Subject: [AAA-WG]: [issue] Partial support of CMS

From: Miguel Ángel Monjas Llorente <[email-masked]>
Date: Fri, 14 Sep 2001 12:18:20 +0200

Submitter name: Miguel A. Monjas
Submitter email address: [email-masked] 
Date first submitted: 2001-09-14
Reference: 
Document: CMS-02. ¿base?
Comment type: T
Priority: S
Section: 
Rationale/Explanation of issue: 

One of the scenarios described in section 4.3 introduces the concept
of a client without cryptographic abilities but able to send a PDSA
request (and process a PDSA answer).

My concern is the following: does this client actually support CMS
(that is, can it include a value of '2' in the capabilities exchange?)
I don't think so. However, it must support the messages that are
needed to request a proxy a DSA on its behalf.

Requested change: 

A clarifying text about it such clients can advertise that they
support CMS when they can't actually do it? As a consecuence, maybe it
would be more reasonable to move PDSAR and PDSAA to the base
specification, so that a base support would include such messages (I
don't really like this proposal, but IMHO it's the more coherent).

Regards

  // M.A.

-- 
  Miguel Angel Monjas Llorente
  Systems Engineer, GSM/UMTS Systems Management
  Ericsson España, S.A. (EEM) UMTS/GSM Databases
  Tel: +34 91 3393605                 Mob: +34 629 570196
  <mailto:[email-masked]>  Fax: +34 91 3392538
  Retama 1, 4th. 28045 Madrid - SPAIN -

---

From: Pat Calhoun <[email-masked]>
Date: Sun, 16 Sep 2001 08:33:00 -0700

Folks, my inclination is to not make this change, but I think that it deserves
input from the WG. We have a couple of options here:

1. Move the PDSR to the base protocol spec, as suggested below.
2. Add clarifying text to the CMS spec stating that a compliant node
   MAY only need to support the PDSR/PDSA messages.
3. Split the CMS spec into two (my least favorite)
4. Have the CMS spec include a two application-Id (this would be broken, btw)
   so I don't believe we should take this approach.
5. leave it as is.

my preference is #2 above.

Comments from the WG please.

PatC

---

From: "Jari Arkko" <[email-masked]>
Date: Sun, 16 Sep 2001 21:15:42 +0300

>    so I don't believe we should take this approach.

My preference is also #2.

Jari

---

From: "Fredrik Johansson" <[email-masked]>
Date: Mon, 17 Sep 2001 10:24:40 +0200

I would prefer #2

/Fredrik

>-----Original Message-----
>From: [email-masked] [mailto:[email-masked]]On Behalf Of
>Jari Arkko
>Sent: den 16 september 2001 20:16
>To: Pat Calhoun; Miguel Ángel Monjas Llorente
>Cc: [email-masked]
>Subject: Re: WG Consensus check: Re: [AAA-WG]: [issue] Partial support
>of CMS
>
>
>

---

From: Miguel Ángel Monjas Llorente <[email-masked]>
Date: Mon, 17 Sep 2001 10:52:52 +0200

> my preference is #2 above.

Proposal #2 means that a node announcing -1 may have no real CMS
support (just PDSR/PDSA messages).

Since I think that this option might be very risky, I'd modify #2
proposal to say that ONLY Diameter clients (that is, NASes) may
support only PDSA messages while not supporting the whole application.

Regards

  // M.A.

---

From: Jari Arkko <[email-masked]>
Date: Mon, 17 Sep 2001 12:16:35 +0300

>support only PDSA messages while not supporting the whole application.

Well... not sure I agree about the risky part here.
CMS is an extension, and certain rules dictate
how an implementation is conformant to it.

Base protocol spec 2.0 gives these rules (which contain
more text than just excusing the clients, by the way).
I am happy with the current spec in this respect.

One way of implementing the option #2 that is under
discussion is to copy also the relevant excerpt from
base 2.0 to cms.

Jari

---

From: Miguel Ángel Monjas Llorente <[email-masked]>
Date: Mon, 17 Sep 2001 13:08:21 +0200

> I am happy with the current spec in this respect.

Yes. I browsed that section a long time ago and I didn't remember the
exact details. After reading, the conclusion is clear:

- Diameter servers: MUST support DSA messages; MAY support PDSA
messages
- Proxy agents: MUST support DSA messages; MUST support PDSA messages
- Diameter clients: SHOULD support DSA messages; MUST support PDSA
messages
- Relay agents: MAY support DSA messages; MAY support PDSA messages
- Redirector agents: MAY support DSA messages; MAY support PDSA
messages

What looks fine (except that Diameter clients SHOULD support DSA
messages; wouldn't it be more realistic to weaken this requirement
(since the proper CMS draft states some scenarios with NASes without
cryptographic abilities)?)

> discussion is to copy also the relevant excerpt from

Yes, I think that including a paragraph stating what the announcement
for each type of diameter nodes means would be convenient.

Regards

  Ombú 3, 10th. 28045 Madrid - SPAIN -