Subject: [AAA-WG]: Issue 60: E2E cert names

From: Pat Calhoun <[email-masked]>
Date: Tue, 5 Jun 2001 07:17:37 -0700

My understanding of the cert names was that by adding the -diameter in the
cert name, it became obvious that this cert was useful ONLY for Diameter, not
for anything else.

However, I believe that Stephen could answer this question better than I could
given that this particular section is his text.

PatC

---

From: Jari Arkko <[email-masked]>
Date: Wed, 06 Jun 2001 12:05:59 +0300

> cert name, it became obvious that this cert was useful ONLY for Diameter, not

Yes. Well, to be exact, this is obvious only to humans with
a brain; not necessarily to mindless machines executing PKI
operations. For instance, a Netscape browser would propably
happily accept a name like [email-masked] since the
knowledge of the naming rules exists only within Diameter
implementations, not elsewhere. Therefore, what this spec
really means that is that a Diameter client doesn't by
accident accept the certificate of the ISP's web server
even if the web server and the AAA server use the same
CA. But a web client could accept the AAA server's
certificate.

I suppose the spec is fine; having a specific naming in the
certificates shouldn't be that much of an issue and it
does buy _some_ level of additional ease as the same CA
can be used for different purposes. The only drawback is
that in some cases additional certificates may have to
be manufactured for a node, for instance to support VPN
layer and application layer authentication, and Diameter.
However, since currently we don't have similar naming
constraints on other areas it could still be that e.g.
a SIP proxy would use a Diameter certificate with the
name "[email-masked]" in Diameter, IPsec, and
SIP layer operations.

Jari

---

From: Pat Calhoun <[email-masked]>
Date: Wed, 6 Jun 2001 06:41:28 -0700

> name "[email-masked]" in Diameter, IPsec, and

Perhaps Stephen has a response to your comment...

PatC

---

From: Stephen Farrell <[email-masked]>
Date: Thu, 07 Jun 2001 14:32:28 +0100

The -diameter naming is intended to make it easier to use 
an existing CA for Diameter, as pointed out below, it means that 
a Diameter node won't accidentally accept e.g. an end user's email 
certificate.

I don't believe there's any problem if you also want to use the
same certificate for other purposes as well, since a single
certificate can contain as many subjectAltName extensions as
the CA likes to put there. All the Diameter node has to check 
is that <xxx>-diameter@<realm> is present as any one of the alt 
names. In other words, its a CA operational issue whether
the certs used for Diamater E2E are usable for other purposes,
which is, I think, the correct approach.

Stephen.

> > [...]  Therefore, what this spec

-- 
____________________________________________________________
Stephen Farrell         				   
Baltimore Technologies,   tel: (direct line) +353 1 881 6716
39 Parkgate Street,                     fax: +353 1 881 7000
Dublin 8.                mailto:[email-masked]
Ireland                             http://www.baltimore.com

---

From: Jari Arkko <[email-masked]>
Date: Thu, 07 Jun 2001 16:47:13 +0300

> names. In other words, its a CA operational issue whether

Sounds good. I think we can then close this issue, though
some clarifying text would perhaps be useful in the draft.

jari

---

From: Pat Calhoun <[email-masked]>
Date: Thu, 7 Jun 2001 07:10:13 -0700

> some clarifying text would perhaps be useful in the draft.

Then I suggest that we do not close this one until we get some
clarifying text.

PatC

---

From: Stephen Farrell <[email-masked]>
Date: Thu, 07 Jun 2001 16:37:23 +0100

> Then I suggest that we do not close this one until we get some

"The naming scheme presented here is intended to:

- make it simple to use existing certification authorities (CAs) 
  for Diamater CMS
- allow CAs to ensure that only "proper" Diameter certificiates 
  are accepted by Diameter nodes
- allow Diameter certfificates to be used for other purposes
  where that meets a CA's practices."

That do?

Stephen.