Subject: [AAA-WG]: Issue 132: Multiple signatures on a set of AVPs

From: Pat Calhoun <[email-masked]>
Date: Mon, 27 Aug 2001 07:32:16 -0700

The original issue included the following proposed text:

"Multiple Diameter entities MAY add their signatures to an existing 
CMS-Signed-Data AVP. Multiple signatures are added within the
countersignature attribute (defined in section 11.4 of [3]) and 
not as additional SignerInfo values. The countersignature attribute 
requires that the signatures occur sequentially, meaning that each 
signature covers the existing signatures in the CMS object. This 
attribute MUST be always unsigned."

I have two comments. First, I'd like to propose the following text
instead (a slight variation from the above):

"Multiple Diameter entities MAY add their signatures to an existing 
CMS-Signed-Data AVP. Multiple signatures are added within the
countersignature attribute (defined in section 11.4 of [3]) and 
not as additional SignerInfo values. The countersignature attribute 
requires that the signatures occur sequentially, meaning that each 
signature covers the existing signatures in the CMS object. This 
attribute MUST be always unsigned. "

My second comment has to do with the last sentence. What exactly is
the attribute that must be unsigned? Does this mean unsigned as in
how the field is treated (meaning most significant bit is part of the
value), or rather that the attribute doesn't include a digital signature?
If the latter, then the text reads that the countersignature attribute
requires a signature, but it is unsigned.

confused

PatC

---

From: Miguel Ángel Monjas Llorente <[email-masked]>
Date: Tue, 28 Aug 2001 10:34:15 +0200

> attribute MUST be always unsigned. "

I've read carefully both paragraphs and... they are the same!!!
Finally I checked the original paragraph proposed by my and saw what
is Pat proposing (sometimes cut&paste fails :-)))

The change is stylistic (and sounds better), so that you can go ahead
with your proposal.

> requires a signature, but it is unsigned.

Yes, a little bit confused. In my answer to issue #133 I make it
clear: according to CMS specification, countersignature is an unsigned
attribute within a SignedData SignedInfo value while message-digest is
signed. But those facts are relevant within CMS not in Diameter CMS
Security. My proposal is to drop that sentence:

signature covers the existing signatures in the CMS object. "

Regards

  // M.A.