Subject: [AAA-WG]: question about section 4.6 in base draft

From: [email-masked]
Date: Tue, 06 Aug 2002 10:41:02 +0200

Hello,

I'm new to this list so my apologies if this question was already asked.

When reading the diameter base spec (version 12) I was wondering what
the difference is between the 'MAY encr' and the  P flag column in
the table in section 4.6. When reading the text the explanation for the
both columns is identical.

For instance for the 'Auth-Request type' the P may be set but the 'MAY
encr' indicates it may not be encrypted. Does this mean I can set the P
bit but not encrypt the message?

Small typo in the command code ABNF spec?

should (double quote  missing?):

header = "<" diameter-Header:" command-id [r-bit] [p-bit] [e-bit]
">"

read:

header = "<" "diameter-Header:" command-id [r-bit] [p-bit]
[e-bit] ">"

also in the example

Example-Request ::= < "Diameter-Header: 9999999, REQ, PXY >

should read?

Example-Request ::= < Diameter-Header: 9999999, REQ, PXY >

Regards,

Suresh

---

From: Jari Arkko <[email-masked]>
Date: Tue, 06 Aug 2002 14:24:41 +0300

[email-masked] wrote:

> the difference is between the 'MAY encr' and the  P flag column in the 
> table in section 4.6. When reading the text the explanation for the both 
> columns is identical.
> 

This must be some problem that remains from the time we made CMS
independent of the base.

The following should fix it:

"there is end-to-end security between the originator and the recipient"

  =>

"there is end-to-end security between the originator and the recipient
and integrity / confidentiality protection is offered for this AVP"

Jari

---

From: [email-masked]
Date: Wed, 07 Aug 2002 16:11:25 +0200

Jari,

Thank you for the answer.
Here are however some questions I'm struggling with:
1) Are Integrity & confidentiality not part of the basic end-to-end security?
2) What do I have to do with an AVP where the 'may encr' states no and the P
bit is set? integrity/confidentiality but not end-to-end security?
3) end-to-end is this true e2e or up to the proxy?  Can I use proxy agents
when end-to-end security is used (according to section 2.8.2 not) ?

two other small things:
In section 5.4 the Disconnect-Reason AVP should be changed to Disconnect-Cause
AVP.
I didn't find the E2E-Sequence AVP (section 6.15) back in the table in section
4.6 (is this part of the base spec or a specific application?).
Is there an identifier in the Inband-security-Id for IPsec?

Regards,
    Suresh