Subject: Re: [AAA-WG]: Re: [AAA-WG]: CMS Question

From: [email-masked]
Date: Sat, 2 Mar 2002 11:54:26 +0900

Hi,
> [email-masked] wrote: 
> 
> I think DSA/DSAA message contain several AAA-Node-Cert AVP . AAA-Node-
Cert AVP  contains 
> certificates of 
> 
> AAA hosts in same realm. 
> 
> if the size of one certificate is 700k and there is 5 hosts in same
realm, does DSAR/DSAA( contain
700k!!! X.509 has been accused of bloat, but never that much bloat! 
Certificates are usually <2k.

sorry. that is my mistake. i misunderstood "byte" and "k". i mean 700 byte
and 3500 byte..

> 
> 3500k certificate - 5 AAA-Node-Cert AVPs ) message have to transport? 
> 
> also, if one realm and antoher realm(one host and one host) has a DSA,
don't other hosts at these 
> 
> realm need to establish DSA? Without DSA establish step, the
communocation is possible?
That depends on how many of the hosts have access to the private key 
concerned. One option is that all the hosts use the same key pair 
(put all their names in the relevant certificate).
Stephen.
 
if even all hosts in same real use same certificates, i think it is
impossible communacation without DSA establish.

so it has no something to do with using same certificate or not.  DSA is
1:1 connectios, isn' it?

i think only one AAA-Node-Cert AVP must appear in DSAR/DSAA.(without common
3-des key by  DSA establish step,

how they can communcate?)

regards