Subject: RE: [AAA-WG]: Issue 279: Base does not sufficiently explain what 'MAY encrypt means - CLOSED for BASE

From: "Fredrik Johansson" <[email-masked]>
Date: Fri, 1 Mar 2002 10:28:50 +0100

According to the discussion on where to send accounting records
http://www.merit.edu/mail.archives/aaa-wg/2002-02/msg00182.html

It was proposed that intermediate servers could collect accounting data on
the way to the home accounting server for inter-operator settlements. But if
accounting record AVPs are encrypted, the intermediate servers will not have
any chance to interpret the content.

I still believe that accounting records generated in the access network
should be able to send to a accounting server in the access network and not
to the home network. It should be configurable.

/Fredrik

P.S. kind of strange that AVPs marked with MAY encrypt in the table MUST be
encrypted :-) Change the column name to MUST encr.

>-----Original Message-----
>From: [email-masked] [mailto:[email-masked]]On Behalf Of
>[email-masked]
>Sent: den 27 februari 2002 20:45
>To: [email-masked]
>Cc: [email-masked]; [email-masked]
>Subject: RE: [AAA-WG]: Issue 279: Base does not sufficiently explain
>what 'MAY encrypt means - CLOSED for BASE
>
>
>Hi Stephen,
>
>
>> After some off-list discussion it appears that the following
>> is the correct interpretation of the "MAY encr" column:
>>
>> "For the originator of a Diameter message, "MAY encr" means
>> that if a message containing that AVP is to be sent via a
>> proxy/agent then the message MUST NOT be sent unless there
>> is a DSA between the originator and the recipient OR the
>> originator has locally trusted configuration that indicates
>> that CMS need not be used."
>>
>> I'll put this into CMS, but would also recommend it go
>> somewhere in the base.
>
>I'll make this change
>
>ORIGINAL TEXT
>
> 4.6  Diameter Base Protocol AVPs
>
>	The following table describes the Diameter AVPs defined
>	in the base protocol, their AVP Code values, types, possible
>	flag values and whether the AVP MAY be encrypted.  If an AVP
>	MAY be encrypted, section 2.0 of the Diameter CMS security
>	extension [CMS] defines in which situations the encryption is
>	actually employed.
>
>NEW TEXT:
>
> 4.6  Diameter Base Protocol AVPs
>
>	The following table describes the Diameter AVPs defined
>	in the base protocol, their AVP Code values, types, possible
>	flag values and whether the AVP MAY be encrypted.  For the
>	originator of a Diameter message, "MAY Encr" means that if
>	a message containing that AVP is to be sent via a
>	proxy/agent then the message MUST NOT be sent unless there
>	is a DSA between the originator and the recipient OR the
>	originator has locally trusted configuration that indicates
>	that CMS need not be used.
>
>John