Subject: [Tsvwg] I-D ACTION:draft-tuexen-tsvwg-tls-over-sctp-00.txt

From: [email-masked]
Date: Tue, 26 Jun 2001 07:01:42 -0400

A New Internet-Draft is available from the on-line Internet-Drafts directories.

	Title		: TLS over SCTP
	Author(s)	: M. Tuexen, A. Jungmaier
	Filename	: draft-tuexen-tsvwg-tls-over-sctp-00.txt
	Pages		: 6
	Date		: 25-Jun-01
	
This document describes the usage of the Transport Layer Security (TLS)
protocol, as defined in [RFC2246], over the Stream Control Transmission
Protocol (SCTP), as defined in [RFC2960].

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-tuexen-tsvwg-tls-over-sctp-00.txt

Internet-Drafts are also available by anonymous FTP. Login with the username
"anonymous" and a password of your e-mail address. After logging in,
type "cd internet-drafts" and then
	"get draft-tuexen-tsvwg-tls-over-sctp-00.txt".

A list of Internet-Drafts directories can be found in
http://www.ietf.org/shadow.html 
or ftp://ftp.ietf.org/ietf/1shadow-sites.txt

Internet-Drafts can also be obtained by e-mail.

Send a message to:
	[email-masked].
In the body type:
	"FILE /internet-drafts/draft-tuexen-tsvwg-tls-over-sctp-00.txt".
	
NOTE:	The mail server at ietf.org can return the document in
	MIME-encoded form by using the "mpack" utility.  To use this
	feature, insert the command "ENCODING mime" before the "FILE"
	command.  To decode the response(s), you will need "munpack" or
	a MIME-compliant mail reader.  Different MIME-compliant mail readers
	exhibit different behavior, especially when dealing with
	"multipart" MIME messages (i.e. documents which have been split
	up into multiple messages), so check your local documentation on
	how to manipulate these messages.

Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.

---

From: Tuexen Michael <[email-masked]>
Date: Wed, 27 Jun 2001 12:12:22 +0200

Dear Robert,

SCTP provides the support of the multiple streams to avoid head of line blocking. We thought that this feature should also be available to the
(TLS/SCTP)-user.

We also wanted to keep TLS as it is. TLS needs a guaranteed and in sequence
delivery service from its lower layer. This service is provided by a stream,
but NOT by an assocaition. So a connection maps to a bi directional stream.

We also thought about having only one connection for an association (with
multiple streams) but this needs some changes/adaptions of TLS. So we decided
to use the simpler solution unless we see the need for the more complex one.

Best regards
Michael

Michael Tuexen    Tel.:   +49 89 722 47210
Siemens AG        Fax:    +49 89 722 48212
ICN WN CS SE 5    E-mail: [email-masked]

> -----Original Message-----
> From:	Fairlie-Cuninghame, Robert [SMTP:[email-masked]]
> Sent:	Wednesday, June 27, 2001 12:03 PM
> To:	[email-masked]'; [email-masked]'
> Cc:	[email-masked]
> Subject:	RE: [Tsvwg] I-D ACTION:draft-tuexen-tsvwg-tls-over-sctp-00.txt
> 
> Hi Michael & Andreas, 
> 
> Why was the decision made to map each TLS connection  to an SCTP stream to a rather than an SCTP association? To me this would seem to be the natural overlay of TLS onto SCTP. I'm not very familiar with the workings of TLS, is there a technical problem in doing this ? 
> 
> Regards, 
> 
> Robert. 
> 
> -----Original Message----- 
> From:   [email-masked] [ <mailto:[email-masked]>] 
> Sent:   Tuesday, June 26, 2001 12:02 PM 
> Cc:     [email-masked] 
> Subject:        [Tsvwg] I-D ACTION:draft-tuexen-tsvwg-tls-over-sctp-00.txt 
> 
>  << Message:  >> A New Internet-Draft is available from the on-line Internet-Drafts directories. 
> 
> 
>         Title           : TLS over SCTP 
> <http://www.ietf.org/internet-drafts/draft-tuexen-tsvwg-tls-over-sctp-00.txt> 
> 
> <http://www.ietf.org/shadow.html> 
> or <ftp://ftp.ietf.org/ietf/1shadow-sites.txt> 
> 
> 

_______________________________________________
tsvwg mailing list
[email-masked]
http://www1.ietf.org/mailman/listinfo/tsvwg

---

From: "Fairlie-Cuninghame, Robert" <[email-masked]>
Date: Wed, 27 Jun 2001 03:02:43 -0700

Hi Michael & Andreas,

Why was the decision made to map each TLS connection  to an SCTP stream to a
rather than an SCTP association? To me this would seem to be the natural
overlay of TLS onto SCTP. I'm not very familiar with the workings of TLS, is
there a technical problem in doing this ? 

Regards,

Robert.

-----Original Message-----
From:	[email-masked] [mailto:[email-masked]]
Sent:	Tuesday, June 26, 2001 12:02 PM
Cc:	[email-masked]
Subject:	[Tsvwg] I-D ACTION:draft-tuexen-tsvwg-tls-over-sctp-00.txt

 << Message:  >> A New Internet-Draft is available from the on-line
Internet-Drafts directories.

	Title		: TLS over SCTP

Send a message to:
	[email-masked].
In the body type:

---

From: Tuexen Michael <[email-masked]>
Date: Wed, 27 Jun 2001 13:34:38 +0200

Dear Robert,

we do not support TLS/U-SCTP, therefore it is not mentioned there. Furthermore we
assume that a bi-directional is used by TLS only! So the TLS user is not able
to transmit user message on a stream used by TLS without using TLS.

Since TLS does not provide unordered delivery it will not make use of this feature
in SCPT. But we can state this explicitly in the next version of the draft.

There was also a suggestion (by Qiaobing) saying that we should not require
the in/outbound stream number to be the same. We could restrict the usage of
bi-directional streams for TLS to min(instreamsA, outstreamsA, instreamsB, instreamsB).
The higher streams could be used uni-directional (without TLS) and even in the 
sense of U-SCTP.
On the pro side of this solution is the greater flexibility. On the cons we have TLS
users which access the the association via the TLS API and directly via the SCTP-API.
This brings up the need for some rules: We must make sure that there is no user message
marked for unordered delivery inflight on a bi-directional stream before we start using
it for TLS. The simplest way to do this is to disallow it at all on these streams. 

Best regards
Michael

> Sent:	Wednesday, June 27, 2001 1:11 PM
> To:	'Tuexen Michael'
> Cc:	[email-masked]
> Hi Michael, 
> I guessed as much - shame. What if the application asserts the unordered delivery flag in a particular datagram (or the stream is configured for U-SCTP)? At the very least I think this should be mentioned/disallowed in the draft.
> 
> Cheers, 
> 
> Robert. 
> 
> From:   Tuexen Michael [ <mailto:[email-masked]>] 
> Sent:   Wednesday, June 27, 2001 11:12 AM 
> To:     'Fairlie-Cuninghame, Robert'; Tuexen Michael; [email-masked]' 
> Cc:     [email-masked]