Subject: [Dime] I-D Action:draft-pascual-dime-sctp-00.txt

From: Victor Pascual Avila <[email-masked]>
Date: Mon, 8 Nov 2010 13:32:19 +0100

Hi Folks,

Being related to some recent discussion
(http://www.ietf.org/mail-archive/web/dime/current/msg04545.html) we
have just submitted a draft on the usage of Diameter over SCTP.

Filename: draft-pascual-dime-sctp

Version: 00

URL: http://tools.ietf.org/id/draft-pascual-dime-sctp-00.txt

Title: The Stream Control Transmission Protocol (SCTP) as a Transport
for the Diameter Protocol

Abstract: This document provides the guidelines for usage of SCTP (the
Stream Control Transmission Protocol) as the transport mechanism
between Diameter entities.

Author(s):
Victor Pascual, [email-masked]
Gonzalo Camarillo, [email-masked]

Comments are welcome!

Cheers,
-Victor

---

From: Sebastien Decugis <[email-masked]>
Date: Tue, 09 Nov 2010 18:16:31 +0900

Hi Victor,

I have a few comments on this draft.

First of all, thank you for putting this together, I believe it is very
useful :)

To comment on the "Editor's note" in section 3.1:
I don't know the exact difference, but in my experience using the
destination port number is an efficient way to track the exchange in a
protocol analyzer. I am not sure of the value added by the PPID. In case
there is such value, I guess 2 PPID are needed, one for plain Diameter
and one for Diameter over DTLS?

Section 3.3 (port number):
I don't understand the purpose of this paragraph.
Also, should a different port be attributed to DTLS/SCTP ? Would it be
the same as TLS/TCP ? Or using PPID is better and we reserve only one
port for Diameter/SCTP ?
Edit: after reading 5.3, I got to understand. Maybe a little more
wording to specify that section 3 concerns the case Diameter over IPsec
would be useful.

Section 4. (DTLS instead of TLS)
Is it not better to deprecate the use of TLS -- easy because it was
never clearly required anyway -- and recommend the use of DTLS as the
only available mechanism? Or is it your intention to say that both
mechanisms (TLS and DTLS) are possible ? In that case, how does an
implementation know which one to use if both mechanisms are allowed --
do we need to reserve 2 different ports to distinguish TLS and DTLS?

Section 5.
"SCTP over IPsec is the RECOMMENDED solution for securing Diameter
messages until..."
I am not sure that this sentence is useful at all, I would rather not
have it. But, I am maybe missing something here.
My rationale is that using (D)TLS allows the Diameter application to
have control over the credentials used to protect the connection and
bind these credentials (such as subject of the certificate) to the
Diameter Identity advertized by the remote peer. IPsec does not allow to
do this as easily (e.g. a Diameter peer could impersonate another peer
in that case). Therefore, I believe that (D)TLS should be recommended
over IPsec, and not the other way around as the proposed text suggest.
But I agree that the lack of deployment might be an issue -- the same as
the lack of support for SCTP at all, actually...

5.2 (ordering)
There are a few rare cases where the messages actually have to be
ordered. For example, if a message is sent immediatly after a CEA (might
happen after a connection is restored) but received before this CEA, it
will be discarded, as per the connection state machine. With playing
with different streams it is possible to work around this. The same
applies probably to unordered delivery (I have not checked). For
example, unordered delivery should not be used until a message has been
received from the remote peer after CEA has been sent.
Another such race condition is possible with DPR/DPA exchange (if DPR is
received before the last message, although it was sent after).
For this one I am not sure what the correct workaround could be -- maybe
just don't send a DPR "too soon" after a message.

5.3. Ok, this explains and answers my comment on 3.3.  A little more
wording in that section would help understanding, maybe -- or it is just
me ^^

Best regards, and good work!
Sebastien.

Le 08/11/2010 21:32, Victor Pascual Avila a écrit :
> _______________________________________________
> DiME mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dime

-- 
Sebastien Decugis
Research fellow
Network Architecture Group
NICT (nict.go.jp)

---

From: Victor Pascual Avila <[email-masked]>
Date: Wed, 10 Nov 2010 06:34:52 +0100

Hi Sebastien,

thanks for your comments. Answers to a couple of points inline...

On Tue, Nov 9, 2010 at 10:16 AM, Sebastien Decugis <[email-masked]> wrote:
> implementation know which one to use if both mechanisms are allowed

I'd say
- For TCP: TLS is the primary method for securing Diameter and IPsec
is a secondary alternative
- For SCTP: DTLS is the primary method for securing Diameter and IPsec
is a secondary alternative

> just don't send a DPR "too soon" after a message.

AFAIU the ordering is provided at the application level and there is
no need to handle this at the transport layer. As you mention, there
could be exceptions like CER/CEA or STR/STA but I believe this is
something that could be worked around in the implementation.

Cheers,
-Victor