Subject: [AAA-WG]: Issue about User-Name AVP and accounting

From: Jari Arkko <[email-masked]>
Date: Sun, 10 Feb 2002 18:02:54 +0200

Submitter name: Jari Arkko (Sebastian Zander)
Submitter email address: [email-masked]
Date first submitted: Feb 10, 2002
Reference: http://www.merit.edu/mail.archives/aaa-wg/msg03001.html
Document: base, nasreq
Comment type: E
Priority: 2
Section: 9.5, 9.7.1, 9.7.2, nasreq 10.2
Rationale/Explanation of issue:

Section 9.5 of base-08 reads:  "In all accounting records the
Session-Id and User-Name AVPs MUST be present.". However, the Diameter node
sending the accounting request may not know it. Still the target can use the various
session-ID AVPs to correlate the records. There also seems to be some inconsistency
in the draft and between base-08 and nasreq-08: In section 9.7.1 & 9.7.2
(ACR, ACA definition) User-Name AVP is marked as optional  while in
section 10.2 it is again specified as MUST.

Proposed change:

I suggest modifying 9.5 so that it reads. "User-Name AVP MUST be present if
it is available to the Diameter client."

Then change the tables in 10.2 as follows:

    User-Name                     | 0+   | 0+   |

---

From: Jari Arkko <[email-masked]>
Date: Sun, 10 Feb 2002 18:56:27 +0200

Document: cms, base
Section: base 4.6, cms 2.0, 3.1, 5.0

1) Base does not sufficiently explain what 'MAY encrypt' means in
the AVP tables. Does it mean that it where CMS is used for the
particular message, the AVPs MAY be encrypted, or does it mean
that if CMS is used, they MUST be encrypted?

2) CMS flow example in 5.0 is misleading as to how the
set of protected AVPs is decided.

3) There are several references to somehow negotiating
the AVPs to be signed/encrypted. We have removed such
functionality since this is really static information.

Proposed change:

1) Add to the end of the first paragraph in base 4.6: "If an
AVP MAY be encrypted, section 2.0 of the Diameter CMS security extension [11]
defines in which situations the encryption is actually employed."

Move the last paragraph of 3.1 to the end of 2.0, where I
think it would be easier to find.

In cms 3.1, change the text ", which specifies which AVPs
should be encrypted, signed or both, as well as which public
key(s) to use." to ", which specifies which public key(s)
to use for signing and encryption of AVPs."

Also, in cms 5.0, remove the last sentence of step (f). And
the last sentence of (g).

In step (h) change "which authenticates the AVPs that were
requested by the Home Server in the DSAA." to "which authenticates
the AVPs that MUST be authenticated as defined in section 2.0."

In step (i) change "whose contents include the AVPs that were
specified by the NAS in the DSAR." to "whose contents include the
AVPs that MUST be encrypted as defined in section 2.0."

---

From: David Spence <[email-masked]>
Date: Wed, 27 Feb 2002 19:32:36 -0500

This issue is mis-stated.  The section 10.2 that is in error is sec. 10.2 of
the base -- not nasreq.