Subject: RE: [AAA-WG]: Issue about which AVPs to encrypt and which not

From: "Pat R. Calhoun" <[email-masked]>
Date: Sun, 10 Feb 2002 10:21:36 -0800

The WG decided to eliminate the Expected AVPs because of the
possibility for conflicting information between the tables in the
specifications, and what one sends in its Expected list of secured
AVPs.

I see no reason to go back to the more complex scheme.

PatC

- -----Original Message-----
From: Jari Arkko [mailto:[email-masked]] 
Sent: Sunday, February 10, 2002 8:56 AM
To: [email-masked]
Subject: [AAA-WG]: Issue about which AVPs to encrypt and which not

Submitter name: Jari Arkko (Sebastian Zander)
Submitter email address: [email-masked]
Date first submitted: Feb 10, 2002
Reference: http://www.merit.edu/mail.archives/aaa-wg/msg03001.html
Document: cms, base
Comment type: E
Priority: 2
Section: base 4.6, cms 2.0, 3.1, 5.0
Rationale/Explanation of issue:

1) Base does not sufficiently explain what 'MAY encrypt' means in the
AVP tables. Does it mean that it where CMS is used for the particular
message, the AVPs MAY be encrypted, or does it mean that if CMS is
used, they MUST be encrypted?

2) CMS flow example in 5.0 is misleading as to how the
set of protected AVPs is decided.

3) There are several references to somehow negotiating
the AVPs to be signed/encrypted. We have removed such functionality
since this is really static information.

Proposed change:

1) Add to the end of the first paragraph in base 4.6: "If an AVP MAY
be encrypted, section 2.0 of the Diameter CMS security extension [11]
defines in which situations the encryption is actually employed."

Move the last paragraph of 3.1 to the end of 2.0, where I
think it would be easier to find.

In cms 3.1, change the text ", which specifies which AVPs should be
encrypted, signed or both, as well as which public
key(s) to use." to ", which specifies which public key(s)
to use for signing and encryption of AVPs."

Also, in cms 5.0, remove the last sentence of step (f). And
the last sentence of (g).

In step (h) change "which authenticates the AVPs that were requested
by the Home Server in the DSAA." to "which authenticates the AVPs
that MUST be authenticated as defined in section 2.0."

In step (i) change "whose contents include the AVPs that were
specified by the NAS in the DSAR." to "whose contents include the
AVPs that MUST be encrypted as defined in section 2.0."

---

From: "Jari Arkko" <[email-masked]>
Date: Sun, 10 Feb 2002 21:30:37 +0200

RE: [AAA-WG]: Issue about which AVPs to encrypt and which not>The WG decided to eliminate the Expected AVPs because of the 
>I see no reason to go back to the more complex scheme. 

Agreed. I think the confusion arises from some parts of the old
scheme still being visible in the text. My proposed fix tries to
write everything in a manner where the data is fixed and not
sent in the Expected lists.

Jari