Subject: RE: [AAA-WG]: Ambiguity in the description of Session-Id

From: <[email-masked]>
Date: Mon, 16 Dec 2002 19:52:27 +0200

DiameterIdentity is fqdn and thus does not seem to allow to include
";" charactor.  So I don't see the ambiguity.  Could you show an
example case?
[Kishore] The problem occurs once domain names are internationalized. If we use ';' as the delimiter then we restrict ourselves using ASCII names for fqdn and Diameter host identities.  Secondly present base protocol specification does not mandate that a ';'(or any other delimiter) MUST follow the DiameterIdentity in Session-Id.

Another issue is that how global uniqueness of Session-ID is
maintained without using global unique identifier.

[Kishore]I do not understand why a globally unique identifier has to be specified by the protocol to generate a globally unique Session-Id. One can use any globally unique identifer (even a DiameterIdentity of the entity generating the Sesion-Id)  within the Session-Id but that need not be specified in the protocol. For example one can place the DiameterIdentity both at the start or at the end of the Session-Id but still can ensure the uniqueness.

Kishore

-----Original Message-----
From: ext Yoshihiro Ohba [mailto:[email-masked]]
Sent: 16. December 2002 18:18
To: Loughney John (NRC/Helsinki)
Cc: [email-masked]; Ghadiyaram Venkata
(EXT-TataConsultancy/Helsinki); [email-masked]
Subject: Re: [AAA-WG]: Ambiguity in the description of Session-Id

DiameterIdentity is fqdn and thus does not seem to allow to include
";" charactor.  So I don't see the ambiguity.  Could you show an
example case?

Another issue is that how global uniqueness of Session-ID is
maintained without using global unique identifier.

Yoshihiro Ohba

On Mon, Dec 16, 2002 at 11:15:49AM +0200, [email-masked] wrote:
> Hi all,
> 
> The issue below seems to be reasonable - will accepting this cause
> any problems for anyone?
> 
> John
> 
> > -----Original Message-----
> > From: ext Bernard Aboba [mailto:[email-masked]]
> > Sent: 15 December, 2002 04:51
> > To: Ghadiyaram Venkata (EXT-TataConsultancy/Helsinki)
> > Cc: [email-masked]
> > Subject: Re: [AAA-WG]: Ambiguity in the description of Session-Id
> > 
> > 
> > Filed as Issue 392.
> > 
> > On Fri, 13 Dec 2002 [email-masked] wrote:
> > 
> > > Descriptiom of the issue: Ambiguity in Session-Id description
> > > Submitter name: Ghadiyaram Venkata Kishore
> > > Submitter email address: [email-masked],
> > > Date first submitted: 13 December, 2002
> > > Reference:
> > > Document: Base
> > > Comment type: T
> > > Priority: S
> > > Section:
> > > Rationale/Explanation of issue:
> > > Section 8.8 describing the Session-Id AVP is ambiguous 
> > about the mandatory part and the optional part of the 
> > Session-Id. From the description it is possible to have a 
> > Session-Id of the form <DiameterIdentity>[unique optional 
> > value>] where there is no delimiter between the 
> > DiameterIdentity and the remaining portion of the Session-Id. 
> > So it is not possible to validate the correctness of the 
> > Session-Id. It may not also be possible to specify a 
> > delimiter as the DiameterIdentity is of type UTF8String.
> > >
> > > Is there a necessity for the mandatory part of the 
> > Session-Id. Why should it be mandatory that the Session-Id 
> > should start with DiameterIdentity. The whole Session-Id 
> > could be implementation dependant and the implementation 
> > should ensure the uniqueness.
> > >
> > > Requested Change :
> > >
> > > In section 8.8 remove the lines
> > >
> > > "  The Session-Id includes a mandatory portion and an 
> > implementation-defined portion;"
> > >
> > > and
> > >
> > > "  The Session-Id MUST begin with the sender's identity 
> > encoded in the DiameterIdentity type (see section 4.4)."
> > >
> > > -----Original Message-----
> > > From: ext Bernard Aboba [mailto:[email-masked]]
> > > Sent: 13. December 2002 19:55
> > > To: Ghadiyaram Venkata (EXT-TataConsultancy/Helsinki)
> > > Subject: Re: [AAA-WG]: Ambiguity in the description of Session-Id
> > >
> > >
> > > Assuming that your question isn't answered, please file an 
> > issue in the
> > > format described in:
> > >
> > > http://www.drizzle.com/~aboba/AAA/issues.html
> > >
> > >
> > 
> > 
>

---

From: Yoshihiro Ohba <[email-masked]>
Date: Mon, 16 Dec 2002 14:43:22 -0500

> [Kishore] The problem occurs once domain names are internationalized. If we use ';' as the delimiter then we restrict ourselves using ASCII names for fqdn and Diameter host identities.  Secondly pr…

If internationalized domain name is the issue, I think we should use a
delimiter that is not allowed to be included in stringprep.  If ";" is
allowed to be included in stringprep, then it might be better to
choose other delimiter.

> [Kishore]I do not understand why a globally unique identifier has to be specified by the protocol to generate a globally unique Session-Id. One can use any globally unique identifer (even a Diamete…

I don't think using any globally unique identifer can guarantee global
uniqueness.  If one uses value X from global identifier space S1 and
the other uses value Y from other global identifier S2, it is possible
that X==Y if intersection of S1 and S2 are not null.  So, a protocol
must define what global space is used in order to guarantee the
uniqueness of identifier.

Yoshihiro Ohba