Subject: RE: [AAA-WG]: [issue] Clarify relationship between auth andaccountingsessions

From: <[email-masked]>
Date: Fri, 3 May 2002 11:36:21 +0300

Hi Bernard,

> > > I guess "eternally unique" means that it never repeats, which 
> > > is the same
> > > as "temporally unique", so that this is covered. One question 
> > > though is
> > > whether the session-ID can obviate the need for a Nonce AVP 
> > > with respect to replay prevention. 
> > 
> > I think that the security area prefers more randomness, that
> > way it is not possible to guess the sequence number based upon
> > seeing previous messages.
> 
> The issue here, I think is replay. Nonces don't actually 
> prevent replay
> unless the entities can keep a (potentially large) nonce 
> cache. That's why
> IPsec packets contain a sequence number, not a nonce; the 
> sequence number
> makes it possible to maintain a replay window.  

OK - I agreed.  A nonce is not needed, but a good sequence number is.
So, does this go into the Diameter Header (I think the only way to
remove part of the CMS dependency).  Am I correctly understanding
the problem?

John