Subject: [AAA-WG]: Re: Comments on draft-ietf-aaa-diameter-sip-app-05.txt

From: Miguel Garcia <[email-masked]>
Date: Sun, 16 Jan 2005 10:15:04 +0200

Hi:

I am not sure if this message has been distributed by the AAA mailing 
list. In any case, read below Cullen's concerns and my answers inline.

Cullen Jennings wrote:
> I just reviewed the stuff on how MAR/MAA fit in with SIP digest auth - the
> draft is very nice and complete, and about as exciting as reading MIBs :-)
> 
> One trivial comment section 10 second para - the expression "retain
> authentication of the user" left me puzzled for a bit by what it meant.

Ok, I see it may be missleading. The idea to express is "if the Diameter 
  server wants to assue that authentication will take place in the own 
Diameter server (as opposed to a delegated authentication taking place 
in the SIP server) ...."

> 
> It might be worth a comment that on system where the SIP that are using
> Digest inside of TLS where only the proxy has a certificate, that using the
> HA1 mode greatly reduces the load on diameter servers. On the other hand
> this might be obvious to anyone who cares so perhaps it is not worth
> mentioning. I don't really care much but that's my 0.5 cents.

It is fine, we can add some motivation text indicating so.

BR,

       Miguel

-- 
Miguel A. Garcia           tel:+358-50-4804586
Nokia Research Center      Helsinki, Finland

---

From: <[email-masked]>
Date: Tue, 18 Jan 2005 15:09:36 +0200

Hi Miguel,

> > Great; after that, I think we might be done.
> 
> Well, almost. We have an open discussion with the RADIUS authentication 
> document. This may end up in RADIUS defining the SIP-AOR atrribute, in 
> which case the Diameter SIP app will need to "include" it rather than 
> defining. Then we are done.

My feeling was this was more or less agreed upon already.

John

---

From: Miguel Garcia <[email-masked]>
Date: Wed, 19 Jan 2005 09:58:21 +0200

Cullen:

The Diameter server never reveals the users' password to the SIP server. 
It reveals H(A1) (Digest), which is used to calculate the expected 
response, but not the password.

In any case, I will try to add more clarifications to this part of the 
draft.

- Miguel

Cullen Jennings wrote:

> 
> Sure that wording sounds better. Not a big deal to me one way or another 
> but it was a part that I thought would leave people somewhat confused. 
> Might want to consider phrasing it more as if the Diameter server does 
> not want to reveal the users password to the SIP server then blah blah 
> blah. Really this is a polishing detail, I think that everyone who needs 
> to really implement and understand this stuff will get what this is all 
> about no matter what we put here. I don't think the words here are 
> critical to people making products that successfully interoperate so I 
> really don't want to hold things up with too much wordsmiting on this.
> 
> Cullen
> 
> 
> On 1/17/05 3:47 AM, "[email-masked]" <[email-masked]> 
> wrote:
> 
>     Hi Miguel & Cullen,
> 
>>  list.
>     I don't think it was.
>>  In any case, read below Cullen's concerns and my answers inline.
>>
>>  Cullen Jennings wrote:
>     I think you mean assume in the second sentence; Cullen, is this text
>     better?
>