Subject: [AAA-WG]: [전체회신] Re: [AAA-WG]: CMS Question

From: [email-masked]
Date: Tue, 26 Feb 2002 20:26:33 +0900

I think DSA/DSAA message contain several AAA-Node-Cert AVP . AAA-Node-Cert
AVP  contains certificates of

AAA hosts in same realm. 

if the size of one certificate is 700k and there is 5 hosts in same realm,
does DSAR/DSAA( contain 

3500k certificate - 5 AAA-Node-Cert AVPs ) message have to transport?

also, if one realm and antoher realm(one host and one host) has a DSA,
don't other hosts at these 

realm need to establish DSA? Without DSA establish step, the communocation
is possible?

is there anyone answer me?

thanks advance.

i am  wait your answer.

regards

원본 내용:

보낸사람: Jari Arkko[[email-masked]]
받는사람: [email-masked]; [email-masked]
제목: Re: [AAA-WG]: CMS Question
받은날짜: 2002/02/09 토 04:05

[AAA-WG]: CMS Question>in section 4.1  Diameter-Security-Association-
Request, 
>DSAR message can have zero or more  AAA-Node-Cert AVP 
>but, in section 8.0, AAA-Node-Cert 0-1. 
>it is a contradiction. i wonder how many AAA-Node-Cert AVPs are in DSAR
message . 
This seems to be an error in 8.0. Should be 0+ for both DSAR and DSAA. 
Also, I have the concern that section 3.1 lists only a subset of all AVPs 
that are allowed in 4.1 for DSAR and DSAA. This list should be completed. 
Preferably, the list items should also point to the AVP names for easier 
reference. There are many cert AVPs, for instance, it is not very easy 
to distinguish them from each other.
>there is another question. if a host send DSAR message, does  it 
>include other host's certificates in same realm?(within many AAA-Node-Cert
AVPs )
I suppose so. Needs clarification in the I-D.
Jari

---

From: Jari Arkko <[email-masked]>
Date: Tue, 26 Feb 2002 15:13:05 +0200

[email-masked] wrote:

> also, if one realm and antoher realm(one host and one host) has a DSA,  don't other hosts at these
> 
> realm need to establish DSA? Without DSA establish step, the communocation is possible?

Hmm... this seems to be correct, you can't communicate with the other
hosts if you don't have a DSA. Perhaps this implies that the
AAA-Node-Cert should really appear at most once, like section 8
states but in contradiction with section 4.1.

Jari

---

From: Stephen Farrell <[email-masked]>
Date: Wed, 27 Feb 2002 17:30:20 +0000

Hi,

> [email-masked] wrote:
> 
> I think DSA/DSAA message contain several AAA-Node-Cert AVP . AAA-Node-Cert AVP  contains
> certificates of
> 
> AAA hosts in same realm.
> 
> if the size of one certificate is 700k and there is 5 hosts in same realm, does DSAR/DSAA( contain

700k!!! X.509 has been accused of bloat, but never that much bloat! 
Certificates are usually <2k.

> realm need to establish DSA? Without DSA establish step, the communocation is possible?

That depends on how many of the hosts have access to the private key
concerned. One option is that all the hosts use the same key pair
(put all their names in the relevant certificate).

Stephen.

-- 
____________________________________________________________
Stephen Farrell         				   
Baltimore Technologies,   tel: (direct line) +353 1 881 6716
39 Parkgate Street,                     fax: +353 1 881 7000
Dublin 8.                mailto:[email-masked]
Ireland                             http://www.baltimore.com