Subject: [Ipsec] IPSec use with Diameter

From: mohanlal jangir <[email-masked]>
Date: Mon, 06 Dec 2004 12:17:04 +0530

Here is one paragraph from RFC 3588 (Diameter Base Protocol):

"Note that IPsec is considerably less flexible than TLS when it comes to
configuring root CAs. Since use of Port identifiers is prohibited within IKE
Phase 1, within IPsec it is not possible to uniquely configure trusted root
CAs for each application individually; the same policy must be used for all
applications. This implies, for example, that a root CA trusted for use with
Diameter must also be trusted to protect SNMP. These restrictions can be
awkward at best.
Since TLS supports application-level granularity in certificate policy, TLS
SHOULD be used to protect Diameter connections between administrative
domains. IPSec is most appropriate for intra-domain usage when pre-shared
keys are used as a security mechanism."

Can someone explain more about this?

Regards
Mohanlal

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: "Scott G. Kelly" <[email-masked]>
Date: Mon, 06 Dec 2004 06:13:31 -0800

> Can someone explain more about this?

It's wrong. Granted, the original IPsec RFC's were not very clear on how 
you configure something like this, but what is discussed above is an 
implementation problem probably resulting from a design decision to only 
permit one IKE SA between a given endpoint pair. It has always been 
possible to use granular per-port policies, and if a particular 
implementation does not support this, it's not because of a restriction 
in the IPsec standard.

Scott

---

From: Stephen Kent <[email-masked]>
Date: Mon, 13 Dec 2004 21:38:38 -0500

>Can someone explain more about this?

I think there is some confusion here, on several fronts:

	- TLS says nothing about cert management; TLS provides 
facilities for transporting certs. HTTPS is the relevant standard re 
cert management in this context, and I don't think it says anything 
about configuring root CAs ("trust anchors" in PKIX terminology) on a 
per-application basis.

	- RFC 2401, like TLS, says nothing about cert management in 
the way described above.  2401bis added the notion of the PAD, and I 
have recently provided text on PAD details to the PKI4IPSEC WG. That 
text provides means for restricting the scope of a trust anchor, and 
that could be used to constrain the set of SPD entries that are used 
with a given TA, which might be used to provide per-application TA 
bindings.

I am appalled by the text cited above. It's just wrong, including the 
misspelling of "IPsec!"

Steve