Subject: RE: [AAA-WG]: End-2-End security

From: "Martin Julien (ECE)" <[email-masked]>
Date: Wed, 16 May 2001 09:27:11 +0200

I think it could be left to the Diameter server providers to
support or not the e2e security extension, and left to their customers
to decide whether they need it or not. It does not seem to be
a MANDATORY extension to me. Proxy servers do not even need to
support it, in order to carry the messages, right?
I can easily see Diameter servers only counting on IPsec for 
their security mechanism. Furthermore, I'd prefer seeing 
Diameter product releases ASAP.

Martin

> -----Original Message-----
> From: Jari Arkko [mailto:[email-masked]]
> Sent: Monday, May 14, 2001 6:34 PM
> To: [email-masked]; Bernard Aboba
> Cc: Pat Calhoun; Thomas Panagiotis-PTHOMAS1; [email-masked]
> Subject: Re: [AAA-WG]: End-2-End security
> 
> 
> 
> > So End-2-End security is a MAY for Clients and Servers, right?
> 
> I would be in favor of making e2e a MAY for at least clients.
> 
> Jari
> 
> 
> 
>

---

From: Pat Calhoun <[email-masked]>
Date: Wed, 16 May 2001 06:25:33 -0700

> Diameter product releases ASAP.

So if I understand correctly, you'd like to see home servers
initiate the E2E Security Association. Presumably after receiving
some auth request.

The only issue, of course, is that the auth request could include
things that the home server didn't want to receive unprotected.

PatC

---

From: Barney Wolff <[email-masked]>
Date: Wed, 16 May 2001 10:48:53 -0400

Pat, unless I have failed to understand e2e security, the protection
would entail using the home server's public key.  So if it had
none, the NAS would know that it did not support e2e.  Besides,
I don't know what "e2e" security means if the two ends know
nothing about each other.

Barney

---

From: Pat Calhoun <[email-masked]>
Date: Wed, 16 May 2001 07:54:08 -0700

On Wed, May 16, 2001 at 10:48:53AM -0400, Barney Wolff wrote:
> none, the NAS would know that it did not support e2e. 

There are two messages defined in the e2e sec extension, and these
can carry CMS messags. a CMS message MAY contain a cert, hence the
public key.

> Besides,

Well, they eventually do. When the E2E SA Request is sent from the NAS
to the home network, a box in the home network replies. At that point,
they know each other, and all packets secured for that server contains
the Destination-FQDN of the home server.

PatC