Subject: [AAA-WG]: CMS Security for Mobile-IP Session Keys

From: "Bob Kopacz" <[email-masked]>
Date: Mon, 8 Oct 2001 18:08:19 -0400

Hi,

I have a couple rookie questions about CMS security as applied to Diameter
Mobile-IP messages.

Q1: Suppose the AAAH receives an AMR from some FA, and the AAAH wants to
hide the session keys being returned in the AMA, but the FA has not
previously set up a DSA with the AAAH.  Does the AAAH then reject the AMR
with a Result-Code of DIAMETER_NO_DSA_ESTABLISHED?  Or is it the FA that
dictates whether CMS will be used, i.e. if no DSA has been set up by the FA,
then the AAAH can't hide his AMA's session keys?

Q2: Suppose a Diameter Mobile-IP AAA Home server receives an AMR in which
the AAAF has offered to allocate the HA in the visited network.  Suppose the
AAAH wants to accept the offer, and the AAAH wants to use CMS to hide the
session keys he will be sending to the foreign HA via the HAR.  Before
sending the HAR, the AAAH will want to first set up a DSA with the HA by
sending a DSAR.  But the AAAH doesn't yet know who the HA is.  The best he
can do is to send the DSAR with the Destination-Realm set to the AMR's
Origin-Realm, and with no Destination-Host.  In this case, it seems the DSAR
would be consumed by some AAA server in the foreign network, so the AAAH
would end up with a DSA with some AAAF, rather than with the HA.

Bob K.

---

From: Pat Calhoun <[email-masked]>
Date: Sun, 14 Oct 2001 16:40:37 -0700

> then the AAAH can't hide his AMA's session keys?

It's a policy decision on both ends. If the FA's policy was to establish a DSA
then it would. If the AAAH will only accept requests with a DSA in place, then
it would reply with the error code you mentioned.

> would end up with a DSA with some AAAF, rather than with the HA.

hmmm... interesting scenario. I believe that the AAAH would send the HAR,
which would be rejected by the HA with the error code you mentioned above,
and then the DSA could be established.

I'll admit this isn't the most efficient approach, but it is rather difficult
to setup a DSA with an unknown host.

PatC