Subject: [AAA-WG]: Issue 279: Base does not sufficiently explain what 'MAY encrypt means - CLOSED for BASE

From: <[email-masked]>
Date: Wed, 27 Feb 2002 09:56:16 +0200

Jari,

I can add the text to secion 4.6, though the change:

  Move the last paragraph of 3.1 to the end of 2.0, where I
  think it would be easier to find.

seem to be unclear / unnescessary.

John

Issue #279
Submitter name: Jari Arkko (Sebastian Zander)
Submitter email address: [email-masked]
Date first submitted: Feb 10, 2002
Reference: http://www.merit.edu/mail.archives/aaa-wg/msg03001.html
Document: cms, base
Comment type: E
Priority: 2
Section: base 4.6, cms 2.0, 3.1, 5.0
Rationale/Explanation of issue:

1) Base does not sufficiently explain what 'MAY encrypt' means in
the AVP tables. Does it mean that it where CMS is used for the
particular message, the AVPs MAY be encrypted, or does it mean
that if CMS is used, they MUST be encrypted?

2) CMS flow example in 5.0 is misleading as to how the
set of protected AVPs is decided.

3) There are several references to somehow negotiating
the AVPs to be signed/encrypted. We have removed such
functionality since this is really static information.

Proposed change:

1) Add to the end of the first paragraph in base 4.6: "If an
AVP MAY be encrypted, section 2.0 of the Diameter CMS security extension [11]
defines in which situations the encryption is actually employed."

Move the last paragraph of 3.1 to the end of 2.0, where I
think it would be easier to find.

In cms 3.1, change the text ", which specifies which AVPs
should be encrypted, signed or both, as well as which public
key(s) to use." to ", which specifies which public key(s)
to use for signing and encryption of AVPs."

Also, in cms 5.0, remove the last sentence of step (f). And
the last sentence of (g).

In step (h) change "which authenticates the AVPs that were
requested by the Home Server in the DSAA." to "which authenticates
the AVPs that MUST be authenticated as defined in section 2.0."

In step (i) change "whose contents include the AVPs that were
specified by the NAS in the DSAR." to "whose contents include the
AVPs that MUST be encrypted as defined in section 2.0."

---

From: Jari Arkko <[email-masked]>
Date: Wed, 27 Feb 2002 12:31:48 +0200

> seem to be unclear / unnescessary.

Sure, I don't care really that much where it is. As long
as it is explicitly referenced from the base 4.6. Preferrably
also very visible on the CMS document, but what is very visible
is of course debatable...

Jari