Subject: [AAA-WG]: [issue] Required Transports

From: David Spence <[email-masked]>
Date: Sun, 20 May 2001 17:53:29 -0700

Subject: [issue] Required Transports

Submitter name: David Spence
Submitter email address: [email-masked]
Date first submitted: May 20, 2001
Reference: 

      From:  [email-masked]
      Date:  May 20, 2001
   Subject:  Re: [AAA-WG]: transport MUSTs

Document: Base
Comment type: T
Priority: S
Section: 2.1
Rationale/Explanation of issue:

   The following sentence from section 2.1 is unclear:

      "Diameter clients SHOULD support SCTP, but MUST support TCP if SCTP
      is not available."

   It appears to allow Diameter clients not to support TCP.  This would be 
   contrary to past WG decision.

Requested change:

   The sentence should read:

      "Diameter clients MUST support TCP and MAY support SCTP."

-- 
David Spence                            email: [email-masked]
Interlink Networks, Inc.                phone: (734) 821-1203
775 Technology Drive, Suite 200         fax:   (734) 821-1235
Ann Arbor, MI 48108           
U.S.A.

---

From: David Spence <[email-masked]>
Date: Wed, 30 May 2001 16:28:27 -0400

>       "Diameter clients MUST support TCP and MAY support SCTP."

Resolution:

   The consensus reached at the May interim meeting on this issue is to
   change the approach agreed to last February.  The new position is
   that clients MUST support either SCTP or TCP.  This allows for
   SCTP-only clients, TCP-only clients, or clients that support both.
   Servers MUST support both SCTP and TCP.  Transport negotiation is
   simplified.  Servers always connect to servers using SCTP unless
   explicitly configured to do otherwise.  For client-server
   connections, the client initiates the connection using whichever
   transport it supports or prefers.

   The change in reasoning is as follows.  We no longer care about the
   firewall issue.  Firewalls can be made to pass SCTP.  If finer
   grained control is needed, it will soon be offered by the firewall
   vendors.  Similarly, we are no longer concerned about operating
   system support.  The requirement is for servers to support SCTP.  We
   do not specify whether the support is provided in the application or
   in the operating system.  If the Diameter server application expects
   operating system support, then that server can only fully support the
   standard by running on an operating system that supports SCTP.

   With regard to the security issue, we recognize that there are issues
   running SCTP over IPsec and running TLS over SCTP.  But we feel that
   these issues must be urgently addressed.  IPsec would have problems
   with the multiple IP addresses supported by SCTP.  However, Diameter
   does not need multiple addresses, so it appears that IPsec can still
   be used with Diameter/SCTP.  TLS would have difficulty running over
   multiple SCTP streams.  Multiple streams are required to prevent head
   of line blocking.  We need to resolve this problem, but running
   Diameter over TLS over a single SCTP stream would be no worse than
   running Diameter over TLS over TCP, so there is no need to require
   use of TCP with TLS.

   The interoperability of SCTP with IPsec and TLS requires further
   study, however, before Diameter goes to last call.