Subject: [AAA-WG]: [issue] Multiple signatures on a set of AVPs

From: Miguel Ángel Monjas Llorente <[email-masked]>
Date: Wed, 22 Aug 2001 18:56:20 +0200

Submitter name: Miguel A. Monjas
Submitter email address: [email-masked] 
Date first submitted: 2001-08-22
Reference: 
Document: CMS-02
Comment type: T
Priority: 1
Section: 6.1
Rationale/Explanation of issue: 

In 6.1 it's stated that:

   Multiple Diameter entities MAY add their signatures to an existing
   CMS-Signed-Data AVP using the countersignature attribute, defined
in
   section 11.4 of [3]. The countersignature attribute requires that
the
   signatures occur sequentially, meaning that each signature covers
the
   existing signatures in the CMS object.

May I assume that this is the only way to add multiple signatures? If
so, there will be only one singerInfo in a SignedData value (including
a message-digest attribute) and that multiple signatures will be
handled only like countersignature attributes (which allows not to
resign the whole set of AVPs)

Requested change: 

If so, I'd change the previous paragraph to say:

   Multiple Diameter entities MAY add their signatures to an existing
   CMS-Signed-Data AVP. It MUST be done using the countersignature 
   Attribute (defined in section 11.4 of [3]) and not as additional
   SignerInfo values. The countersignature attribute requires that the
   signatures occur sequentially, meaning that each signature covers
the
   existing signatures in the CMS object. This attribute MUST be
always 
   unsigned.

Regards

  // M.A.

-- 
  Miguel Angel Monjas Llorente
  Systems Engineer, GSM/UMTS Systems Management
  Ericsson España, S.A. (EEM) UMTS/GSM Databases
  Tel: +34 91 3393605                 Mob: +34 629 570196
  <mailto:[email-masked]>  Fax: +34 91 3392538
  Retama 1, 4th. 28045 Madrid - SPAIN -