Subject: [AAA-WG]: [issue] CMS-Data AVPs in base protocol

From: Miguel Ángel Monjas Llorente <[email-masked]>
Date: Mon, 24 Sep 2001 11:22:46 +0200

Submitter name: Miguel A. Monjas
Submitter email address: [email-masked] 
Date first submitted: 2001-09-24
Reference: 
Document: Base
Comment type: T
Priority: S
Section: 9.5, 9.7.1
Rationale/Explanation of issue: 

In base specification 9.5 it's quoted the term CMS-Data AVP:

  In all accounting records the Session-Id and User-Name AVPs MUST
  be present. If end-to-end authentication is required, as described
  in [11], the CMS-Data AVP may be used to authenticate the
  Accounting Data and Service Specific AVPs. It is not typically
  necessary, nor recommended, that the end-to-end authentication
  cover any additional AVPs since the Data and Service Specific AVP,
  and associated CMS-Data, MAY need to be submitted to a third party.

Also in 9.7.1:

  When the Accounting-Request is being submitted to a third party
  (e.g. settlement service), and includes the CMS-Data AVP [11], the
  CMS-Data AVP MUST be signed by both the local and home Diameter
  server using the countersignature procedures described in [11].

However, this CMS-Data AVP doesn't actually exist.

Requested change: 

Changing that term in both paragraphs. In the first paragraph,
CMS-Data should be changed by CMS-Signed-Data since it's
authentication the security service involved. However, in the last
sentence, the phrase "It is [...] not recommended that the end-to-end
authentication cover any additional AVPs..." looks wrong. As stated in
the discussion of issue 150, too much digital signature doesn't harm
and there's no problem if the signature covers other AVPs.

The result could be something like the following:

  In all accounting records the Session-Id and User-Name AVPs MUST
  be present. If end-to-end authentication is required, as described
  in [11], the CMS-Signed-Data AVP may be used to authenticate the
  Accounting Data and Service Specific AVPs. It is not typically
  necessary, although nor harmful, that the digital signature carried
  by the CMS-Signed-Data AVP covers any additional AVPs, even if the
  since the Data and Service Specific AVP, and associated 
  CMS-Signed-Data, MAY need to be submitted to a third party.

In the second one, it also looks like CMS-Signed-Data is the right
option.

  When the Accounting-Request is being submitted to a third party
  (e.g. settlement service), and includes the CMS-Signed-Data AVP
  [11], the CMS-Signed-Data AVP MUST be include digital signatures
  by both the local and home Diameter server using the
countersignature
  procedures described in [11].

Regards

  // M.A.

-- 
  Miguel Angel Monjas Llorente
  Systems Engineer, GSM/UMTS Systems Management
  Ericsson España, S.A. (EEM) UMTS/GSM Databases
  Tel: +34 91 3393605                 Mob: +34 629 570196
  <mailto:[email-masked]>  Fax: +34 91 3392538
  Retama 1, 4th. 28045 Madrid - SPAIN -

---

From: Miguel Ángel Monjas Llorente <[email-masked]>
Date: Mon, 24 Sep 2001 11:47:10 +0200

Problems with the cut&paste

>         the Data and Service Specific AVP, and associated
    ^^^^^
         "since" dropped

Regards

  // M.A.

  Ombú 3, 10th. 28045 Madrid - SPAIN -