Re: [Dime] On RFC3588bis security.. Stephen Farrell's DISCUSS

Hi,

On Jan 3, 2012, at 7:24 PM, <lionel.morand@orange.com> <lionel.morand@orange.com> wrote:

> OK with the direction of the proposal.
> Just too questions for clarification:
> - do we keep a priority order between 1/(D)TLS and 2/IPsec as currently documented in draft or is it also challenged by the Stephen's comment?

Stephen does not challenge the priority order. I would personally have a slight preference for IPsec as it is already there for other purposes but I am definitely OK having the current priority order the WG came up with.

> - Is it clear that mandating the possible use of IPsec to secure the connection does not mandate the peers to support of Diameter by the peers (e.g. use of IPsec GWs btw peers)?

This is a good point to emphasize. One known deployment that will rely on IPsec is 3GPP Rel-8. For example, GSMA recently put references to NDS into LTE roaming guideline IR.88 for securing Diameter connections.

In addition to Stephen's Section 13 change proposal also Section 2.2 sentence "If desired, alternative security mechanisms that are independent of Diameter, such as IPsec [RFC4301], can be deployed to secure connections between peers." needs to be changed to make it explicit that the alternative security mechanism is IPsec based.

- Jouni

> 
> Regards,
> 
> Lionel 
> 
> -----Message d'origine-----
> De : dime-bounces@ietf.org [mailto:dime-bounces@ietf.org] De la part de Tina TSOU
> Envoyé : lundi 21 novembre 2011 09:49
> À : jouni korhonen; dime@ietf.org
> Objet : Re: [Dime] On RFC3588bis security.. Stephen Farrell's DISCUSS
> 
> This solution works for me, though I think TLS is closer to what most of the vendors currently implement.
> 
> 
> Best Regards,
> Tina TSOU
> http://tinatsou.weebly.com/contact.html
> 
> -----Original Message-----
> From: dime-bounces@ietf.org [mailto:dime-bounces@ietf.org] On Behalf Of jouni korhonen
> Sent: Monday, November 21, 2011 12:38 AM
> To: dime@ietf.org
> Subject: [Dime] On RFC3588bis security.. Stephen Farrell's DISCUSS
> 
> Folks,
> 
> During the meeting we had a discussion on Stephen Farrell's discuss: https://datatracker.ietf.org/doc/draft-ietf-dime-rfc3588bis/ballot/#stephen-farrell
> 
> Glen had a solution proposal that we follow what Stephen suggested i.e. mandate use of either IPsec or (D)TLS within the spec and leave out the "some security mechanism". This of course has some impact on product & deployment level as from now on either IPsec or (D)TLS must be used..
> 
> Any feedback?
> 
> - Jouni
> _______________________________________________
> DiME mailing list
> DiME@ietf.org
> https://www.ietf.org/mailman/listinfo/dime
> _______________________________________________
> DiME mailing list
> DiME@ietf.org
> https://www.ietf.org/mailman/listinfo/dime