Subject: RE: [AAA-WG]: Issue 349: Accounting Response Bloat

From: <[email-masked]>
Date: Thu, 30 May 2002 10:43:42 +0300

Hi all,
 
> The question is, if we will avoid it only most of the time, or all of the time.
> John's suggested text deals with the case that the NAS [or the NSA -- are you
> sure John you don't work for them? ;-) ] indicates its need through either using
> or not using the CMS AVPs. This is the current approach, but it seems a bit
> at odds with the regular CMS 'P' and 'MAY ENCR' approach with fixed policies.
> There are AVPs that have a 'P' and 'MAY ENCR' in every ACR/ACA command, so
> it would seem that the CMS AVPs are needed in any case. Local configurations
> may indicate that CMS should be turned off for some communications, though.
> 
> So indicating the need for the CMS AVPs in the response is one problem.
> Here we have the following alternatives: 1) current text, clarify that
> this rule takes precedence over the regular P/ENCR rules or 
> 2) simply use the P/ENCR rules.
> 
> Then there is another problem. What should go into the response, and
> how should the signature be made? Here we have the following 
> alternatives:
> 1) If CMS is needed at all, copy all AVPs to the response. 2) Decide that
> we don't need this function i.e. no usage AVP copying at all and no
> signatures either. 3) Invent some special rules in CMS so that CMS-Signed-Data
> AVP can sign even AVPs that are omitted from the response. 4) A "hash" AVP
> is added by the NAS when it uses CMS, containing a hash of the AVPs
> protected by CMS. The server is then required to copy this AVP back,
> and per P/ENCR rules sign it.
> 
> Personally, 2+4 would be the cleanest technical solution. I can live
> with 1+1 (John's text) to avoid too many changes.

I prefer the 1+1 approach.  What would you see as the clarifying text needed.

Is this sufficient?

	The Accounting-Answer command contains the same Session-Id and 
	includes the the usage AVPs only if the NSA specifically 
	requests that they be included, such as by including the CMS-
	DATA AVP.  This this rule takes precedence over the regular 
	P/ENCR rules.

John

---

From: Jari Arkko <[email-masked]>
Date: Thu, 30 May 2002 10:55:22 +0300

> 	DATA AVP.  This this rule takes precedence over the regular 

=>

The Accounting-Answer command contains the same Session-Id and
includes the usage AVPs only if CMS is in use when sending this
command. Note that the inclusion of the usage AVPs when CMS is
not being used leads to unnecessarily large answer messages,

and can not be used as a server's proof of the receipt of these

AVPs in an end-to-end fashion.

(Then, later, when we want to fix the bloat problem also with
CMS, we can add a new AVP that the NAS can include in the request
for the hash, and the server can send it back signed. So I don't
think we will lose this functionality for ever if we go for 1+1.)

Jari