Subject: [AAA-WG]: CMS Question

From: [email-masked]
Date: Thu, 7 Feb 2002 14:26:14 +0900

there is something strange in CMS document.

in section 4.1  Diameter-Security-Association-Request,   DSAR message can
have zero or more  AAA-Node-Cert AVP .(
   * [ AAA-Node-Cert ])

but, in section 8.0, AAA-Node-Cert                 | 0-1 | 0-1 | 0   | 0
|.

it means  that AAA-Node-Cert can be 0 or 1 in DSAR or DSAA.

it is a contradiction. i wonder how many AAA-Node-Cert AVPs are in DSAR
message .

there is another question. if a host send DSAR message, does  it include
other host's certificates in same realm?(within many AAA-Node-Cert AVPs )

---

From: "Jari Arkko" <[email-masked]>
Date: Fri, 8 Feb 2002 21:05:24 +0200

[AAA-WG]: CMS Question>in section 4.1  Diameter-Security-Association-Request,
>DSAR message can have zero or more  AAA-Node-Cert AVP
>but, in section 8.0, AAA-Node-Cert 0-1.
>it is a contradiction. i wonder how many AAA-Node-Cert AVPs are in DSAR message . 

This seems to be an error in 8.0. Should be 0+ for both DSAR and DSAA.
Also, I have the concern that section 3.1 lists only a subset of all AVPs
that are allowed in 4.1 for DSAR and DSAA. This list should be completed.
Preferably, the list items should also point to the AVP names for easier
reference. There are many cert AVPs, for instance, it is not very easy
to distinguish them from each other.

>there is another question. if a host send DSAR message, does  it
>include other host's certificates in same realm?(within many AAA-Node-Cert AVPs )

I suppose so. Needs clarification in the I-D.

Jari