Subject: RE: [sigtran] draft-ietf-sigtran-security-01.txt

From: [email-masked]
Date: Tue, 4 Feb 2003 08:06:03 +0200

Hi Andrew,

> 2) line 424
>   "It is recommended that SIGTRAN peers use the same security mechanism
>   (IPSec or TLS) across all its sessions with other SIGTRAN peers."
> 
>   This recommendation seems to encourage the use of IPSec, since peers 
> are required to support IPSec while TLS is optional.  For example, 
> suppose that a server interacts with implementations from several 
> vendors, where additional vendors could be added later, then there is no 
> guarantee that the new implementations would support TLS.   So the 
> server would be "recommended" to use IPSec.  All of this is technically 
> fine, it just seems to stack the odds against general TLS support.

The opinion of the security area was that a single security solution
needs to be mandatory, to ensure interoperability.  In addition, mixing
TLS on some links and IPsec on others leads to known possible security holes.
Now, in deployments, TLS or IPsec could be chosen, depending upon the
service providers needs.

br,
John
_______________________________________________
Sigtran mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/sigtran