Subject: [AAA-WG]: Questions about AVPs occurrence

From: Miguel Ángel Monjas Llorente <[email-masked]>
Date: Mon, 20 Aug 2001 17:01:46 +0200

Hi all,

just a couple of questions about AVPs occurrence:

- Is it possible to change the Expected-*-AVP value in a DSA? I mean,
is it possible to issue a new Expected-Signed-AVP if the DSA hasn't
expired?

- Is it necessary to establish a DSA to include a CMS-Cert AVP in a
Diameter message? Or is it possible to "push" a certificate at
anytime?

Regards

-- 
  Miguel Angel Monjas Llorente
  Systems Engineer, GSM/UMTS Systems Management
  Ericsson España, S.A. (EEM) UMTS/GSM Databases
  Tel: +34 91 3393605                 Mob: +34 629 570196
  <mailto:[email-masked]>  Fax: +34 91 3392538
  Retama 1, 4th. 28045 Madrid - SPAIN -

---

From: Pat Calhoun <[email-masked]>
Date: Mon, 20 Aug 2001 10:14:04 -0700

> is it possible to issue a new Expected-Signed-AVP if the DSA hasn't

You can send a new message to re-establish new keying info prior to the TTL 
expiration. The peer needs to support this anyways, since the reason for the new
message could be due to a reboot.

> Diameter message? Or is it possible to "push" a certificate at

Well I would think that you'd need the cert to establish the DSA. We've never
discussed using the messages described in the CMS application as a way to push
certs.

PatC

---

From: Miguel Ángel Monjas Llorente <[email-masked]>
Date: Mon, 20 Aug 2001 19:44:56 +0200

> message could be due to a reboot.

OK. That answer my question.

> discussed using the messages described in the CMS application as a way to push

Well, just to quote the specification itself:

   This use of the CMS-Cert AVP can be used to "push" public key and
   attribute certificates and CRLs using Diameter, which MAY be useful
   in environments where repositories (e.g.  LDAP servers) are either
   not used or not available (e.g. due to crossing a domain boundary).

So that this use is suggested by the specification itself. The next
paragraph doesn't mention whether a DSA is stablished:

   Conforming implementations MUST be able to emit a certs-only CMS
   structure which contains relevant PKI related information and MUST
be
   able to process a CMS-Cert AVP which contains a certs-only CMS
   structure.

Regards

   // M.A.

---

From: Pat Calhoun <[email-masked]>
Date: Mon, 20 Aug 2001 16:53:18 -0700

hmmmm..... well the message is used to setup the DSA, so I suppose I assumed
that the reader would understand that sending another message, for the purposes
of pushing certs, would cause a rekey to occur.

Are you then stating that this isn't clear, and additional clarifying text
is required?

PatC

---

From: Miguel Ángel Monjas Llorente <[email-masked]>
Date: Thu, 23 Aug 2001 10:54:51 +0200

> Are you then stating that this isn't clear, and additional clarifying text

I'm afraid so (at least IMHO). Furthermore, additional clarifying text
is never a bad idea.

Regards

  // M.A.

---

From: Miguel Ángel Monjas Llorente <[email-masked]>
Date: Wed, 29 Aug 2001 12:05:08 +0200

> Are you then stating that this isn't clear, and additional clarifying text

Pat, have you got a proposal for this text? Is it necessary to write a
formal issue to ask for a clarification text?

Regards

  // M.A.

---

From: Pat Calhoun <[email-masked]>
Date: Wed, 29 Aug 2001 04:38:49 -0700

> formal issue to ask for a clarification text?

Here's the text that I have so far:

4.1  Diameter-Security-Association-Request

   The Diameter-Security-Association-Request command, indicated by the
   Command-Code field set to 304 and the 'R' bit set in the message
   flags field, is sent by a Diameter node to establish a Diameter
   Security Association. The DSAR message MUST NOT be used simply as 
   a convenient certificate distribution protocol without establishing 
   a DSA. The CMS-Signed-Data AVP MUST be present if any AVP in the 
   message has the 'P' bit set.

PatC

---

From: Miguel Ángel Monjas Llorente <[email-masked]>
Date: Wed, 29 Aug 2001 14:49:39 +0200

>    message has the 'P' bit set.

Perfect. I just wanted to know whether a certificate can be pushed
"outside" a DSA.

Regards

  // M.A.