Subject: [AAA-WG]: Questions about DSAs through proxy agents

From: Miguel Ángel Monjas Llorente <[email-masked]>
Date: Mon, 20 Aug 2001 20:22:20 +0200

Hi all,

I'm trying to understand the overall mechanism of CMS Security when a
proxy is involved. I'd be grateful for any comment about my
description.

An agent tries to establish a DSA with a Diameter server. Let's
imagine that it requires both encrypted and signed AVPs. There is also
a downstream proxy.

The proxy inspects the request and checks that it won't modify any of
the expected protected AVPs, so that answers with a DSAA including
DIAMETER_CAN_ACT_AS_CMS_PROXY. Which additional AVPs must include this
answer? It doesn't seem that the same information quoted in 3.1 must
be present there (which AAA-Server-Certs AVPs are gonna be used).
Finally, as stated in 1.2, the DSAA must include a CMS-Signed-Data AVP
(but, on what?) along with the digital certificate of the proxy.

If the agent agrees on using the proxy, I assume that the proxy
establishes the DSA with the AAA server using some of the parameters
provided by the agent in the first DSAR (at least TTL,
Expected-Encrypted-AVP and Expected-Signed-AVP; am I right?). It signs
the protected AVPs with its proper keys and includes its certificates.
From the server point of view, the cryptographic partner is the proxy.
Finally, the proxy issues a PDSA indicating success.

From now, all the signed AVP coming from the server are checked and
forwared to the agent (erasing the CMS-Signed-Data AVPs); the
encrypted data is extracted and forwarded to the agent. On the other
way, the AVPs that the server expects as signed are signed by the
proxy. The ones required as encrypted are encrypted by the proxy.
That's clear...

Any comment on the first point of the mail...

-- 
  Miguel Angel Monjas Llorente
  Systems Engineer, GSM/UMTS Systems Management
  Ericsson España, S.A. (EEM) UMTS/GSM Databases
  Tel: +34 91 3393605                 Mob: +34 629 570196
  <mailto:[email-masked]>  Fax: +34 91 3392538
  Retama 1, 4th. 28045 Madrid - SPAIN -

---

From: Miguel Ángel Monjas Llorente <[email-masked]>
Date: Wed, 22 Aug 2001 16:26:39 +0200

> (but, on what?) along with the digital certificate of the proxy.

Sorry. I've just read that a message with a failure Result-Code
doesn't to conform to the ABNF of the command.

Rest of concerns are developed in separate mails...

Regards

  // M.A.