Subject: [AAA-WG]: [issue] Confusion between security services and techniques to achieve them

From: Miguel Ángel Monjas Llorente <[email-masked]>
Date: Wed, 29 Aug 2001 11:52:01 +0200

Submitter name: Miguel A. Monjas
Submitter email address: [email-masked] 
Date first submitted: 2001-08-29
Reference: 
Document: CMS-02
Comment type: E
Priority: S
Section: abstract, 1.1, 3.1, 3.4, 5.0, 6.1, 6.2
Rationale/Explanation of issue: 

The purpose of Diameter CMS Security Application is to achieve some
security services:

[1] (data origin) authentication
[2] confidentiality
[3] integrity
[4] non-repudiation (with proof of origin)

To achieve them, some techniques are used:

- digital signatures + digital certificates provide [1], [3] and [4]
(though to achieve only [3] maybe MAC would be enough)
- encryption (using asymmetric techniques to encrypt a content
encryption key and this CEK for bulk encryption) provides just [2]
- encryption + digital signatures + digital certificates provide [1],
[2], [3] and [4]

However, not all the security services are listed neither the specific
techniques are linked with the services.

Requested change: 

Replace the second paragraph of the abstract with the following text:

   This Diameter application describes how a security association is
   established by two peers through agents, and how authentication
   integrity, confidentiality and non-repudiation (with proof of 
   origin) are achieved using a mixture of symmetric and asymmetric
   transforms, by encapsulating Cryptographic Message Syntax (CMS)
   data within AVPs. CMS is also used to carry X.509 certificates.

   Two main techniques are so that used. Digital signatures (along
   with digital certificates) provide authentication, integrity and
   non-repudiation. Encryption provides confidentiality (using
   asymmetric techniques to encrypt a content encryption key and
   this key for bulk encryption). Both techniques can be used
   together to provide all the specified security services.

Replace the paragraph below the figure 2 (1.1) wiht the following:

   This document defines the Diameter commands that are used to
   establish a DSA through Diameter agents, and specifies how
   encapsulating CMS objects [3] in Diameter AVPs can provide
   authentication, integrity, confidentiality and non-repudiation.
   The CMS object MAY also be used to transport X.509
   certificates and revocation lists.

Replace the third paragraph in 3.1 with the following:

   We use Diameter Security Association Request (DSAR) and Diameter
   Security Association Answer (DSAA) messages to establish a DSA,
which
   specifies which AVPs should be encrypted, signed, or both things,
   as well as which public key(s) to use.

Replace the second last paragraph in 3.1 with the following:

   Depending on the security technique required (digital
   signature, encryption or both), then the originating node
   prepares the CMS related AVPs as required.

Replace the second paragraph in 3.4 with the following:

   Note that though the use of symmetric encryption might be used
   to provide integrity or confidentiality but does not provide
   non-repudiation with proof of origin.

Replace the second paragraph in 5.0 with the following:

   Although the example doesn't specifically use bi-directional
   digital signature and encryption, this feature is supported.

Replace the first sentence of second last paragraph in 6.1 with the
following:

   The eContent field of the EncapsulatedContentInfo structure MUST be
   absent since the digital signature covers data outside of the
object.

Replace the fourth paragraph in 6.2 with the following:

   When AVPs are to be both encrypted and signed, the CMS-
   Encrypted-Data AVP MUST be created first.

Regards

  // M.A.