Subject: [Dime] Comments on draft-ietf-dime-ikev2-psk-diameter-03.txt

From: "Mizikovsky, Semyon B (Simon)" <[email-masked]>
Date: Thu, 28 Oct 2010 14:53:07 -0500

1. In Sec.4.2 first paragraph "The HAAA may maintain state or may be stateless.  This is indicated by presence or absence of the Auth-Session-State AVP." This behavior is already defined in RFC3588. In fact, absence of the Auth-Session-State AVP in a Request would indicate the default that the state is requested to be maintained by the HAAA, and absence of this AVP in an Answer - that the HAAA will in fact maintain the state. Suggest to remove these two sentences, leaving only the main requirement of this Draft, listed in the third sentence: "The IKEv2 Server MUST support the Authorization Session State Machine defined in [RFC3588]."

2. The Auth-Session-State AVP is absent in the IKEv2-PSK-Answer (IKEPSKA) Command, sec. 5.2, even though it is shown [optional] in IKEv2-PSK-Request (IKEPSKR) Command, sec.5.1.  Suggest to add it to IKEv2-PSK-Answer (IKEPSKA) Command for completeness.

3. Sec.10 "Security Considerations", second paragraph "In this case, the HA to the Diameter server AAA communication relies on the security properties of the intermediating AAA inter-connection networks, AAA brokers, and Diameter agents." Suggest replacing the HA with IKEv2 Server.

With these changes, suggest to approve the draft for publication.

Semyon Mizikovsky
Alcatel Lucent
Wireless Security & Fraud Prevention
Wireless Standards Department
600/700 Mountain Avenue, 3C-506L
Murray Hill, NJ 07974, USA
(O) 1+908-582-0729
(M) 1+732-239-7533
(F)  1+908-743-4361