Subject: [RE] Re: [AAA-WG]: CMS Security for Mobile-IP Session Keys

From: [email-masked]
Date: Mon, 15 Oct 2001 14:02:29 +0900

I thought i can use CMS Security only between FA and AAAF... for strong
authentication of registration keys.
But, because of below emails. i think i need change my thought.
 
Final Question is : 
	   Regardless of HA's location(home or foreign domain), 
	   is it recommended that the CMS security application be used
	   between 'HA' and AAAH as well as between 'FA' and AAAH?
 
please make things clear!!

원본 내용:

보낸사람: Pat Calhoun[[email-masked]]
받는사람: Bob Kopacz
참조:aaa-wg
제목: Re: [AAA-WG]: CMS Security for Mobile-IP Session Keys
받은날짜: 2001/10/15 월 08:40

> Q1: Suppose the AAAH receives an AMR from some FA, and the AAAH wants to 
> hide the session keys being returned in the AMA, but the FA has not 
> previously set up a DSA with the AAAH.  Does the AAAH then reject the AMR 
> with a Result-Code of DIAMETER_NO_DSA_ESTABLISHED?  Or is it the FA that 
> dictates whether CMS will be used, i.e. if no DSA has been set up by the
FA, 
> then the AAAH can't hide his AMA's session keys?
It's a policy decision on both ends. If the FA's policy was to establish a
DSA 
then it would. If the AAAH will only accept requests with a DSA in place,
then 
it would reply with the error code you mentioned.
> Q2: Suppose a Diameter Mobile-IP AAA Home server receives an AMR in which 
> the AAAF has offered to allocate the HA in the visited network.  Suppose
the 
> AAAH wants to accept the offer, and the AAAH wants to use CMS to hide the 
> session keys he will be sending to the foreign HA via the HAR.  Before 
> sending the HAR, the AAAH will want to first set up a DSA with the HA by 
> sending a DSAR.  But the AAAH doesn't yet know who the HA is.  The best
he 
> can do is to send the DSAR with the Destination-Realm set to the AMR's 
> Origin-Realm, and with no Destination-Host.  In this case, it seems the
DSAR 
> would be consumed by some AAA server in the foreign network, so the AAAH 
> would end up with a DSA with some AAAF, rather than with the HA.
hmmm... interesting scenario. I believe that the AAAH would send the HAR, 
which would be rejected by the HA with the error code you mentioned above, 
and then the DSA could be established.
I'll admit this isn't the most efficient approach, but it is rather
difficult 
to setup a DSA with an unknown host.
PatC