Subject: [AAA-WG]: New Issue: Prescribed use of encryption in NASREQ

From: "Kevin Purser" <[email-masked]>
Date: Tue, 21 Aug 2001 16:37:19 -0700

Submitter name: Kevin Purser
Submitter email address: [email-masked]
Date first submitted: August 21, 2001
Reference: none
Document: NASREQ-07
Comment type: 'E'ditorial
Priority: '1' Should fix
Section: 3.1.1.1
Rationale/Explanation of issue: 
This section mentions that the User-Password AVP "MUST be encrypted using of the methods described in [2] or [13]," where [2] is the Base Protocol, and [13] is the CMS Security Application.  Of the mechanisms described in the Base Protocol, neither IPsec or TLS deal with encrypting portions of a diameter message, but rather the entire message itself.

Requested change: 
Remove the reference to [2], leaving only the reference to [13].

Kev

---

From: "Jari Arkko" <[email-masked]>
Date: Wed, 22 Aug 2001 05:41:31 +0300

>This section mentions that the User-Password AVP "MUST be
>encrypted using of the methods described in [2] or [13]," where
>[2] is the Base Protocol, and [13] is the CMS Security Application. 
>Of the mechanisms described in the Base Protocol, neither IPsec
>or TLS deal with encrypting portions of a diameter message, but
>rather the entire message itself.

In cases where CMS security isn't necessary - such as when a NAS leaves
e2e security to be handled by local proxy - wouldn't IPsec/TLS encryption
of the whole packet be sufficient?

Jari

---

From: Pat Calhoun <[email-masked]>
Date: Wed, 22 Aug 2001 09:23:40 -0700

> of the whole packet be sufficient?

I agree. Although IPSec and/or TLS doesn't cover just portion of the secret,
it may be sufficient in many (non-roaming) installations.

PatC

---

From: "Kevin Purser" <[email-masked]>
Date: Wed, 22 Aug 2001 11:29:11 -0700

Ok, I was just confused about the wording of the text, which sounded to me
like it was trying to say the AVP alone could be encrypted through the use
of IPsec/TLS, which obviously isn't the case.  Guess it's already clear for
everybody else?

Kev

---

From: "Jari Arkko" <[email-masked]>
Date: Wed, 22 Aug 2001 21:57:50 +0300

> of IPsec/TLS, which obviously isn't the case.  Guess it's already clear for

No, I'm pretty sure we could formulate this in a clearer way.
How about this: "The User-Password AVP MUST be
encrypted using the methods described in [13], or where
[13] isn't applied, the whole DIAMETER message flow
MUST be encrypted using IPsec and/or TLS as described
in [2]."

Jari

---

From: "Kevin Purser" <[email-masked]>
Date: Wed, 22 Aug 2001 12:17:10 -0700

> MUST be encrypted using IPsec and/or TLS as described

Sounds good to me.