Subject: Re: [AAA-WG]: Issue 167: CMS-Cert in AVP Occurence Table

From: Miguel Ángel Monjas Llorente <[email-masked]>
Date: Mon, 24 Sep 2001 14:30:33 +0200

Pat Calhoun wrote:
> 
> All,
> 
> THere are cases where a certificate could be omitted from a DSAR (e.g.
> if two nodes frequently setup DSAs and are under the same
> jurisdiction). This issue now mandates that the DSA-Request includes
> this AVP

Really?

My original proposal was changing the current row (which is the
following):

                                 +-----------------------+
                                 |      Command-Code     |
                                 |-----+-----+-----+-----+
   Attribute Name                | DSAR| DSAA| PDSR| PDSA|
   ------------------------------|-----+-----+-----+-----+
   CMS-Cert                      | 0   | 0   | 0   | 0   |

with this one

   CMS-Cert                      | 0-1 | 0   | 0   | 0   |

After some discussion, it was described that, if a certificate was
always needed in the DSAR, the row must be:

   CMS-Cert                      |  1 | 0   | 0   | 0   |

But, once Stephen and you has made a decision ("There are cases where
a certificate could be omitted from a DSAR"), my original proposal
must be included (that is, the issue must not be rejected, but taken
in its original way).

Regards

  // M.A.

-- 
  Miguel Angel Monjas Llorente
  Systems Engineer, GSM/UMTS Systems Management
  Ericsson España, S.A. (EEM) UMTS/GSM Databases
  Tel: +34 91 3393605                 Mob: +34 629 570196
  <mailto:[email-masked]>  Fax: +34 91 3392538
  Ombú 3, 10th. 28045 Madrid - SPAIN -

---

From: Pat Calhoun <[email-masked]>
Date: Mon, 24 Sep 2001 04:40:55 -0700

All,

THere are cases where a certificate could be omitted from a DSAR (e.g.
if two nodes frequently setup DSAs and are under the same
jurisdiction). This issue now mandates that the DSA-Request includes 
this AVP, and Stephen and I believe this should be rejected.

PatC

---

From: Pat Calhoun <[email-masked]>
Date: Mon, 24 Sep 2001 07:28:25 -0700

> My original proposal was changing the current row (which is the

yes, this one is fine.

>    CMS-Cert                      |  1 | 0   | 0   | 0   |

This one is a problem

> must be included (that is, the issue must not be rejected, but taken

correct... thanks for the recap. I think we lost the original proposal.

PatC

---

From: Miguel Ángel Monjas Llorente <[email-masked]>
Date: Mon, 24 Sep 2001 19:21:20 +0200

> >    CMS-Cert                      | 0-1 | 0   | 0   | 0   |

Sorry, but now I'm not certain of this suggestion. In one of the
answers to issue 180, you've said (when I was suggesting that it may
happen that AAA-Server-Certs wouldn't be present in a DSAA) that you
thought that AAA-Server-Certs would include the certificate of the AAA
server signing the DSAA, so that no CMS-Cert is needed here. Which is
the right answer to this problem?

Regards

  // M.A.

---

From: Pat Calhoun <[email-masked]>
Date: Mon, 24 Sep 2001 17:18:39 -0700

> the right answer to this problem?

The AVP isn't required to send AAA server certs, but you may want to send
other certs (e.g. top level CA cert).

PatC

---

From: Miguel Ángel Monjas Llorente <[email-masked]>
Date: Tue, 25 Sep 2001 09:50:11 +0200

> the right answer to this problem?

Well, sometimes I'm not the most clever man.... I've rethinking the
anwser above and is quite wrong. This issue was intended to fix an
alleged error in DSA-R (not in DSA-A in which AAA-Server-Certs must be
placed). Please drop this mail...

Regards

  // M.A.

---

From: Miguel Ángel Monjas Llorente <[email-masked]>
Date: Tue, 25 Sep 2001 16:02:49 +0200

> other certs (e.g. top level CA cert).

You needn't do that. The top level CA certificate should be one of the
"direct trust" certificates that the originator of the DSA listed in
the DSA-Request (Local-CA-Info) so that no top level certificate is
needed in the DSA-Answer but only the certificates included in
AAA-Server-Certs and the ones of the CA-Chain.

Regards

  // M.A.