Subject: RE: [Sigtran] security issues

From: [email-masked]
Date: Thu, 5 Dec 2002 06:57:17 +0200

Hi Lyndon,

The issue is quite clear.  You run something over IP, you need security.
I've seen a number of operator's plans who will be running SIGTRAN
protocols over the Internet (which I define as connecting different
networks with IP, by using global IP addresses).  That being said,
we need to specify a MUST to implement security protocol, otherwise
it is impossible ensure interoperability with regards to security. We 
are leaning to IPsec because TLS would require protocol changes to existing 
SIGTRAN protocols and because TLS uses a single stream only.

We have tried to outline the issues here:

http://www.ietf.org/internet-drafts/draft-ietf-sigtran-security-00.txt

Comments welcome.

thanks,
John
> -----Original Message-----
> From: ext Ong, Lyndon [mailto:[email-masked]]
> Sent: 05 December, 2002 01:41
> To: [email-masked]
> Subject: [Sigtran] security issues
> 
> 
> Hi Folks,
> 
> The remaining issues with security are currently a roadblock to IESG
> approval of further UA documents.  One issue in particular is whether
> to mandate implementation of IPSec or TLS for security, as one 
> mechanism should be selected for interoperability.  I would like to
> hear if people have opinions on this either way.
> 
> If the issue is unclear to people, I'm also wondering if it might make
> sense to form some type of design team to address this.
> 
> Cheers,
> 
> L. Ong
> _______________________________________________
> Sigtran mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/sigtran
> 
_______________________________________________
Sigtran mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/sigtran

---

From: "Brian F. G. Bidulock" <[email-masked]>
Date: Thu, 5 Dec 2002 03:19:16 -0700

John,

Looking at the draft it looks fine (however, I am not conversant on all
the technical details of IPSec and TLS).  One significant issue,
however, is that the recommendations rely on two drafts (TLS draft and
SCTP IPSec draft) which are work in progress.  This begs two questions:

1)  How can a SIGTRAN UA RFC security section rely on a Work in
    Progress?

2)  How can a SIGTRAN UA properly address security issues which TSVWG
    has not yet put in place for SCTP?

In fact, few (if any) of the security issues appear to be related to any
SIGTRAN UA.  They appear to be all related to SCTP and whether SCTP can
provide its services (multi-homing, multiple streams) transparently
under a security regime.

How can SIGTRAN be expected to address SCTP security issues within the
SIGTRAN charter?  Are these not the responsibility of TSV (where the
cited works in progress have not been advanced)?

Certainly if a security regime for SCTP existed which allowed SCTP to
provide its services to its ULP with the defined SCTP interface, SIGTRAN
UAs could point at that RFC and say "use that" and go on to discuss the
idiosyncrasies of particular UAs with regard to the manageability or
operation of such a regime.

Until then, contrasting two works in progress, or point to one work in
progress or the other, does not acheive much.

Comments?

--brian

John Loughney wrote:                            (Thu, 05 Dec 2002 06:57:17)

-- 
Brian F. G. Bidulock
[email-masked]
http://www.openss7.org/

---

From: "Brian F. G. Bidulock" <[email-masked]>
Date: Thu, 5 Dec 2002 05:05:45 -0700

Michael,

Michael Tuexen wrote:                          (Thu, 05 Dec 2002 11:24:43)
> Brian,
> see my comments below.
> Best regards
> Michael
> 
> Brian F. G. Bidulock wrote:
> > John,
> > 
> It can not. The TLS over SCTP is PS. The IPSec doc is not 'necessary'.
> IPSec is working, you need only 2 * n * m security associations for
> an SCTP asscociation where one endpoint announces n addresses and
> the other endpoint m addresses. To reduce this number to 2 the IPSec ID
> enables security association to handle multihoming. Therefore you
> can consider the ID as an optimization. So we do not have to rely on
> Work in progress.

Then don't recommend it.

> TLS over SCTP is done. I will come up with a short ID describing
> TLS usage for SIGTRAN. This will focus on a session upgrade procedure.

What RFC number is TLS over SCTP?

--brian

---

From: Michael Tuexen <[email-masked]>
Date: Thu, 05 Dec 2002 11:24:43 +0100

Brian,
see my comments below.
Best regards
Michael

---

From: Michael Tuexen <[email-masked]>
Date: Thu, 05 Dec 2002 13:36:19 +0100

Brian,
see my comments below.
Best regards
Michael

> What RFC number is TLS over SCTP?
The status is PS. The document is in the authors 48 hours period. It
will be published as RFC 3436 when the '48 hours' are over.