Subject: RE: [AAA-WG]: [issue] Clarify relationship between auth and accountingsessions

From: <[email-masked]>
Date: Fri, 3 May 2002 07:07:31 +0300

Hi Bernard,

> I guess "eternally unique" means that it never repeats, which 
> is the same
> as "temporally unique", so that this is covered. One question 
> though is
> whether the session-ID can obviate the need for a Nonce AVP 
> with respect to replay prevention. 

I think that the security area prefers more randomness, that
way it is not possible to guess the sequence number based upon
seeing previous messages.

John

---

From: Bernard Aboba <[email-masked]>
Date: Thu, 2 May 2002 22:36:13 -0700 (PDT)

> seeing previous messages.

The issue here, I think is replay. Nonces don't actually prevent replay
unless the entities can keep a (potentially large) nonce cache. That's why
IPsec packets contain a sequence number, not a nonce; the sequence number
makes it possible to maintain a replay window.