Re: [Dime] unexpected consequence of deprecating E2E security in RFC 3588 bis

On Oct 2, 2012, at 1:40 PM, <dieter.jacobsohn@telekom.de> <dieter.jacobsohn@telekom.de> wrote:

> Hello all
> a question for me is also what exactly do we mean by:
> 
>> "MUST NOT be sent via intermediate nodes unless there is end-to-end 
>> security between the originator and recipient "
> 
> Which kind of e2e security? There is no such thing in Diameter right now, or did I miss something?

There is no such thing.. But we have the lack of it reflected in our charter.
Two meetings ago we had some discussion around the topic during the WG meeting.

> We can only do e2e security by hop-by-hop security (IPsec or TLS), if there is NO intermediate (Diameter) node.
> So, either we have e2e security, then there is no intermediate node - or we have intermediate nodes, then there can't be e2e security. 

As for now, you can go around this for coming applications by application
specific means; like defining AVPs that inherently only carry encrypted
payload etc.

- Jouni

> 
> 
> Best regards
> Dieter Jacobsohn
> 
> 
> Deutsche Telekom AG
> Group Technology
> Dieter Jacobsohn
> Landgrabenweg 151, 53227 Bonn
> +49 228 936-18445 (Tel.)
> +49 391 5801 46624 (Fax)
> +49 171 2088 710 (Mobil)
> E-Mail: dieter.jacobsohn@telekom.de
> www.telekom.com    
> 
> Erleben, was verbindet.  
> 
> Deutsche Telekom AG
> Aufsichtsrat: Prof. Dr. Ulrich Lehner (Vorsitzender)
> Vorstand: René Obermann (Vorsitzender),
> Dr. Manfred Balz, Reinhard Clemens, Niek Jan van Damme,
> Timotheus Höttges, Claudia Nemat,  Prof. Dr. Marion Schick
> Handelsregister: Amtsgericht Bonn HRB 6794
> Sitz der Gesellschaft Bonn
> USt-IdNr. DE 123475223
> 
> Große Veränderungen fangen klein an - Ressourcen schonen und nicht jede E-Mail drucken. 
> 
> 
> _______________________________________________
> DiME mailing list
> DiME@ietf.org
> https://www.ietf.org/mailman/listinfo/dime