Re: [tsvwg] 3GPP SA3 reply LS on SCTP-AUTH and DTLS

[John Mattsson <[e-mail]>]

Hi Michael,

>Where you able to also get some feedback related to the questions I raised in my e-mail sent on May 14th?
I was not there myself. But I would assume that 3GPP did not discuss more than the information in the LS and in the drafts. Your questions are certainly relevant, but the security group might not be the right working group to ask some of your questions.

Magnus and Michael wrote:
>> Much lower requirements on DTLS implementations when it comes to support of functionality
>Which is the other way around at the SCTP level.
Not having to make any changes to the DTLS library is very important from a security standpoint. Changes to the DTLS library can easily introduce security vulnerabilities and having changes makes it much harder to quickly apply security patches.

Cheers,
John

From: Michael Tuexen <[e-mail]>
Date: Wednesday, 31 May 2023 at 16:04
To: John Mattsson <[e-mail]>
Cc: [e-mail] <[e-mail]>
Subject: Re: [tsvwg] 3GPP SA3 reply LS on SCTP-AUTH and DTLS
> On 30. May 2023, at 17:54, John Mattsson <john.mattsson=[e-mail]> wrote:
>
> Hi,
> 3GPP SA3 (Security) had a meeting last week and sent a Reply LS to TSVWG regarding SCTP-AUTH and DTLS. The LS will appear in the IETF LS tracker at a later date when the 3GPP and IETF secretariats has processed the LS.
> https://protect2.fireeye.com/v1/url?k=31323334-501d5122-313273af-454445555731-e80a50d8b7f2c96c&q=1&e=910c8519-cb03-46e1-a414-afc589ed9d3f&u=https%3A%2F%2Fwww.3gpp.org%2Fftp%2Ftsg_sa%2FWG3_Security%2FTSGS3_111_Berlin%2FDocs%2FS3-233355.zip
> SA3 discussed the discovered vulnerabilities, DTLS over SCTP, DTLS in SCTP, the importance of this work, and agreed on the following text:
> "SA3 would like to thank IETF Transport Area Working Group (TSVWG) for notifying SA3 of the vulnerabilities related to SCTP-AUTH and DTLS over SCTP.
> SA3 agrees that the vulnerabilities are serious – they are affecting confidentiality, integrity, replay, and availability. Supporting DTLS over SCTP in N2, Xn, F1, and E1 interfaces has been made mandatory from Release 15 onwards. Therefore, SA3’s understanding is that it is important to solve all the security vulnerabilities, including the availability vulnerabilities. Since the problem is related to the use of DTLS with SCTP, SA3’s understanding is that the solution should be based on DTLS, and the solution should not rely on unsupported DTLS features.
> SA3 kindly asks TSVWG to work on and publish a solution as soon as possible."
Hi John,

thanks for the information. Where you able to also get some feedback related to the questions
I raised in my e-mail sent on May 14th?
> We need to progress the work in TSVWG fulfilling 3GPP requirements of fixing the availability vulnerabilities, not relying on unsupported DTLS features, and to publish a solution as soon as possible. DTLS in SCTP seems like the only solution as it solves the availability vulnerabilities and do not rely on unsupported DTLS features.
This conclusion is not clear to me. It highly depends on the architecture of the SCTP you are using.
Therefore, my questions above. However, up to know we have not made any particular requirements on
whether you use a userland or kernel SCTP stack. We just specified a socket API and ensured that
you can implement it in kernel land. Implementing it in userland is then not a problem.

Best regards
Michael
> Cheers,
> John