Subject: [AAA-WG]: Issue 139: Key Management chapter rephrasing

From: Pat Calhoun <[email-masked]>
Date: Mon, 27 Aug 2001 10:29:36 -0700

All,

Below is my proposed text for the new section 3.0:

3.0 Key Management

   For DSA origin authentication, CMS itself already provides sufficient
   key management without the need for additional specification. Basically,
   the originating Diameter node signs and includes whatever certificates
   are necessary for validation of the digital signature. Section 3.1 
   provides an example of how the Diameter CMS Security application is used.
   
   In order to encrypt AVPs for a recipient, the originating Diameter
   node must have a copy of the recipient's public key. There are many
   well-known key retrieval schemes (e.g. LDAP [6]), but this 
   specification also allows for the transportation of certificates
   within Diameter AVPs, which is expected to simplify implementations.
   Section 3.2 describes how Diameter node names are encoded within such
   certificates.
   
   Finally, it is anticipated that the overhead of key generation for
   each Diameter message sent to a given peer could be significant. 
   Section 3.4 specifies how CMS encryption keys may be reused for
   multiple Diameter messages."

Comments appreciated,

PatC

---

From: Miguel Ángel Monjas Llorente <[email-masked]>
Date: Tue, 28 Aug 2001 10:37:52 +0200

>    multiple Diameter messages."

Section 3.0 is much more clear now. A last comment... Does it make any
sense to keep 3.3 section (algorithms) within 3.0 (focused on key
management). Wouldn't be better to put it outside (maybe like a
top-level chapter)?

Regards

  // M.A.

---

From: Pat Calhoun <[email-masked]>
Date: Tue, 28 Aug 2001 06:39:12 -0700

> management). Wouldn't be better to put it outside (maybe like a

If you think it makes sense, I can make this change.

PatC