Subject: RE: [AAA-WG]: Issue 279: Base does not sufficiently explain what 'MAY encrypt means - CLOSED for BASE

From: <[email-masked]>
Date: Wed, 27 Feb 2002 13:47:10 +0200

Hi Jari,

> > I can add the text to secion 4.6, though the change:
> > 
> >   Move the last paragraph of 3.1 to the end of 2.0, where I
> >   think it would be easier to find.
> > 
> > seem to be unclear / unnescessary.
> 
> 
> Sure, I don't care really that much where it is. As long
> as it is explicitly referenced from the base 4.6. Preferrably
> also very visible on the CMS document, but what is very visible
> is of course debatable...

very good, that closes that issue, then.

John

---

From: Stephen Farrell <[email-masked]>
Date: Wed, 27 Feb 2002 16:55:12 +0000

After some off-list discussion it appears that the following
is the correct interpretation of the "MAY encr" column:

"For the originator of a Diameter message, "MAY encr" means 
that if a message containing that AVP is to be sent via a 
proxy/agent then the message MUST NOT be sent unless there 
is a DSA between the originator and the recipient OR the 
originator has locally trusted configuration that indicates 
that CMS need not be used."

I'll put this into CMS, but would also recommend it go 
somewhere in the base.

On a related issue, the CMS draft is currently overly 
restrictive in instructing proxies to prevent DSA 
establishment. The suggestion is to change this to the 
following:

"Proxys that modify AVPs MAY prevent the establishment of
DSAs based on local configuration."

With these two changes, I think this (and the pre-historic 
issue 221) can both be closed.

Stephen.

-- 
____________________________________________________________
Stephen Farrell         				   
Baltimore Technologies,   tel: (direct line) +353 1 881 6716
39 Parkgate Street,                     fax: +353 1 881 7000
Dublin 8.                mailto:[email-masked]
Ireland                             http://www.baltimore.com