently working on Diameter and I have some points
that are not cleared at all for me.
That is why I send you this mail.
In fact, I have read Diameter RFC and I do not understand well the
inter-domain security considerations.
I have made google search on this topic but do not find any clear
answers relative to this point.

In fact, TLS is recommended for inter-domain relationship:
"Note that IPsec is considerably less flexible than TLS when it comes
   to configuring root CAs.  Since use of Port identifiers is prohibited
   within IKE Phase 1, within IPsec it is not possible to uniquely
   configure trusted root CAs for each application individually; the
   same policy must be used for all applications."

Is this explanation still available with IKEv2? Does it mean that we
use CA with IPsec ?

If I make the hypothesis that inter-domain actors have trust
relationships established together (and for instance pre-shared key),
will IPsec be OK for inter-domain security ? Do you think it is a
quite true hypothesis ?

If I use IPsec between a NAS and a local AAA server, and then TLS
between this local AAA server and a remote AAA server, there will be
at the same time IPsec and TLS running on the local AAA server. I ask
you for this point because I read this paragraph in RFC 3588:
"It is recommended that a Diameter peer implement the same security
   mechanism (IPsec or TLS) across all its peer-to-peer connections.
   Inconsistent use of security mechanisms can result in redundant
   security mechanisms being used (e.g., TLS over IPsec) or worse,
   potential security vulnerabilities.  When IPsec is used with
   Diameter, a typical security policy for outbound traffic is "Initiate
   IPsec, from me to any, destination port Diameter"; for inbound
   traffic, the policy would be "Require IPsec, from any to me,
   destination port Diameter".
"

May be I have not enough background in networking to understand the
motivation of TLS instead of IPsec in Diameter. That is why I send you
this mail in order to understand the use of IPsec and TLS with
Diameter.
I would be grateful if you could tell me some information on why and
when TLS and/or IPsec is better for Diameter.

Thanks a lot in advance for your help,

Best regards,

-- 
Julien

_______________________________________________
DiME mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dime