Subject: RE: [Sigtran] security issues

From: [email-masked]
Date: Thu, 5 Dec 2002 11:15:27 -0500

Hi Lyndon and others,

In discussing security you would have to consider whether the solution is
really security of the adaptation protocol or network security.  One issue
to consider if it is a requirement to use IPsec encapsulation at the node
supporting the adaption layer and the SS7 application, is that it would
impact the use of monitoring systems (e.g., SS7 link monitoring systems).
Specifically, for M2PA we were envisioning a solution where IPsec tunnel
mode is used to provide secure tunnels between gateway routers and the SS7
node itself (e.g., SG and MGC) would not have to support IPsec.  This would
allow link monitoring systems to be used at the SS7 nodes the way they are
being used in SS7 networks today.

Therefore, in specifying requirements for nodes to support TLS and IPsec
encapsulation, please consider that certain network providers would like to
continue use of their link monitoring systems.

Regards
Ray

                    john.loughney                                                                  
                    @nokia.com           To:     [email-masked], [email-masked]                 
                                         cc:     (bcc: Ray P. Singh/Telcordia)                     
                    12/04/02             Subject:     RE: [Sigtran] security issues                
                    11:57 PM                                                                       

Hi Lyndon,

The issue is quite clear.  You run something over IP, you need security.
I've seen a number of operator's plans who will be running SIGTRAN
protocols over the Internet (which I define as connecting different
networks with IP, by using global IP addresses).  That being said,
we need to specify a MUST to implement security protocol, otherwise
it is impossible ensure interoperability with regards to security. We
are leaning to IPsec because TLS would require protocol changes to existing
SIGTRAN protocols and because TLS uses a single stream only.

We have tried to outline the issues here:

http://www.ietf.org/internet-drafts/draft-ietf-sigtran-security-00.txt

Comments welcome.

thanks,
John
> -----Original Message-----
> From: ext Ong, Lyndon [mailto:[email-masked]]
> Sent: 05 December, 2002 01:41
> To: [email-masked]
> Subject: [Sigtran] security issues
>
>
> Hi Folks,
>
> The remaining issues with security are currently a roadblock to IESG
> approval of further UA documents.  One issue in particular is whether
> to mandate implementation of IPSec or TLS for security, as one
> mechanism should be selected for interoperability.  I would like to
> hear if people have opinions on this either way.
>
> If the issue is unclear to people, I'm also wondering if it might make
> sense to form some type of design team to address this.
>
> Cheers,
>
> L. Ong
> _______________________________________________
> Sigtran mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/sigtran
>
_______________________________________________
Sigtran mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/sigtran

_______________________________________________
Sigtran mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/sigtran

---

From: Michael Tuexen <[email-masked]>
Date: Thu, 5 Dec 2002 17:29:42 +0100

Ray,

the IESG requests the use of end-to-end security. So you will
have only two choices:
- Sniff at the endpoint after IPSec processing
- Have Sniffers which know about IPSec and the key material, which
   is then, of course, a security problem.
So I do not see a solution to make the IESG and you happy.

Best regards
Michael

--
[email-masked]

---

From: Scott Bradner <[email-masked]>
Date: Thu, 5 Dec 2002 14:15:08 -0500 (EST)

> the IESG requests the use of end-to-end security. So you will

John has it correct - the IESG requests the ability to be able to use 
end to end security as a bas part of the propocol - it is not enought
to assume that it will be run in a securit environment - but the IESG
does not make any demands on use - that is up to the user

Scott