: SIP: Description of mode selection appears to be self-contradictory

"Glen Zorn (gwz)" <[email protected]> Mon, 17 Oct 2005 21:15:09 -0700
Newsgroups gmane.ietf.aaa
Message-ID <4C0FAAC489C8B74F96BEAD85EAEB2625E24265@xmb-sjc-215.amer.cisco.com>
Description of issue: Description of mode selection appears to be
self-contradictory
Submitter name: Glen Zorn
Submitter email address: [email protected]
Date first submitted: 17 Oct 05
Document: sip
Comment type: T
Priority: S
Section: 5.4
Rationale/Explanation of issue: Paragraph 5 says "The Diameter client in
SIP server 2 first makes a decision, based on configuration, whether to
operate in the mode where nonces are generated in the Diameter client or
in the Diameter server.  Then the Diameter client requests
authentication parameters by sending a Diameter Multimedia-Auth-Request
(MAR) message (step 5) to the Diameter server."  However, later in the
same paragraph it says "The Diameter server responds with a Diameter
Multimedia-Auth-Answer (MAA) message (step 6), which includes a nonce
and all the rest of the parameters necessary for the designated
authentication algorithm associated with the user.  Among others, the
MAA message includes a Digest-HA1 AVP that contains H(A1) (as defined in
RFC 2617 [RFC2617]), and that allows the Diameter client to calculate
the expected response.  Then   the Diameter client can compare this
expected response to with the response to the challenge sent from the
SIP UA.  The absence of the Digest-HA1 AVP in [the] MAA indicates that
authentication and authorization takes place in the Diameter server, as
per the scenario described in Section 5.3", which implies that the
Diameter server is, in fact, deciding whether or not the verification of
the credentials is delegated to the client.  What happens if the client
has decided to verify credentials itself, but no Digest-HA1 AVP is
present in the MAA message?  

Requested change: Clarify the mode selection process.