draft-ietf-rap-rsvp-authsession-03.txt   draft-ietf-rap-rsvp-authsession-04.txt 
RAP Working Group L-N. Hamer RAP Working Group L-N. Hamer
Internet Draft B. Gage Internet Draft B. Gage
M. Broda Nortel Networks
Document: draft-ietf-rap-rsvp-authsession-03.txt Nortel Networks Document: draft-ietf-rap-rsvp-authsession-04.txt B. Kosinski
B. Kosinski
University of Alberta University of Alberta
Hugh Shieh Hugh Shieh
AT&T Wireless AT&T Wireless
June 2002 October 2002
Session Authorization for RSVP Session Authorization Policy Element
Status of this Memo Status of this Memo
This document is an Internet-Draft and is in full conformance with This document is an Internet-Draft and is in full conformance with
all provisions of Section 10 of RFC2026. all provisions of Section 10 of RFC2026.
Internet-Drafts are working documents of the Internet Engineering Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF), its areas, and its working groups. Note that Task Force (IETF), its areas, and its working groups. Note that
other groups may also distribute working documents as Internet- other groups may also distribute working documents as Internet-
Drafts. Internet-Drafts are draft documents valid for a maximum of Drafts. Internet-Drafts are draft documents valid for a maximum of
six months and may be updated, replaced, or obsoleted by other six months and may be updated, replaced, or obsoleted by other
documents at any time. It is inappropriate to use Internet-Drafts as documents at any time. It is inappropriate to use Internet-Drafts as
reference material or to cite them other than as "work in progress." reference material or to cite them other than as "work in progress."
The list of current Internet-Drafts can be accessed at The list of current Internet-Drafts can be accessed at
http://www.ietf.org/ietf/1id-abstracts.txt http://www.ietf.org/ietf/1id-abstracts.txt
The list of Internet- Draft Shadow Directories can be accessed at The list of Internet- Draft Shadow Directories can be accessed at
http://www.ietf.org/shadow.html http://www.ietf.org/shadow.html
The distribution of this memo is unlimited. This memo is filed as The distribution of this memo is unlimited. This memo is filed as
<draft-ietf rap-rsvp-authsession-03.txt>, and expires November, <draft-ietf-rap-rsvp-authsession-04.txt>, and expires March,
2002. Please send comments to the authors. 2003. Please send comments to the authors.
Copyright Notice Copyright Notice
Copyright (C) The Internet Society (2002). All Rights Reserved. Copyright (C) The Internet Society (2002). All Rights Reserved.
Abstract Abstract
This document describes the representation of session authorization This document describes the representation of a session
information in the POLICY_DATA object (RFC 2750) for supporting authorization policy element for supporting policy-based per-session
policy-based per-session authorization and admission control in authorization and admission control. The goal of session
RSVP. The goal of session authorization is to allow the exchange of authorization is to allow the exchange of information between
information between network elements in order to authorize the use network elements in order to authorize the use of resources for a
of resources for a service and to co-ordinate actions between the service and to co-ordinate actions between the signaling and
signaling and transport planes. This document describes how a transport planes. This document describes how a process on a system
process on a system authorizes the reservation of resources by a authorizes the reservation of resources by a host and then provides
host and then provides that host with a session authorization policy that host with a session authorization policy element which can be
element which can be inserted into the RSVP PATH message to inserted into a resource reservation protocol (e.g. the RSVP PATH
facilitate proper and secure reservation of those resources within message) to facilitate proper and secure reservation of those
the network. We describe the encoding of media authorization resources within the network. We describe the encoding of session
information as RSVP policy elements and provide details relating to authorization information as a policy element conforming to the
operations, processing rules and error scenarios. format of a Policy Data object (RFC-2750) and provide details
relating to operations, processing rules and error scenarios.
Contents Contents
Status of this Memo................................................1 Status of this Memo................................................1
Copyright Notice...................................................1 Copyright Notice...................................................1
Abstract...........................................................1 Abstract...........................................................1
1. Conventions used in this document...............................3 1. Conventions used in this document...............................3
2. Introduction....................................................3 2. Introduction....................................................3
3. Policy Element for Session Authorization Data...................4 3. Policy Element for Session Authorization........................4
3.1 Policy Data Object Format......................................4 3.1 Policy Data Object Format......................................4
3.2 Session Authorization Data Policy Element......................4 3.2 Session Authorization Policy Element...........................4
3.3 Session Authorization Attributes...............................4 3.3 Session Authorization Attributes...............................4
3.3.1 Authorizing Entity Identifier................................6 3.3.1 Authorizing Entity Identifier................................6
3.3.2 Session Identifier...........................................7 3.3.2 Session Identifier...........................................7
3.3.3 Source Address...............................................7 3.3.3 Source Address...............................................7
3.3.4 Destination Address..........................................9 3.3.4 Destination Address..........................................9
3.3.5 Start time..................................................10 3.3.5 Start time..................................................10
3.3.6 End time....................................................11 3.3.6 End time....................................................11
3.3.7 Resources Authorized........................................11 3.3.7 Resources Authorized........................................11
3.3.8 Authentication data.........................................12 3.3.8 Authentication data.........................................12
4. Integrity of the AUTH_SESSION policy element...................13 4. Integrity of the AUTH_SESSION policy element...................13
4.1 Shared private keys...........................................13 4.1 Shared symmetric keys.........................................13
4.1.1 Operational Setting using shared private keys...............13 4.1.1 Operational Setting using shared symmetric keys.............13
4.2 Kerberos......................................................14 4.2 Kerberos......................................................14
4.2.1. Operational Setting using Kerberos.........................14 4.2.1. Operational Setting using Kerberos.........................14
4.3 Public Key....................................................15 4.3 Public Key....................................................16
4.3.1. Operational Setting for public key based authentication....15 4.3.1. Operational Setting for public key based authentication....16
5. Framework......................................................16 4.3.1.1 X.509 V3 digital certificates.............................16
5.1 The coupled model.............................................16 4.3.1.2 PGP digital certificates..................................17
5.2 The associated model with one policy server...................16 5. Framework......................................................18
5.3 The associated model with two policy servers..................17 5.1 The coupled model.............................................18
5.4 The non-associated model......................................17 5.2 The associated model with one policy server...................18
6. Message Processing Rules.......................................17 5.3 The associated model with two policy servers..................19
6.1 Message Generation (RSVP Host)................................17 5.4 The non-associated model......................................19
6.2 Message Reception (Router)....................................18 6. Message Processing Rules.......................................20
6.3 Authorization (Router/PDP)....................................18 6.1 Generation of the AUTH_SESSION by the authorizing entity......20
7. Error Signaling................................................18 6.2 Message Generation (RSVP Host)................................20
8. IANA Considerations............................................19 6.3 Message Reception (RSVP-aware Router).........................20
9. Security Considerations........................................20 6.4 Authorization (Router/PDP)....................................20
10. Acknowledgments...............................................21 7. Error Signaling................................................21
11. Normative References..........................................21 8. IANA Considerations............................................21
12. Informative References........................................23 9. Security Considerations........................................23
13. Author Information............................................23 10. Acknowledgments...............................................24
14. Full Copyright Statement......................................24 11. Normative References..........................................24
15. Notices.......................................................24 12. Informative References........................................26
16. RFC Editor Considerations.....................................25 13. Author Information............................................26
14. Contributors..................................................27
15. Full Copyright Statement......................................27
16. Notices.......................................................27
1. Conventions used in this document 1. Conventions used in this document
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
this document are to be interpreted as described in [RFC-2119]. document are to be interpreted as described in [RFC-2119].
2. Introduction 2. Introduction
RSVP [RFC-2205] is a resource reservation setup protocol designed RSVP [RFC-2205] is one example of a resource reservation protocol
for an integrated services [RFC-1633] or Integrated Services over that is used by a host to request specific services from the network
Diffserv networks [RFC-2998]. The RSVP protocol is used by a host to for particular application data streams or flows. RSVP requests
request specific services from the network for particular will generally result in resources being reserved in each router
application data streams or flows. RSVP is also used to deliver along the data path. RSVP allows users to obtain preferential
quality-of-service (QoS) requests to all routers along the path(s) access to network resources, under the control of an admission
of the flows and to establish and maintain state to provide the control mechanism. Such admission control is often based on user or
requested quality of service. RSVP requests will generally result application identity [RFC-3182], however, it is also valuable to
in resources being reserved in each router along the data path. provide the ability for per-session admission control.
RSVP allows users to obtain preferential access to network
resources, under the control of an admission control mechanism.
Such admission control is often based on user or application
identity [RFC-3182], however, it is also valuable to provide the
ability for per-session admission control.
In order to allow for per-session admission control, it is necessary In order to allow for per-session admission control, it is necessary
to provide a mechanism for ensuring use of resources by a host has to provide a mechanism for ensuring use of resources by a host has
been properly authorized before allowing the reservation of those been properly authorized before allowing the reservation of those
resources. In order to meet this requirement, there must be resources. In order to meet this requirement, there must be
information in the RSVP message which may be used to verify the information in the resource reservation message which may be used to
validity of the RSVP request. This can be done by providing the verify the validity of the reservation request. This can be done by
host with a token upon authorization which is inserted into the RSVP providing the host with a session authorization policy element which
PATH message and verified by the network. is inserted into the resource reservation message and verified by
the network.
This document describes the session authorization element This document describes the session authorization policy element
(AUTH_SESSION) contained in the POLICY_DATA object. The user (AUTH_SESSION) used to convey information about the resources
process must obtain an AUTH_SESSION object from an authorizing authorized for use by a session. The host must obtain an
entity, which it then passes to the RSVP process (service) on the AUTH_SESSION element from an authorizing entity via a session
originating host. The RSVP service then inserts the AUTH_SESSION signaling protocol such as SIP [RFC-3261]. The host then inserts
object into the RSVP PATH message to allow verification of the the AUTH_SESSION element into the resource reservation message to
network resource request. Network elements verify the request and allow verification of the network resource request; in the case of
then process the RSVP message based on admission policy. RSVP, this element MUST be encapsulated in the Policy Data object
[RFC-2750] of an RSVP PATH message. Network elements verify the
request and then process the resource reservation message based on
admission policy.
[S-AUTH] describes a framework in which a session authorization [S-AUTH] describes a framework in which a session authorization
policy element may be utilized to contain information relevant to policy element may be utilized to contain information relevant to
the network's decision to grant a reservation request. the network's decision to grant a reservation request.
3. Policy Element for Session Authorization Data 3. Policy Element for Session Authorization
3.1 Policy Data Object Format 3.1 Policy Data Object Format
POLICY_DATA objects contain policy information and are carried by The Session Authorization policy element conforms to the format of a
RSVP messages. A detailed description of the format of POLICY_DATA POLICY DATA object which contains policy information and is carried
object can be found in "RSVP Extensions for Policy Control" [RFC- by policy based admission protocols such as RSVP. A detailed
2750]. description of the POLICY_DATA object can be found in "RSVP
Extensions for Policy Control" [RFC-2750].
3.2 Session Authorization Data Policy Element 3.2 Session Authorization Policy Element
In this section we describe a policy element (PE) called session In this section we describe a policy element (PE) called session
authorization data (AUTH_SESSION). The AUTH_SESSION policy element authorization (AUTH_SESSION). The AUTH_SESSION policy element
contains a list of fields which describe the session, along with contains a list of fields which describe the session, along with
other attributes. other attributes.
+-------------+-------------+-------------+-------------+ +-------------+-------------+-------------+-------------+
| Length | P-Type = AUTH_SESSION | | Length | P-Type = AUTH_SESSION |
+-------------+-------------+-------------+-------------+ +-------------+-------------+-------------+-------------+
// Session Authorization Attribute List // // Session Authorization Attribute List //
+-------------------------------------------------------+ +-------------------------------------------------------+
Length: 16 bits Length: 16 bits
skipping to change at line 184 skipping to change at page 4, line 43
P-Type: 16 bits (Session Authorization Type) P-Type: 16 bits (Session Authorization Type)
AUTH_SESSION = TBD-by-IANA AUTH_SESSION = TBD-by-IANA
The Policy element type (P-type) of this element. The The Policy element type (P-type) of this element. The
Internet Assigned Numbers Authority (IANA) acts as a registry Internet Assigned Numbers Authority (IANA) acts as a registry
for policy element types for identity as described in for policy element types for identity as described in
[RFC-2750]. [RFC-2750].
Session Authorization Attribute List: variable length Session Authorization Attribute List: variable length
The session authorization attribute list is a collection of The session authorization attribute list is a collection of
objects which describes the session and provides other objects which describes the session and provides other
information necessary to verify the RSVP request. An initial set information necessary to verify the resource reservation request.
of valid objects is described in Section 3. An initial set of valid objects is described in Section 3.3.
3.3 Session Authorization Attributes 3.3 Session Authorization Attributes
A session authorization attribute may contain a variety of A session authorization attribute may contain a variety of
information and has both an attribute type and subtype. The information and has both an attribute type and subtype. The
attribute itself MUST be a multiple of 4 octets in length, and any attribute itself MUST be a multiple of 4 octets in length, and any
attributes that are not a multiple of 4 octets long MUST be padded attributes that are not a multiple of 4 octets long MUST be padded
to a 4-octet boundary. All padding bytes MUST have a value of zero. to a 4-octet boundary. All padding bytes MUST have a value of zero.
+--------+--------+--------+--------+ +--------+--------+--------+--------+
skipping to change at line 279 skipping to change at page 6, line 42
2 IPV6_ADDRESS IPv6 address represented in 128 bits 2 IPV6_ADDRESS IPv6 address represented in 128 bits
3 FQDN Fully Qualified Domain Name as defined 3 FQDN Fully Qualified Domain Name as defined
in RFC-1034 as an ASCII string. in RFC-1034 as an ASCII string.
4 ASCII_DN X.500 Distinguished name as defined 4 ASCII_DN X.500 Distinguished name as defined
in RFC-2253 as an ASCII string. in RFC-2253 as an ASCII string.
5 UNICODE_DN X.500 Distinguished name as defined 5 UNICODE_DN X.500 Distinguished name as defined
in RFC-2253 as a UNICODE string. in RFC-2253 as a UTF-8 string.
6 URI Universal Resource Identifier, as 6 URI Universal Resource Identifier, as
defined in RFC-2396. defined in RFC-2396.
7 KRB_PRINCIPAL Fully Qualified Kerberos Principal name 7 KRB_PRINCIPAL Fully Qualified Kerberos Principal name
represented by the ASCII string of a represented by the ASCII string of a
principal followed by the @ realm name as principal followed by the @ realm name as
defined in RFC-1510 (e.g. defined in RFC-1510 (e.g.
principalX@realmY). principalX@realmY).
8 X509_V3_CERT A chain of authorizing entity's X.509 V3 8 X509_V3_CERT A chain of authorizing entity's X.509 V3
digital certificates. digital certificates as defined in RFC-
3280.
9 PGP_CERT The PGP digital certificate of the 9 PGP_CERT The PGP digital certificate of the
authorizing entity. authorizing entity as defined in RFC-2440.
OctetString OctetString
Contains the authorizing entity identifier. Contains the authorizing entity identifier.
3.3.2 Session Identifier 3.3.2 Session Identifier
SESSION_ID is a unique identifier used by the authorizing entity to SESSION_ID is a unique identifier used by the authorizing entity to
identify the request. It may be used for a number of purposes, identify the request. It may be used for a number of purposes,
including replay detection, or to correlate this request to a policy including replay detection, or to correlate this request to a policy
decision entry made by the authorizing entity. For example, the decision entry made by the authorizing entity. For example, the
skipping to change at line 364 skipping to change at page 8, line 27
2 IPV6_ADDRESS IPv6 address represented in 128 bits 2 IPV6_ADDRESS IPv6 address represented in 128 bits
3 FQDN Fully Qualified Domain Name as defined 3 FQDN Fully Qualified Domain Name as defined
in RFC-1034 as an ASCII string. in RFC-1034 as an ASCII string.
4 ASCII_DN X.500 Distinguished name as defined 4 ASCII_DN X.500 Distinguished name as defined
in RFC-2253 as an ASCII string. in RFC-2253 as an ASCII string.
5 UNICODE_DN X.500 Distinguished name as defined 5 UNICODE_DN X.500 Distinguished name as defined
in RFC-2253 as a UNICODE string. in RFC-2253 as a UTF-8 string.
6 UDP_PORT LIST list of UDP port specifications, 6 UDP_PORT_LIST list of UDP port specifications,
represented as 16 bits per list entry. represented as 16 bits per list entry.
7 TCP_PORT LIST list of TCP port specifications, 7 TCP_PORT_LIST list of TCP port specifications,
represented as 16 bits per list entry. represented as 16 bits per list entry.
OctetString OctetString
The OctetString contains the source address information. The OctetString contains the source address information.
In scenarios where a source address is required (see Section 5), at In scenarios where a source address is required (see Section 5), at
least one of the subtypes 1 through 5 (inclusive) MUST be included least one of the subtypes 1 through 5 (inclusive) MUST be included
in every Session Authorization Data Policy Element. Multiple SOURCE in every Session Authorization Data Policy Element. Multiple SOURCE
ADDR attributes MAY be included if multiple addresses have been ADDR attributes MAY be included if multiple addresses have been
authorized. The source address field of the RSVP datagram MUST match authorized. The source address field of the resource reservation
one of the SOURCE ADDR attributes contained in this Session datagram (e.g. RSVP PATH) MUST match one of the SOURCE ADDR
Authorization Data Policy Element when resolved to an IP address. attributes contained in this Session Authorization Data Policy
Element when resolved to an IP address.
At most, one instance of subtype 6 MAY be included in every Session At most, one instance of subtype 6 MAY be included in every Session
Authorization Data Policy Element. At most, one instance of subtype Authorization Data Policy Element. At most, one instance of subtype
7 MAY be included in every Session Authorization Data Policy 7 MAY be included in every Session Authorization Data Policy
Element. Inclusion of a subtype 6 attribute does not prevent Element. Inclusion of a subtype 6 attribute does not prevent
inclusion of a subtype 7 attribute (i.e. both UDP and TCP ports may inclusion of a subtype 7 attribute (i.e. both UDP and TCP ports may
be authorized). be authorized).
If no PORT attributes are specified, then all ports are considered If no PORT attributes are specified, then all ports are considered
valid; otherwise, only the specified ports are authorized for use. valid; otherwise, only the specified ports are authorized for use.
skipping to change at line 432 skipping to change at page 9, line 47
2 IPV6_ADDRESS IPv6 address represented in 128 bits 2 IPV6_ADDRESS IPv6 address represented in 128 bits
3 FQDN Fully Qualified Domain Name as defined 3 FQDN Fully Qualified Domain Name as defined
in RFC-1034 as an ASCII string. in RFC-1034 as an ASCII string.
4 ASCII_DN X.500 Distinguished name as defined 4 ASCII_DN X.500 Distinguished name as defined
in RFC-2253 as an ASCII string. in RFC-2253 as an ASCII string.
5 UNICODE_DN X.500 Distinguished name as defined 5 UNICODE_DN X.500 Distinguished name as defined
in RFC-2253 as a UNICODE string. in RFC-2253 as a UTF-8 string.
6 UDP_PORT LIST list of UDP port specifications, 6 UDP_PORT_LIST list of UDP port specifications,
represented as 16 bits per list entry. represented as 16 bits per list entry.
7 TCP_PORT LIST list of TCP port specifications, 7 TCP_PORT_LIST list of TCP port specifications,
represented as 16 bits per list entry. represented as 16 bits per list entry.
OctetString OctetString
The OctetString contains the destination address specification. The OctetString contains the destination address specification.
In scenarios where a destination address is required (see Section In scenarios where a destination address is required (see Section
5), at least one of the subtypes 1 through 5 (inclusive) MUST be 5), at least one of the subtypes 1 through 5 (inclusive) MUST be
included in every Session Authorization Data Policy Element. included in every Session Authorization Data Policy Element.
Multiple DEST ADDR attributes MAY be included if multiple addresses Multiple DEST ADDR attributes MAY be included if multiple addresses
have been authorized. The destination address field of the RSVP have been authorized. The destination address field of the resource
datagram MUST match one of the DEST ADDR attributes contained in reservation datagram (e.g. RSVP PATH) MUST match one of the DEST
this Session Authorization Data Policy Element when resolved to an ADDR attributes contained in this Session Authorization Data Policy
IP address. Element when resolved to an IP address.
At most, one instance of subtype 6 MAY be included in every Session At most, one instance of subtype 6 MAY be included in every Session
Authorization Data Policy Element. At most, one instance of subtype Authorization Data Policy Element. At most, one instance of subtype
7 MAY be included in every Session Authorization Data Policy 7 MAY be included in every Session Authorization Data Policy
Element. Inclusion of a subtype 6 attribute does not prevent Element. Inclusion of a subtype 6 attribute does not prevent
inclusion of a subtype 7 attribute (i.e. both UDP and TCP ports may inclusion of a subtype 7 attribute (i.e. both UDP and TCP ports may
be authorized). be authorized).
If no PORT attributes are specified, then all ports are considered If no PORT attributes are specified, then all ports are considered
valid; otherwise, only the specified ports are authorized for use. valid; otherwise, only the specified ports are authorized for use.
skipping to change at line 609 skipping to change at page 13, line 22
field MUST be set to 0. field MUST be set to 0.
OctetString OctetString
OctetString contains the authentication data of the AUTH_SESSION. OctetString contains the authentication data of the AUTH_SESSION.
4. Integrity of the AUTH_SESSION policy element 4. Integrity of the AUTH_SESSION policy element
This section describes how to ensure the integrity of the policy This section describes how to ensure the integrity of the policy
element is preserved. element is preserved.
4.1 Shared private keys 4.1 Shared symmetric keys
In shared private key environments, the AUTH_ENT_ID MUST be of In shared symmetric key environments, the AUTH_ENT_ID MUST be of
subtypes: IPV4_ADDR, IPV6_ADDR, FQDN, ASCII_DN, UNICODE_DN or URI. subtypes: IPV4_ADDR, IPV6_ADDR, FQDN, ASCII_DN, UNICODE_DN or URI.
An example AUTH_SESSION policy element is shown below. An example AUTH_SESSION policy element is shown below.
+--------------+--------------+--------------+--------------+ +--------------+--------------+--------------+--------------+
| Length | P-type = AUTH_SESSION | | Length | P-type = AUTH_SESSION |
+--------------+--------------+--------------+--------------+ +--------------+--------------+--------------+--------------+
| Length |SESSION_ID | zero | | Length |SESSION_ID | zero |
+--------------+--------------+--------------+--------------+ +--------------+--------------+--------------+--------------+
| OctetString (The session identifier) ... | OctetString (The session identifier) ...
+--------------+--------------+--------------+--------------+ +--------------+--------------+--------------+--------------+
| Length |AUTH DATA. | zero | | Length |AUTH DATA. | zero |
+--------------+--------------+--------------+--------------+ +--------------+--------------+--------------+--------------+
| OctetString (Authentication data) ... | OctetString (Authentication data) ...
+--------------+--------------+--------------+--------------+ +--------------+--------------+--------------+--------------+
4.1.1 Operational Setting using shared private keys 4.1.1 Operational Setting using shared symmetric keys
This assumes both the Authorizing Entity and the Network router/PDP This assumes both the Authorizing Entity and the Network router/PDP
are provisioned with shared private keys and with policies detailing are provisioned with shared symmetric keys and with policies
which algorithm to be used for computing the authentication data. detailing which algorithm to be used for computing the
authentication data along with the expected length of the
authentication data for that particular algorithm.
Key maintenance is outside the scope of this document, but Key maintenance is outside the scope of this document, but
AUTH_SESSION implementations MUST at least provide the ability to AUTH_SESSION implementations MUST at least provide the ability to
manually configure keys and their parameters locally. The key used manually configure keys and their parameters locally. The key used
to produce the authentication data is identified by the AUTH_ENT_ID to produce the authentication data is identified by the AUTH_ENT_ID
field. Each key must also be configured with lifetime parameters for field. Each key must also be configured with lifetime parameters for
the time period within which it is valid as well as an associated the time period within which it is valid as well as an associated
cryptographic algorithm parameter specifying the algorithm to be cryptographic algorithm parameter specifying the algorithm to be
used with the key. At a minimum, all AUTH_SESSION implementations used with the key. At a minimum, all AUTH_SESSION implementations
MUST support the HMAC-MD5-96 [RFC-2104][FRC-1321] cryptographic MUST support the HMAC-MD5-128 [RFC-2104][FRC-1321] cryptographic
algorithm for computing the authentication data. algorithm for computing the authentication data. New algorithms may
be added by the IETF standards process.
It is good practice to regularly change keys. Keys MUST be It is good practice to regularly change keys. Keys MUST be
configurable such that their lifetimes overlap allowing smooth configurable such that their lifetimes overlap allowing smooth
transitions between keys. At the midpoint of the lifetime overlap transitions between keys. At the midpoint of the lifetime overlap
between two keys, senders should transition from using the current between two keys, senders should transition from using the current
key to the next/longer-lived key. Meanwhile, receivers simply accept key to the next/longer-lived key. Meanwhile, receivers simply accept
any identified key received within its configured lifetime and any identified key received within its configured lifetime and
reject those that are not. reject those that are not.
4.2 Kerberos 4.2 Kerberos
skipping to change at line 680 skipping to change at page 14, line 48
+--------------+--------------+--------------+--------------+ +--------------+--------------+--------------+--------------+
| Length | AUTH_ENT_ID | KERB_P. | | Length | AUTH_ENT_ID | KERB_P. |
+--------------+--------------+--------------+--------------+ +--------------+--------------+--------------+--------------+
| OctetString (The principal@realm name) ... | OctetString (The principal@realm name) ...
+--------------+--------------+--------------+--------------+ +--------------+--------------+--------------+--------------+
4.2.1. Operational Setting using Kerberos 4.2.1. Operational Setting using Kerberos
An authorizing entity is configured to construct the AUTH_SESSION An authorizing entity is configured to construct the AUTH_SESSION
policy element that designates use of the Kerberos authentication policy element that designates use of the Kerberos authentication
method (KRB_PRINCIPAL). Upon reception of the RSVP request, the method (KRB_PRINCIPAL) as defined in RFC-1510. Upon reception of
router/PDP contacts the local KDC to request a ticket for the the resource reservation request, the router/PDP contacts the local
authorizing entity (principal@realm). The router/PDP uses the ticket KDC, with a KRB_AS_REQ message, to request credentials for the
to access the authorizing entity and obtain authentication data for authorizing entity (principal@realm). The local KDC responds with
the message. these credentials in a KRB_AS_REP message,
encrypted in the client's key. The credentials consist of 1) a
"ticket" for the server and 2) a temporary encryption key (often
called a "session key"). The router/PDP uses the ticket to access
the authorizing entity with a KRB_AP_REQ message. The session key
(now shared by the router/PDP and the authorizing entity) is used to
authenticate the router/PDP, and is used to authenticate the
authorizing entity. The session key is an encryption key and is also
used to encrypt further communication between the two parties. The
authorizing entity responds by sending a concatenated message of a
KRB_AP_REP and a KRB_SAFE. The KRB_AP_REP is used to authenticate
the authorizing entity. The KRB_SAFE message contains the
authentication data in the safe-body field. The authentication data
must be either a 16 byte MD5 hash or 20 byte SHA-1 hash of all data
in the AUTH_SESSION policy element up to the AUTHENTICATION_DATA
(note that when using Kerberos the AUTH SESSION PE should not
include AUTHENTICATION DATA as this is sent in the KRB_SAFE
message). The router/PDP independently computes the hash, and
compares it with the received hash in the user-data field of the
KRB-SAFE-BODY [RFC-1510].
At a minimum, all AUTH_SESSION implementations using Kerberos MUST
support the Kerberos des-cbc-md5 encryption type [RFC-1510](for
encrypted data in tickets and Kerberos messages) and the Kerberos
rsa-md5-des checksum type [RFC-1510] (for the KRB_SAFE checksum)
checksum. New algorithms may be added by the IETF standards process.
Triple-DES encryption is supported in many Kerberos implementations
(although not specified in [RFC-1510]), and should be used over
single DES.
For cases where the authorizing entity is in a different realm (i.e. For cases where the authorizing entity is in a different realm (i.e.
administrative domain, organizational boundary), the router/PDP administrative domain, organizational boundary), the router/PDP
needs to fetch a cross-realm Ticket Granting Ticket (TGT) from its needs to fetch a cross-realm Ticket Granting Ticket (TGT) from its
local KDC. This TGT can be used to fetch authorizing entity tickets local KDC. This TGT can be used to fetch authorizing entity tickets
from the KDC in the remote realm. Note that for performance from the KDC in the remote realm. Note that for performance
considerations, tickets are typically cached for extended periods. considerations, tickets are typically cached for extended periods.
4.3 Public Key 4.3 Public Key
skipping to change at line 718 skipping to change at page 16, line 30
+--------------+--------------+--------------+--------------+ +--------------+--------------+--------------+--------------+
| OctetString (Authorizing entity Digital Certificate) ... | OctetString (Authorizing entity Digital Certificate) ...
+--------------+--------------+--------------+--------------+ +--------------+--------------+--------------+--------------+
| Length |AUTH DATA. | zero | | Length |AUTH DATA. | zero |
+--------------+--------------+--------------+--------------+ +--------------+--------------+--------------+--------------+
| OctetString (Authentication data) ... | OctetString (Authentication data) ...
+--------------+--------------+--------------+--------------+ +--------------+--------------+--------------+--------------+
4.3.1. Operational Setting for public key based authentication 4.3.1. Operational Setting for public key based authentication
Public key based authentication assumes following: Public key based authentication assumes the following:
- Authorizing entities have a pair of keys (private key and - Authorizing entities have a pair of keys (private key and
public key). public key).
- Private key is secured with the authorizing entity. - Private key is secured with the authorizing entity.
- Public keys are stored in digital certificates and a - Public keys are stored in digital certificates and a
trusted party, certificate authority (CA) issues these trusted party, certificate authority (CA) issues these
digital certificates. digital certificates.
- The verifier (PDP or router) has the ability to verify the - The verifier (PDP or router) has the ability to verify the
digital certificate. digital certificate.
Authorizing entity uses its private key to generate Authorizing entity uses its private key to generate
AUTHENTICATION_DATA. Authenticators (router, PDP) use the AUTHENTICATION_DATA. Authenticators (router, PDP) use the
authorizing entity's public key (stored in the digital certificate) authorizing entitys public key (stored in the digital certificate)
to verify and authenticate the policy element. to verify and authenticate the policy element.
4.3.1.1 X.509 V3 digital certificates
When the AUTH_ENT_ID is of type X509_V3_CERT, AUTHENTICATION_DATA
MUST be generated following these steps:
- A Signed-data is constructed as defined in section 5 of CMS [RFC-
3369]. A digest is computed on the content (as specified in section
6.1) with a signer-specific message-digest algorithm. The digest
output is digitally signed following section 8 of RFC-2437, using
the signer's private key.
When the AUTH_ENT_ID is of type X509_V3_CERT, verification MUST be
done following these steps:
- Parse the X.509 V3 certificate to extract the distinguished name
of the issuer of the certificate.
- Certification Path Validation is performed as defined in section 6
of RFC-3280.
- Parse through the Certificate Revocation list to verify that the
received certificate is not listed.
- Once the X.509 V3 certificate is validated, the public key of the
authorizing entity can be extracted from the certificate.
- Extract the digest algorithm and the length of the digested data
by parsing the CMS signed-data.
- The recipient independently computes the message digest. This
message digest and the signer's public key are used to verify the
signature value.
This verification ensures integrity, non-repudiation and data
origin.
4.3.1.2 PGP digital certificates
When the AUTH_ENT_ID is of type PGP_CERT, AUTHENTICATION_DATA MUST
be generated following these steps:
- AUTHENTICATION_DATA contains a Signature Packet as defined in
section 5.2.3 of RFC-2440. In summary:
- Compute the hash of all data in the AUTH_SESSION policy element
up to the AUTHENTICATION_DATA.
- The hash output is digitally signed following section 8 of RFC-
2437, using the signer's private key.
When the AUTH_ENT_ID is of type PGP_CERT, verification MUST be done
following these steps:
- Parse the PGP certificate to extract the distinguished name of the
issuer of the certificate.
- Validate the certificate.
- Parse through the Certificate Revocation list to verify that the
received certificate is not listed.
- Once the PGP certificate is validated, the public key of the
authorizing entity can be extracted from the certificate.
- Extract the hash algorithm and the length of the hashed data by
parsing the PGP signature packet.
- The recipient independently computes the message digest. This
message digest and the signer's public key are used to verify the
signature value.
This verification ensures integrity, non-repudiation and data
origin.
5. Framework 5. Framework
[S-AUTH] describes a framework in which the AUTH_SESSION [S-AUTH] describes a framework in which the AUTH_SESSION
policy element may be utilized to transport information required for policy element may be utilized to transport information required for
authorizing resource reservation for media flows. [S-AUTH] authorizing resource reservation for media flows. [S-AUTH]
introduces 4 different models: introduces 4 different models:
1- the coupled model 1- the coupled model
2- the associated model with one policy server 2- the associated model with one policy server
3- the associated model with two policy servers 3- the associated model with two policy servers
4- the non-associated model. 4- the non-associated model.
The fields that are required in an AUTH SESSION policy element is The fields that are required in an AUTH SESSION policy element
dependent on which of the models is used. dependent on which of the models is used.
5.1 The coupled model 5.1 The coupled model
In the Coupled Model, the only information that MUST be included in In the Coupled Model, the only information that MUST be included in
the policy element is the SESSION ID; it is used by the Authorizing the policy element is the SESSION ID; it is used by the Authorizing
Entity to correlate the resource reservation request with the media Entity to correlate the resource reservation request with the media
authorized during session set up. Since the End Host is assumed to authorized during session set up. Since the End Host is assumed to
be untrusted, the Policy Server SHOULD take measures to ensure that be untrusted, the Policy Server SHOULD take measures to ensure that
the integrity of the SESSION ID is preserved in transit; the exact the integrity of the SESSION ID is preserved in transit; the exact
skipping to change at line 771 skipping to change at page 18, line 46
5.2 The associated model with one policy server 5.2 The associated model with one policy server
In this model, the contents of the AUTH_SESSION policy element MUST In this model, the contents of the AUTH_SESSION policy element MUST
include: include:
- A session identifier - SESSION_ID. This is information that the - A session identifier - SESSION_ID. This is information that the
authorizing entity can use to correlate the resource reservation authorizing entity can use to correlate the resource reservation
request with the media authorized during session set up. request with the media authorized during session set up.
- The identity of the authorizing entity _ AUTH_ENT_ID. This - The identity of the authorizing entity - AUTH_ENT_ID. This
information is used by the Edge Router to determine which information is used by the Edge Router to determine which
authorizing entity (Policy Server) should be used to solicit authorizing entity (Policy Server) should be used to solicit
resource policy decisions. resource policy decisions.
In some environments, an Edge Router may have no means for In some environments, an Edge Router may have no means for
determining if the identity refers to a legitimate Policy Server determining if the identity refers to a legitimate Policy Server
within its domain. In order to protect against redirection of within its domain. In order to protect against redirection of
authorization requests to a bogus authorizing entity, the authorization requests to a bogus authorizing entity, the
AUTH_SESSION MUST also include: AUTH_SESSION MUST also include:
skipping to change at line 807 skipping to change at page 19, line 33
include: include:
- Calling party IP address or Identity (e.g. FQDN) - SOURCE_ADDR S- - Calling party IP address or Identity (e.g. FQDN) - SOURCE_ADDR S-
TYPE TYPE
- Called party IP address or Identity (e.g. FQDN) - DEST_ADDR S- - Called party IP address or Identity (e.g. FQDN) - DEST_ADDR S-
TYPE TYPE
- The characteristics of (each of) the media stream(s) authorized - The characteristics of (each of) the media stream(s) authorized
for this session - RESOURCES S-TYPE for this session - RESOURCES S-TYPE
- The authorization lifetime - START_TIME S-TYPE - The authorization lifetime - START_TIME S-TYPE
- The identity of the authorizing entity to allow for validation of - The identity of the authorizing entity to allow for validation of
the token in shared private key and Kerberos schemes - the token in shared symmetric key and Kerberos schemes -
AUTH_ENT_ID S-TYPE AUTH_ENT_ID S-TYPE
- The credentials of the authorizing entity in a public-key scheme - The credentials of the authorizing entity in a public-key scheme
- AUTH_ENT_ID S-TYPE - AUTH_ENT_ID S-TYPE
- Authentication data used to prevent tampering with the - Authentication data used to prevent tampering with the
AUTH_SESSION policy element - AUTHENTICATION_DATA AUTH_SESSION policy element - AUTHENTICATION_DATA
Furthermore, the AUTH_SESSION policy element MAY contain: Furthermore, the AUTH_SESSION policy element MAY contain:
- The lifetime of (each of) the media stream(s) - END_TIME S-TYPE - The lifetime of (each of) the media stream(s) - END_TIME S-TYPE
- Calling party port number - SOURCE_ADDR S-TYPE - Calling party port number - SOURCE_ADDR S-TYPE
- Called party port number - DEST_ADDR S-TYPE - Called party port number - DEST_ADDR S-TYPE
All AUTH_SESSION fields MUST match with the resource request. If a All AUTH_SESSION fields MUST match with the resource request. If a
field does not match, the request SHOULD be denied. field does not match, the request SHOULD be denied.
6. Message Processing Rules 6. Message Processing Rules
6.1 Message Generation (RSVP Host) 6.1 Generation of the AUTH_SESSION by the authorizing entity
An RSVP message is created as specified in [RFC-2205] with following 1. Generate the AUTH_SESSION policy element with the appropriate
modifications. contents as specified in section 5.
2. If authentication is needed, the entire AUTH_SESSION policy
element is constructed, excluding the length, type and subtype
fields of the AUTH_SESSION field. Note that the message MUST include
either a START_TIME or a SESSION_ID (See Section 9), to prevent
replay attacks. The output of the authentication algorithm, plus
appropriate header information, is appended to the AUTH_SESSION
policy element.
6.2 Message Generation (RSVP Host)
An RSVP message is created as specified in [RFC-2205] with the
following modifications.
1. RSVP message MUST contain at most one AUTH_SESSION policy 1. RSVP message MUST contain at most one AUTH_SESSION policy
element. element.
2. A Session Authorization policy element (AUTH_SESSION) is created 2. The AUTH SESSION policy element received from the authorizing
and the IdentityType field is set to indicate the identity type entity (Section 3.2) MUST be copied without modification into the
in the policy element. Only the required Session Authorization POLICY DATA object.
attributes are added.
3. POLICY_DATA object (containing the AUTH_SESSION policy element) 3. POLICY_DATA object (containing the AUTH_SESSION policy element)
is inserted in the RSVP message in the appropriate place. is inserted in the RSVP message in the appropriate place.
6.2 Message Reception (Router) 6.3 Message Reception (RSVP-aware Router)
RSVP message is processed as specified in [RFC-2205] with following RSVP message is processed as specified in [RFC-2205] with following
modifications. modifications.
1. If router is policy aware then it SHOULD send the RSVP 1. If router is policy aware then it SHOULD send the RSVP
message to the PDP and wait for response. If the router is message to the PDP and wait for response. If the router is
policy unaware then it ignores the policy data objects and policy unaware then it ignores the policy data objects and
continues processing the RSVP message. continues processing the RSVP message.
2. Reject the message if the response from the PDP is negative. 2. Reject the message if the response from the PDP is negative.
3. Continue processing the RSVP message. 3. Continue processing the RSVP message.
6.3 Authorization (Router/PDP) 6.4 Authorization (Router/PDP)
1. Retrieve the AUTH_SESSION policy element. Check the PE type 1. Retrieve the AUTH_SESSION policy element. Check the PE type
field and return an error if the identity type is not supported. field and return an error if the identity type is not supported.
2. Verify the message integrity. 2. Verify the message integrity.
- Shared private key authentication: Get authorizing entity ID, - Shared symmetric key authentication: The Network
identify appropriate algorithm and shared private key for the router/PDP uses the AUTH_ENT_ID field to consult a table keyed by
authorizing entity, and validate signature. that field. The table should identify the cryptographic
authentication algorithm to be used along with the expected length
of the authentication data and the shared
symmetric key for the authorizing entity. Verify that the
indicated length of the authentication data is consistent with
the configured table entry and validate the authentication
data.
- Public Key: Validate the certificate chain against - Public Key: Validate the certificate chain against the
trusted Certificate Authority (CA) and validate the trusted Certificate Authority (CA) and validate the
message signature using the public key. message signature using the public key.
- Kerberos Ticket: If the AUTH_ENT_ID is of subtype KRB_PRINCIPAL, - Kerberos Ticket: If the AUTH_ENT_ID is of subtype KRB_PRINCIPAL,
Request a ticket for the authorizing entity (principal@realm) Request a ticket for the authorizing entity (principal@realm)
from the local KDC. Use the ticket to access the authorizing from the local KDC. Use the ticket to access the authorizing
entity and obtain authentication data for the message. entity and obtain authentication data for the message.
3. Verify the requested resources do not exceed the authorized QoS. 3. Verify the requested resources do not exceed the authorized QoS.
7. Error Signaling 7. Error Signaling
If a PDP fails to verify the AUTH_SESSION policy element then it If a PDP fails to verify the AUTH_SESSION policy element then it
MUST return a policy control failure (Error Code = 02) to the PEP. MUST return a policy control failure (Error Code = 02) to the PEP.
The error values are described in [RFC-2205] and [RFC-2750]. Also The error values are described in [RFC-2205] and [RFC-2750]. Also
the PDP SHOULD supply a policy data object containing an AUTH_DATA the PDP SHOULD supply a policy data object containing an AUTH_DATA
Policy Element with A-Type=POLICY_ERROR_CODE containing more Policy Element with A-Type=POLICY_ERROR_CODE containing more
details on the Policy Control failure [RFC-3182]. The PEP details on the Policy Control failure [RFC-3182]. If RSVP is being
MUST include this Policy Data object in the outgoing RSVP Error used, the PEP MUST include this Policy Data object in the outgoing
message. RSVP Error message.
8. IANA Considerations 8. IANA Considerations
Following the policies outlined in [IANA-CONSIDERATIONS], Standard Following the policies outlined in [IANA-CONSIDERATIONS], Standard
RSVP Policy Elements (P-type values) are assigned by IETF Consensus RSVP Policy Elements (P-type values) are assigned by IETF Consensus
action as described in [RFC-2750]. action as described in [RFC-2750].
P-Type AUTH_SESSION is assigned the value TBD-by-IANA. P-Type AUTH_SESSION is assigned the value TBD-by-IANA.
Following the policies outlined in [IANA-CONSIDERATIONS], session Following the policies outlined in [IANA-CONSIDERATIONS], session
skipping to change at line 982 skipping to change at page 23, line 30
SubType FLOW_SPEC is assigned the value 2. SubType FLOW_SPEC is assigned the value 2.
SubType SDP is assigned the value 3. SubType SDP is assigned the value 3.
SubType DSCP is assigned the value 4. SubType DSCP is assigned the value 4.
9. Security Considerations 9. Security Considerations
The purpose of this draft is to describe a mechanism for session The purpose of this draft is to describe a mechanism for session
authorization to prevent theft of service. authorization to prevent theft of service.
Replay attacks MUST be prevented. In the non-associated model, the Replay attacks MUST be prevented. In the non-associated model, the
AUTH_SESSION policy element MUST include a START_TIME field. The AUTH_SESSION policy element MUST include a START_TIME field and the
start time is used to verify that the request is not being replayed Policy Servers MUST support NTP to ensure proper clock
at a later time. In all other models, the SESSION_ID is used by the synchronization. The start time is used to verify that the request
Policy Server to ensure that the resource request successfully is not being replayed at a later time. In all other models, the
correlates with records of an authorized session. If a AUTH_SESSION SESSION_ID is used by the Policy Server to ensure that the resource
is replayed, it MUST be detected by the policy server (using request successfully correlates with records of an authorized
internal algorithms) and the request MUST be rejected. session. If a AUTH_SESSION is replayed, it MUST be detected by the
policy server (using internal algorithms) and the request MUST be
rejected.
To ensure that the integrity of the policy element is preserved in To ensure that the integrity of the policy element is preserved in
untrusted environments, the AUTHENTICATION_DATA attribute MUST be untrusted environments, the AUTHENTICATION_DATA attribute MUST be
included. included.
In order to keep the AUTH_SESSION policy element size to a strict In order to keep the AUTH_SESSION policy element size to a strict
minimum, in environments where shared private keys are possible, minimum, in environments where shared symmetric keys are possible,
they should be used. This is especially true in wireless they should be used. This is especially true in wireless
environments where the AUTH_SESSION policy element is sent over-the- environments where the AUTH_SESSION policy element is sent over-the-
air. The shared private keys authentication option MUST be supported air. The shared symmetric keys authentication option MUST be
by all AUTH_SESSION implementations. supported by all AUTH_SESSION implementations.
If shared private keys are not a valid option, the Kerberos If shared symmetric keys are not a valid option, the Kerberos
authentication mechanism is reasonably well secured and efficient in authentication mechanism is reasonably well secured and efficient in
terms of AUTH_SESSION size. The AUTH_SESSION only needs to contain terms of AUTH_SESSION size. The AUTH_SESSION only needs to contain
the principal@realm name of the authorizing entity. This is much the principal@realm name of the authorizing entity. This is much
more efficient than the PKI authentication option. more efficient than the PKI authentication option.
PKI authentication option provides a high level of security and good PKI authentication option provides a high level of security and good
scalability, however it requires the presence of credentials in the scalability, however it requires the presence of credentials in the
AUTH_SESSION policy element which impacts its size. AUTH_SESSION policy element which impacts its size.
10. Acknowledgments 10. Acknowledgments
We would like to thank Louis LeVay, Francois Audet, Don Wade, Hamid We would like to thank Francois Audet, Don Wade, Hamid Syed, Kwok Ho
Syed, Kwok Ho Chan and many others for their valuable comments. Chan and many others for their valuable comments.
In addition, we would like to thank S. Yadav, et al, for their In addition, we would like to thank S. Yadav, et al, for their
efforts on RFC 3182, as this document borrows from their work. efforts on RFC 3182, as this document borrows from their work.
11. Normative References 11. Normative References
[S-AUTH] Hamer, L.-N., Gage, B., Shieh, H., "Framework [S-AUTH] Hamer, L.-N., Gage, B., Shieh, H., "Framework
for session setup with media authorization", for session setup with media authorization",
Internet-Draft, Internet-Draft,
draft-ietf-rap-session-auth-04.txt, draft-ietf-rap-session-auth-04.txt,
skipping to change at line 1084 skipping to change at page 25, line 37
[RFC-2396] Berners-Lee, T., Fielding, R., Irvine, U.C., [RFC-2396] Berners-Lee, T., Fielding, R., Irvine, U.C.,
Masinter, L., "Uniform Resource Identifiers Masinter, L., "Uniform Resource Identifiers
(URI): Generic Syntax", RFC 2396, August (URI): Generic Syntax", RFC 2396, August
1998. 1998.
[RFC-2474] Nichols, K., Blake, S., Baker, F., Black, D., [RFC-2474] Nichols, K., Blake, S., Baker, F., Black, D.,
"Definition of the Differentiated Services "Definition of the Differentiated Services
Field (DS Field) in the IPv4 and IPv6 Field (DS Field) in the IPv4 and IPv6
Headers", RFC 2474, December 1998. Headers", RFC 2474, December 1998.
[UNICODE] The Unicode Consortium, "The Unicode [RFC-2279] Yergeau, F., "UTF-8, a transformation format
Standard,Version 2.0", Addison-Wesley, of ISO 10646", RFC 2279, January 1998.
Reading, MA, 1996.
[X.509] Housley, R., Ford, W., Polk, W. and D. Solo, [RFC-3280] Housley, R., et al., "Internet X.509 Public
"Internet X.509 Public Key Infrastructure Key Infrastructure Certificate and
Certificate and CRL Profile", RFC 2459, Certificate Revocation List (CRL) Profile",
January 1999. RFC 3280, April 2002.
[X.509-ITU] ITU-T (formerly CCITT) Information technology [X.509-ITU] ITU-T (formerly CCITT) Information technology
Open Systems Interconnection - The Directory: Open Systems Interconnection - The Directory:
Authentication Framework Recommendation X.509 Authentication Framework Recommendation X.509
ISO/IEC 9594-8 ISO/IEC 9594-8
12. Informative References [RFC-2437] Kaliski, B., Staddon, J., "PKCS #1: RSA
Cryptography Specifications Version 2.0."
RFC 2437, October 1998.
[RFC-3182] S. Yadav et al, "Identity Representation for [RFC-3369] Housley, R., "Cryptographic Message Syntax",
RFC 3369, August 2002.
[RFC-2440] Callas, J., "OpenPGP Message Format", RFC
2440, November 1998.
[RFC-3182] S. Yadav et al., "Identity Representation for
RSVP", RFC 3182, October 2001 RSVP", RFC 3182, October 2001
[RFC-2998] Bernet, Y., Ford, P., Yavatkar, R., 12. Informative References
Baker, F.,Zhang, L., Speer, M., Braden, R.,
Davie, B., Wroclawski, J., Felstaine, E., "A
Framework for Integrated Services Operation
over Diffserv Networks", RFC 2998, November
2000.
[RFC-1633] Braden, R., Clark, D., Shenker, S., [RFC-3261] Rosenberg et al., "SIP: Session Initiation
"Integrated Services in the Internet Protocol", RFC 3261, June 2002.
Architecture: An Overview", RFC 1633,
June 1994.
[IANA-CONSIDERATIONS] Alvestrand, H. and T. Narten, "Guidelines for [IANA-CONSIDERATIONS] Alvestrand, H. and T. Narten, "Guidelines for
Writing an IANA Considerations Section in Writing an IANA Considerations Section in
RFCs", BCP 26, RFC 2434, October 1998. RFCs", BCP 26, RFC 2434, October 1998.
13. Author Information 13. Author Information
Louis-Nicolas Hamer Louis-Nicolas Hamer
Nortel Networks Nortel Networks
PO Box 3511 Station C PO Box 3511 Station C
skipping to change at line 1134 skipping to change at page 26, line 35
Ottawa, Ontario Ottawa, Ontario
Canada K1Y 4H7 Canada K1Y 4H7
Phone: +1 613.768.3409 Phone: +1 613.768.3409
EMail: nhamer@nortelnetworks.com EMail: nhamer@nortelnetworks.com
Brett Kosinski Brett Kosinski
University of Alberta University of Alberta
Edmonton, Alberta Edmonton, Alberta
Canada T6G 2M7 Canada T6G 2M7
EMail: kosinski@cs.ualberta.ca EMail: kosinski@cs.ualberta.ca
Bill Gage Bill Gage
Nortel Networks Nortel Networks
PO Box 3511 Station C PO Box 3511 Station C
Ottawa, Ontario Ottawa, Ontario
Canada K1Y 4H7 Canada K1Y 4H7
Phone: +1 613.763.4400 Phone: +1 613.763.4400
EMail: gageb@nortelnetworks.com EMail: gageb@nortelnetworks.com
Matt Broda
Nortel Networks
PO Box 3511 Station C
Ottawa, Ontario
Canada K1Y 4H7
Phone: +1 613.763.7399
EMail: mbroda@nortelnetworks.com
Hugh Shieh Hugh Shieh
AT&T Wireless AT&T Wireless
7277 164th Avenue NE 7277 164th Avenue NE
Redmond, WA Redmond, WA
USA 98073-9761 USA 98073-9761
Phone: +1 425.580.6898 Phone: +1 425.580.6898
Email: hugh.shieh@attws.com Email: hugh.shieh@attws.com
14. Full Copyright Statement 14. Contributors
Matt Broda
Nortel Networks
EMail: mbroda@nortelnetworks.com
Louis LeVay
Nortel Networks
EMail: levay@nortelnetworks.com
Dennis Beard
Nortel Networks
EMail: beardd@nortelnetworks.com
Lawrence Dobranski
Nortel Networks
EMail: ldobran@nortelnetworks.com
15. Full Copyright Statement
Copyright (C) The Internet Society (2002). All Rights Reserved. This Copyright (C) The Internet Society (2002). All Rights Reserved. This
document and translations of it may be copied and furnished to document and translations of it may be copied and furnished to
others, and derivative works that comment on or otherwise explain it others, and derivative works that comment on or otherwise explain it
or assist in its implementation may be prepared, copied, published or assist in its implementation may be prepared, copied, published
and distributed, in whole or in part, without restriction of any and distributed, in whole or in part, without restriction of any
kind, provided that the above copyright notice and this paragraph kind, provided that the above copyright notice and this paragraph
are included on all such copies and derivative works. However, this are included on all such copies and derivative works. However, this
document itself may not be modified in any way, such as by removing document itself may not be modified in any way, such as by removing
the copyright notice or references to the Internet Society or other the copyright notice or references to the Internet Society or other
Internet organisations, except as needed for the purpose of Internet organisations, except as needed for the purpose of
developing Internet standards in which case the procedures for developing Internet standards in which case the procedures for
copyrights defined in the Internet Standards process must be copyrights defined in the Internet Standards process must be
followed, or as required to translate it into. followed, or as required to translate it into.
15. Notices 16. Notices
"The IETF takes no position regarding the validity or scope of "The IETF takes no position regarding the validity or scope of
any intellectual property or other rights that might be claimed any intellectual property or other rights that might be claimed
to pertain to the implementation or use of the technology to pertain to the implementation or use of the technology
described in this document or the extent to which any license described in this document or the extent to which any license
under such rights might or might not be available; neither does under such rights might or might not be available; neither does
it represent that it has made any effort to identify any such it represent that it has made any effort to identify any such
rights. Information on the IETF's procedures with respect to rights. Information on the IETF's procedures with respect to
rights in standards-track and standards-related documentation rights in standards-track and standards-related documentation
can be found in BCP-11. Copies of claims of rights made can be found in BCP-11. Copies of claims of rights made
skipping to change at line 1197 skipping to change at page 28, line 13
to obtain a general license or permission for the use of such to obtain a general license or permission for the use of such
proprietary rights by implementors or users of this proprietary rights by implementors or users of this
specification can be obtained from the IETF Secretariat." specification can be obtained from the IETF Secretariat."
"The IETF invites any interested party to bring to its "The IETF invites any interested party to bring to its
attention any copyrights, patents or patent applications, or attention any copyrights, patents or patent applications, or
other proprietary rights which may cover technology that may be other proprietary rights which may cover technology that may be
required to practice this standard. Please address the required to practice this standard. Please address the
information to the IETF Executive Director." information to the IETF Executive Director."
16. RFC Editor Considerations 17. RFC Editor Considerations
This document references an IETF Internet-Draft that is in the IESG This document references an IETF Internet-Draft that is in the IESG
last call stage. Please use the corresponding RFC number prior to last call stage. Please use the corresponding RFC number prior to
publishing of this document as a RFC. The referenced IETF I-D is publishing of this document as a RFC. The referenced IETF I-D is
[S-AUTH]. [S-AUTH].
 End of changes. 

This html diff was produced by rfcdiff 1.23, available from http://www.levkowetz.com/ietf/tools/rfcdiff/