Subject: RE: [Sigtran] M2PA Security section (was: m2pa comment: author li st)

From: Tuexen Michael <[email-masked]>
Date: Wed, 12 Feb 2003 09:25:51 +0100

Hi,

why not simply referring to the SIGTRAN security doc instead
of reproducing part of it?

Best regards
Michael

Michael Tuexen   Tel.:   +49 89 722 47210
Siemens AG       Fax:    +49 89 722 48212
ICN CP SE C 7    e-mail: [email-masked]

> -----Original Message-----
> From: Tom George [mailto:[email-masked]]
> Sent: Tuesday, February 11, 2003 10:58 PM
> Cc: [email-masked]'
> Subject: [Sigtran] M2PA Security section (was: m2pa comment: author
> list)
> 
> 
> On Jan 26, 2003 "Ong, Lyndon" wrote:
>   [...]
> > The security section probably needs to be updated based on the
> > security framework document (which should come out this week).
>   [...]
> 
> Here is my first stab at revising section 6 of the M2PA 
> draft. Comments
> are welcome, especially since I am not familiar with the security
> protocols.
> 
> tomG.
> 
> =============================
> 6. Security
> 
> M2PA is designed to carry signaling messages for telephony
> services. As such, M2PA MUST involve the security needs of several
> parties: 
> 
>    - the end users of the services
> 
>    - the network providers
> 
>    - the applications involved
> 
> Additional requirements MAY come from local regulation.  
> 
> While these parties may have some overlapping security needs, their
> needs may not be identical. Any security solution SHOULD fulfill all
> of the different parties' needs.
> 
> 6.1 Security Requirements
> 
> As a transport protocol, M2PA has the following security objectives:
> 
>    - Availability of reliable and timely user data transport.
> 
>    - Integrity of user data transport.
> 
>    - Confidentiality of user data.
> 
> M2PA runs on top of SCTP [RFC2960].  SCTP provides certain transport
> related security features, as discussed in [Security]. However, these
> security features MAY NOT be adequate for all of the involved parties'
> requirements.
> 
> When M2PA is running in professionally managed corporate or service
> provider network, it is reasonable to expect that this network
> includes an appropriate security policy framework. The "Site Security
> Handbook" [RFC2196] SHOULD be consulted for guidance.
> 
> When the network in which M2PA runs involves more than one party
> (e.g., a non-private network), it MAY NOT be reasonable to expect that
> all parties have implemented security in a sufficient manner.  In such
> a case, it is recommended that IPSec or TLS be used to ensure
> confidentiality of the user payload. Consult [Security] for more
> guidance on the use of security protocols. 
> 
> 6.2 Protecting Confidentiality
> 
> Particularly for mobile users, the requirement for confidentiality MAY
> include the masking of IP addresses and ports. In this case
> application-level encryption is not sufficient. IPSec ESP SHOULD be
> used instead [RFC2401].  Regardless of which level performs the
> encryption, the IPSec ISAKMP service SHOULD be used for key
> management.
> 
> =============================
> 
> {Add an informative reference:}
> 
>   [Security]
>        J. Loughney, M. Tuexen, and J. Pastor-Balbas, "Security
>        Considerations for SIGTRAN Protocols,"
>        draft-ietf-sigtran-security-01.txt (January 2003).
> 
> =============================
> 
> -- 
> * Tom George       PB7-24001 (near B-21)      
> [email-masked]  *
> * 972-519-3168   Intranet:  
http://www.ssd.usa.alcatel.com/~tgeorge/  *
* Alcatel;  3400 West Plano Pkwy,  MS PB7-SWPRO;  Plano, Texas 75075  *
* I actively disclaim speaking for Alcatel USA, Inc. I do not purport *
* to advertise or represent its position,  operations, or activities. *
_______________________________________________
Sigtran mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/sigtran
_______________________________________________
Sigtran mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/sigtran

---

From: Ken Morneault <[email-masked]>
Date: Wed, 12 Feb 2003 09:48:55 -0500

Tom,

Also, it should be a "normative" reference.

Ken

---

From: Tom George <[email-masked]>
Date: Wed, 12 Feb 2003 09:39:06 -0600

OK with me. I will put it in the normative section. 

  [...]

-- 
* Tom George       PB7-24001 (near B-21)      [email-masked]  *
* 972-519-3168   Intranet:  http://www.ssd.usa.alcatel.com/~tgeorge/  *
* Alcatel;  3400 West Plano Pkwy,  MS PB7-SWPRO;  Plano, Texas 75075  *
* I actively disclaim speaking for Alcatel USA, Inc. I do not purport *
* to advertise or represent its position,  operations, or activities. *
_______________________________________________
Sigtran mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/sigtran

---

From: Tom George <[email-masked]>
Date: Wed, 12 Feb 2003 14:37:24 -0600

Michael,

This is a good idea. I could replace the text in 6.1 with a reference to
the SIGTRAN security draft.

Why was the "Site Security Handbook" RFC 2196 not mentioned in the
SIGTRAN security draft? I think I picked up my reference to this
document from the M3UA RFC. 

There is no mention of the consideration about wireless users as in 6.2.
Should this be in the SIGTRAN security draft, M2PA, both, or neither?

tomG.

---

From: Tom George <[email-masked]>
Date: Mon, 17 Feb 2003 17:01:36 -0600

Here is my 2nd attempt at revising the security section.

tomG.

==========================================
6. Security

   - the network providers

Consult [Security] for a discussion of security requirements and for
guidance on the use of security protocols.

Particularly for wireless users, the requirement for confidentiality
MAY include the masking of IP addresses and ports. In this case
application-level encryption is not sufficient. IPSec ESP SHOULD be
used instead [RFC2401].  Regardless of which level performs the
encryption, the IPSec ISAKMP service SHOULD be used for key
management.

{Add a normative reference:}

  [Security]

==========================================