Subject: [AAA-WG]: Issue 145: Order in CMS-Proxy messages

From: Pat Calhoun <[email-masked]>
Date: Mon, 27 Aug 2001 11:15:29 -0700

This issue is a request to change the language that pertains to 
encryption of AVPs, and the fact that the current text states that the
AVPs may be ordered in any manner prior to the encryption process.

If the encryptor is the client, or the home server, we don't have much of
an issue, which is where this text was directed to. However, if a proxy is
performing the encryption on behalf of a client, it will have to reorder 
the AVPs for them to fit within the CMS-Encrypted-Data AVP (because
the AVPs are pulled from the message, and included in the AVP).

Of course, we could require that each individual AVP be encrypted
separately, and the resulting CMS-Encrypted-Data AVP be inserted in the
same location the original AVP was in.

Personally, I think this is just too much overhead.

So, I would opt to leave the language as is. Proxies are evil anyways,
and they will reorder if they feel like it. This is one case where reorder
is actually necessary.

PatC

---

From: Miguel Ángel Monjas Llorente <[email-masked]>
Date: Tue, 28 Aug 2001 16:18:14 +0200

> the AVPs are pulled from the message, and included in the AVP).

That's right.

> Personally, I think this is just too much overhead.

Me too.

> and they will reorder if they feel like it. This is one case where reorder

Yes, that's right. I felt that it was necessary to point that when in
the base protocol it's said that "proxies SHOULD NOT reorder AVPs" a
sentence like "(however, when acting as CMS proxy, AVPs reorder is
made implicitly)". But possibly it isn't necessary.

Regards

  // M.A.

---

From: Pat Calhoun <[email-masked]>
Date: Tue, 28 Aug 2001 09:03:31 -0700

> made implicitly)". But possibly it isn't necessary.

ok, so I've added the following paragraph prior to the last paragraph
in section 1.2:

"  It is important to note that proxy agents establishing DSA's on
   behalf of a client will most likely need to reorder AVPs during the
   encryption process, in order to fit the encrypted AVPs within a
   CMS-Encrypted-Data AVP. This is contrary to the rule established in
   the Diameter base protocol [1], which states that proxy agents SHOULD
   NOT reorder AVPs."

Does this work for you?

PatC

---

From: Miguel Ángel Monjas Llorente <[email-masked]>
Date: Tue, 28 Aug 2001 18:22:11 +0200

>    the Diameter base protocol [1], which states that proxy agents SHOULD

Works fine. Thanks.

  // M.A.