Subject: [AAA-WG]: Issue 221: Why require CMS to send it's expected AVPs?

From: Pat Calhoun <[email-masked]>
Date: Thu, 25 Oct 2001 17:34:37 -0700

Submitter name: Pat Calhoun
Submitter email address: [email-masked] 
Date first submitted: 25-Oct-01 
Reference:  
Document: cms
Comment type: Technical 
Priority: 1
Section: 
Rationale/Explanation of issue: 

Each Diameter application states which AVPs should be encrypted and which
can be signed. Since this is possible, why bother requiring that the DSAR
sender to include what AVPs it expects to have signed/encrypted? Isn't
the AVP definition sufficient?

---

From: Stephen Farrell <[email-masked]>
Date: Fri, 26 Oct 2001 16:27:28 +0100

Pat,

Don't we support vendor-specific AVPs or any AVPs where encryption
is optional? Similarly, won't requiring/not-requiring a signature
over a given AVP be a matter of local policy?

Any of the above makes the expected-* worthwhile IMHO. If none
of the above apply, you're right, we could do without 'em.

Stephen.

-- 
____________________________________________________________
Stephen Farrell         				   
Baltimore Technologies,   tel: (direct line) +353 1 881 6716
39 Parkgate Street,                     fax: +353 1 881 7000
Dublin 8.                mailto:[email-masked]
Ireland                             http://www.baltimore.com

---

From: Don Zick <[email-masked]>
Date: Fri, 26 Oct 2001 13:04:46 -0400

Hi Stephen,

I see Pat hasn't responded yet so I thought I'd wiegh in with my 2 cents.

>is optional?

Vendor-specific AVPs should have AVP definitions just like standard AVPs.

I don't know of any cases where encryption of an AVP should be optional when
a DSA is in place.  I am very interested in any examples where encryption
of an AVP should be optional.

Even if encryption is optional, why not leave it up to the sender's local
policy.  After all, the sender is the source of the sensitive data.  The
receiver will be able to decipher the AVP whether it is encrypted or not.

>Similarly, won't requiring/not-requiring a signature over a given AVP be
>a matter of local policy?

It seems like a reasonable simplification to just always sign when a DSA is in
place.  A Diameter node can ignore signatures if it chooses.

Thanks,
Don

---

From: Stephen Farrell <[email-masked]>
Date: Fri, 26 Oct 2001 18:22:47 +0100

Hi Don,

> Vendor-specific AVPs should have AVP definitions just like standard AVPs.

Yes, but say that an intermediary (some "boundary" server) is the DSA
endpoint, where the intermidiary itself doesn't know about the AVP? I
suppose this argument would also apply to anything that's not part of
the base spec. (or am I wrong that such "ignorant intermediaries" are 
allowed?).

> of an AVP should be optional.

Fair enough. If there're none, there're none.

> receiver will be able to decipher the AVP whether it is encrypted or not.

I could imagine that the sender & recipient's policies will differ as to
what's sensitive - the expected-* stuff allows us to help there.
 
> place.  A Diameter node can ignore signatures if it chooses.

True, but maybe a bit computationally intensive.

Stephen.