Subject: AW: [AAA-WG]: questions/comments on draft-ietf-aaa-diameter-sip-a pp-02

From: "Beck01, Wolfgang" <[email-masked]>
Date: Mon, 3 May 2004 15:19:51 +0200

Miguel,

> However, if there is not qop parameter used, then the Diameter server 
> can pre-calculate an expected response, since it is not dependent on any 
> client information, and send it to the SIP server. The SIP server 
> challenges the SIP client, receives the credentials (request-digest), 
> compares the response with the expected response, and authorizes the SIP 
> request.
From RfC 2617, section 3.2.1 about optionality of the qop directive:
"This directive is optional, but is made so only for backward
 compatibility with RFC 2069 [6]; it SHOULD be used by all
 implementations compliant with this version of the Digest scheme."
Is support for an obsolete RfC worth the effort? When I read section
5.3 of your draft, I expected the SIP server to have a local
user/passwd/profile database and was a bit confused about steps 5 and 6.
But without centralized user/passwd/profile storage, the DIAMETER server
becomes in fact a SIP redirecting proxy. Can't we just drop 5.3 completely?

Wolfgang

---

From: Miguel Garcia <[email-masked]>
Date: Tue, 04 May 2004 09:28:40 +0300

Wolfgang:

I am afraid we cannot remove the support for the scenario described in 
section 5.3. Among other things, the lack of qop is widely used today, 
no matter what RFC 2617 indicates that it should be used. For instance, 
3GPP is using HTTP Digest AKA that does not require qop. So it is not 
the support of an old RFC, but the support of current networks deployments.

- Miguel

-- 
Miguel A. Garcia           tel:+358-50-4804586
Nokia Research Center      Helsinki, Finland