[saag] Request for guidance regarding E2E security over Diameter

[<[e-mail]>]

Hi,

As currently specified, the Diameter Base protocol (RFC6733) only offers transport level protection between neighboring Diameter peers, using either TLS/TCP, DTLS/SCTP, or IPsec as last resort. However, no mechanism has been defined to ensure E2E security for data (in the conveyed (in the form of Attribute-Value Pairs (AVPs)) in Diameter messages between two endpoints. Early 2000, at the beginning of the work on Diameter, CMS (Cryptographic Message Syntax) was identified as solution to provide AVP-level E2E security but this work was not completed due to lack of deployment interest (at least at that time) and the foreseen complexity of the developed solution for Diameter.

Due to the renewed interest for E2E security over Diameter, mainly for inter-domain signaling in the mobile network environment, the DIME WG has decided to reactivate the work on E2E security for Diameter. The first step is almost completed, with a document (draft-ietf-dime-e2e-sec-req-02) defining the requirements for an AVP-level E2E security solution. The second step will be work on the specification of such mechanism. An early proposal was to derive a solution from JOSE, encapsulating JOSE objects for integrity protection and AVP encryption. It is however expected that other mechanisms could be proposed as candidate solutions. And we know already that there are existing discussions on alternative to JOSE (e.g. COSE).

Whatever the proposed solution(s),the DIME WG has not (and will not have) the expertise required to evaluate and select the more appropriate security mechanism for E2E security over Diameter. We are therefore interested by any guidance and support from SAAG regarding the development of a solution for E2E security over Diameter, based on the requirements collected in draft-ietf-dime-e2e-sec-req-02.

Regards,

Lionel

_________________________________________________________________________________________________________________________

Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,
Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.

This message and its attachments may contain confidential or privileged information that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and delete this message and its attachments.
As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.
Thank you.