Subject: [AAA-WG]: Issue 379: NASREQ-10 NITs

From: Bernard Aboba <[email-masked]>
Date: Sun, 3 Nov 2002 07:53:57 -0800 (PST)

Issue 379: NASREQ-10 NITs
Submitter name: Bernard Aboba
Submitter email address: [email-masked]
Date first submitted: November 3, 2002
Reference:
Document: NASREQ-10
Comment type: T
Priority: S
Section: Several
Rationale/Explanation of issue:

Page 1:

The draft lists 7 authors. This exceeds the guideline of 5 established by
the RFC Editor. Suggest that two authors be dropped.

Page 2:

"This application,
combined with the Diameter base protocol [BASE], satisfies the
requirements defined in the NAS Requirements AAA Criteria
specification [NASCrit] and the Roaming Operations AAA Criteria
specification [ROAMCrit]."

Suggest change to:

"The Diameter NAS application, when
combined with the Diameter base protocol, Transport Profile, EAP
and CMS Security specifications,
satisfies NAS-related requirements defined in [AAACRIT]."

Section 1, Page 6:

"This is achieved by re-using the RADIUS attribute space,
and eliminating the need to perform most attribute translations."

Actually, it appears that translations are required in a considerable
number of cases. Suggest that this sentence be deleted.

Page 6:

"This document describes Diameter applications that are used for AAA
in the Network Access Server (NAS) environment. This application,
combined with the Diameter base protocol [BASE] and related Diameter
Transport [DiamTrans] and Security [DiamEAP,DiamCMS] specifications,
satisfies the requirements defined in the NAS Requirements AAA
Criteria specification [NASCrit] and the Roaming Operations AAA
Criteria specification [ROAMCrit]."

Suggest change to:

"This document describes the Diameter NAS application that is used for AAA
in the Network Access Server (NAS) environment. This application,
combined with the Diameter base protocol [BASE], Transport Profile
[DiamTrans], EAP [DiamEAP], and CMS Security [DiamCMS] specifications,
satisfies NAS-related requirements defined in [AAACRIT]."

Section 1.2

The Auth-Application-Id OR Acct-Application-Id are included in the
CER/CEA, but never both.

Suggest changing:

" Diameter nodes conforming to this specification MAY advertise support
by including the value of one (1) in the Auth-Application-Id and/or
the Acct-Application-Id AVP of the Capabilities-Exchange-Request and
Capabilities-Exchange-Answer commands [BASE]."

To:

"Diameter nodes conforming to this specification MAY advertise support
by including the value of one (1) in the Auth-Application-Id or
the Acct-Application-Id AVP of the Capabilities-Exchange-Request and
Capabilities-Exchange-Answer commands [BASE]."

Section 2:

"If the value of Result-
Code is DIAMETER_MULTI_ROUND_AUTH, an additional authentication
exchange is indicated, and several AAR and AAA messages may be
exchanged until the transaction completes."

Can you give a usage example (e.g. Challenge/Response token
cards)?

Section 2.2:

"the NAS is using RADIUS which does not
support re-authentication or re-authorization."

Actually, RADIUS *does* support re-authentication, just not driven
by the server (except for dynamic authorization). Change to:

"the NAS is using RADIUS which does not support server-initiated
re-authentication or re-authorization. For an exception, see
[RADDYNAUTH]."

Section 3.1 and 3.2

EAP-Payload is included in the AAR/AAA messages. Isn't this
reserved for the EAP application only? If not, can you provide
guidelines as to which application ID (NASREQ or EAP) is used
with EAP?

Section 4.1

AVPs NAS-Port-Id, Called-Station-Id, Calling-Station-ID are listed
as type UTF8String. Is this correct? These AVPs typically only contain
numbers and a few other characters. If so, they should contain
ASCII characters only.

Section 4.1.6

An example of the Connect-Info AVP would be helpful.

Section 4.1.9

" Note: The Termination-Action AVP is typically used for the login
service (Service-Type = 1 or "Login") or by 802.1X supplicants
[802.1X] (e.g., NAS-Port-Type = 19 or "Wireless - IEEE 802.11").

When used for the login service, the service typically terminates
when the login host clears the connection. The NAS may prompt the
user for a new connection and issue a new AA-Request.

When used by 802.1X supplicants, the service typically terminates due
to the expiry of the Session-Timeout AVP. The access device may then
reauthenticate the user with a new AA-Request. The RECOMMENDED way
to do this in Diameter is to use the Authorization-Lifetime AVP
rather than the Termination-Action AVP. However, the Termination-
Action AVP MAY be used when copied from a RADIUS Access-Accept to a
Diameter AA-Answer by a Translation Agent."

If the Termination-Action AVP contains a value other than DEFAULT,
shouldn't a Translation Agent use Authorization-Lifetime AVP instead
of copying the Termination-Action AVP into the Diameter AA-Answer?

Section 4.2

EAP-Payload included here again. Is this for use in NASREQ or EAP
applications (or both)?

Section 4.2.1

" The User-Password AVP MUST be encrypted using the methods described
in [DiamSEC], or where [DiamSEC] isn't applied, the whole DIAMETER
message flow MUST be encrypted using IPsec and/or TLS as described in
[BASE]. Unless this AVP is used for one-time passwords, the User-
Password AVP SHOULD NOT be used in untrusted proxy environments."

DiamSEC isn't an alternative to use of IPsec or TLS. Change to:

" The User-Password AVP contains a user password or one-time
password and therefore represents sensitive information.
As required in [BASE], Diameter messages are encrypted using
IPsec or TLS. Unless this AVP is used for one-time passwords, the User-
Password AVP SHOULD NOT be used in untrusted proxy environments
without encrypting it using end-to-end security techniques, such
as CMS Security [DiamSEC], a work in progress."

Section 4.2.9

I thought that EAP-Payload was supposed to be defined within the
EAP Application. If it is defined in both NASREQ and EAP applications,
which application-id is used when EAP authentication is desired?

Section 4.3.10.3 and 4.3.10.7

Framed-IPv6-Route and Framed-Route AVP should be ASCII not
UTF8String.

Section 4.4.5

" This AVP MUST only be present in authorization responses in an
encrypted form, using one of the methods described in [BASE] and
[DiamSEC]."

Change to:

" The Tunnel-Password AVP contains sensitive information.
As required in [BASE], Diameter messages are encrypted using
IPsec or TLS. The Tunnel-Password AVP SHOULD NOT be used in
untrusted proxy environments
without encrypting it using end-to-end security techniques, such
as CMS Security [DiamSEC], a work in progress."

Section 6.2.5

" >From RFC 2866, the termination causes are as follows:"

Change to:

" From RFC 2866, the termination causes are as follows:"

Section 8.3:

"8.3. Application Identifier

This specification assigns the value one (1) to the Application
Identifier namespace defined in [IANAConsid]. See section 1.2 for
more information."

Is a separate application-Id needed for NASREQ authentication and
accounting?

Section 9:

" This specification also defines a method by which the home Diameter
server can create and distribute registration keys to be used to
authenticate link layer messages (e.g. PPP ECP). The keys SHOULD be
be protected using the methods defined in [DiamSEC]."

Since keying AVPs are no longer in the specification, this paragraph
should be deleted.

Section 10.1

References need to be updated:

[BASE] - Draft 15 is the latest.
[AAATrans] - Draft 8 is the latest.
[DiamMIP] - Draft 13 is the latest.