Subject: [AAA-WG]: Issue 59: e2e mandatory status

From: Pat Calhoun <[email-masked]>
Date: Thu, 14 Jun 2001 16:53:34 -0700

All,

I'd like to propose adding the following text to section 2.0 of the
base protocol spec. This is the consensus of a few of us that chatted 
today.

The general idea is to allow for NASes (and cheap embedded devices) NOT
to require the complexity of including CMS and related code. However, we
agreed that servers, and aggregating servers (read proxies) MUSt support it.
Relay and redirectors MAY support it, since they are typically either 
transparent, or not in the path of the messages.

Comments welcome,

PatC
----

   Diameter clients SHOULD support the CMS security application [11],
   while servers and proxy agents MUST support it. Relay and Redirector
   agents MAY support the CMS security application.

---

From: Pat Calhoun <[email-masked]>
Date: Fri, 15 Jun 2001 05:14:30 -0700

On Thu, Jun 14, 2001 at 04:53:34PM -0700, Pat Calhoun wrote:
All,

I've received some comments that my fix was not actually complete, and would
like to propose new text. First, the missing item was that the CMS spec
contains two features. The first is to protect AVPS via CMS, and the
second is the message that an access device may send to request that an
agent establish a security association with a server in a target realm. This
latter part must be supported by access devices, as it is very simple, and
doesn't require the complexity of CMS on the embedded device.

This is the first time, though, that we define that a portion of a
Diameter application needs to be supported, while another portion is
optional, and begs the question on whether these should really be
two separate applications.

Anyways, here is the text:

   The CMS Diameter security application [11] contains two features:
      1. A set of messages that allows a Diameter node to establish a
         security association, which is used to secure AVPs within a
         Diameter message, even though the message may traverse
         intermediate Diameter agents. A set of AVPs are also defined to
         sign and encrypt AVPs, as well as to transport certificates.
         This feature MUST be supported by Diameter server and proxy
         agents, SHOULD be supported by Diameter clients, and MAY be 
         supported by relay and redirector agents.
      2. A set of messages that allows a Diameter client to request that
         an agent establish a Diameter security association with a
         server in a specific realm. This feature MUST be supported by
         Diameter clients and Proxy agents, and MAY be supported by
         Diameter servers, relay and redirector agents.

Thanks,

PatC