Re: [tsvwg] 3GPP SA3 reply LS on SCTP-AUTH and DTLS

[Michael Tuexen <[e-mail]>]

> On 30. May 2023, at 17:54, John Mattsson <john.mattsson=[e-mail]> wrote:
> 
> Hi,
> 3GPP SA3 (Security) had a meeting last week and sent a Reply LS to TSVWG regarding SCTP-AUTH and DTLS. The LS will appear in the IETF LS tracker at a later date when the 3GPP and IETF secretariats has processed the LS.
> https://www.3gpp.org/ftp/tsg_sa/WG3_Security/TSGS3_111_Berlin/Docs/S3-233355.zip
> SA3 discussed the discovered vulnerabilities, DTLS over SCTP, DTLS in SCTP, the importance of this work, and agreed on the following text:
> "SA3 would like to thank IETF Transport Area Working Group (TSVWG) for notifying SA3 of the vulnerabilities related to SCTP-AUTH and DTLS over SCTP.
> SA3 agrees that the vulnerabilities are serious – they are affecting confidentiality, integrity, replay, and availability. Supporting DTLS over SCTP in N2, Xn, F1, and E1 interfaces has been made mandatory from Release 15 onwards. Therefore, SA3’s understanding is that it is important to solve all the security vulnerabilities, including the availability vulnerabilities. Since the problem is related to the use of DTLS with SCTP, SA3’s understanding is that the solution should be based on DTLS, and the solution should not rely on unsupported DTLS features.
> SA3 kindly asks TSVWG to work on and publish a solution as soon as possible."
Hi John,

thanks for the information. Where you able to also get some feedback related to the questions
I raised in my e-mail sent on May 14th?
> We need to progress the work in TSVWG fulfilling 3GPP requirements of fixing the availability vulnerabilities, not relying on unsupported DTLS features, and to publish a solution as soon as possible. DTLS in SCTP seems like the only solution as it solves the availability vulnerabilities and do not rely on unsupported DTLS features.
This conclusion is not clear to me. It highly depends on the architecture of the SCTP you are using.
Therefore, my questions above. However, up to know we have not made any particular requirements on
whether you use a userland or kernel SCTP stack. We just specified a socket API and ensured that
you can implement it in kernel land. Implementing it in userland is then not a problem.

Best regards
Michael
> Cheers,
> John