Subject: Re: [Dime] FW: [Editorial Errata Reported] RFC4072 (2317)

From: "Glen Zorn" <[email-masked]>
Date: Thu, 1 Jul 2010 14:10:29 +0700

Dan Romascanu [mailto://[email-masked]] writes:

> Dime WG,
> 
> Please assess this errata report.
> 
> If I understand well then Souheil's observation is that more
> Accounting-EAP-Auth-Method AVPs can be included. This seems more like a
> Technical errata, which if accepted can create interoperability problems
> with existing deployment. Am I correct?

I think that your understanding is correct, but the errata makes no sense to
me: AFAIK, only one EAP method can be used in authenticating a user (EAP
methods cannot be chained) & even if they could (as proposed for the new
tunneled EAP method under development in EMU), the structure of the Diameter
EAP app mirrors that of EAP (request/response).  Two EAP methods cannot be
operational simultaneously, so why would two method identifiers need to be
in the same Diameter message?

> 
> Thanks and Regards,
> 
> Dan
> 
> -----Original Message-----
> From: RFC Errata System [mailto:[email-masked]]
> Sent: Thursday, July 01, 2010 7:31 AM
> To: [email-masked]; [email-masked]; [email-masked];
> Romascanu, Dan (Dan); [email-masked]; [email-masked];
> [email-masked]; [email-masked]
> Cc: [email-masked]; [email-masked]
> Subject: [Editorial Errata Reported] RFC4072 (2317)
> 
> 
> The following errata report has been submitted for RFC4072, "Diameter
> Extensible Authentication Protocol (EAP) Application".
> 
> --------------------------------------
> You may review the report below and at:
> http://www.rfc-editor.org/errata_search.php?rfc=4072&eid=2317
> 
> --------------------------------------
> Type: Editorial
> Reported by: Souheil Ben Ayed <[email-masked]>
> 
> Section: 3.2.
> 
> Original Text
> -------------
>       <Diameter-EAP-Answer> ::= < Diameter Header: 268, PXY >
> 
>                                 < Session-Id >
> 
>                                 { Auth-Application-Id }
> 
>                                 { Auth-Request-Type }
> 
>                                 { Result-Code }
> 
>                                 { Origin-Host }
> 
>                                 { Origin-Realm }
> 
>                                 [ User-Name ]
> 
>                                 [ EAP-Payload ]
> 
>                                 [ EAP-Reissued-Payload ]
> 
>                                 [ EAP-Master-Session-Key ]
> 
>                                 [ EAP-Key-Name ]
> 
>                                 [ Multi-Round-Time-Out ]
> 
>                                 [ Accounting-EAP-Auth-Method ]
> 
>                                 [ Service-Type ]
> 
> Corrected Text
> --------------
>       <Diameter-EAP-Answer> ::= < Diameter Header: 268, PXY >
> 
>                                 < Session-Id >
> 
>                                 { Auth-Application-Id }
> 
>                                 { Auth-Request-Type }
> 
>                                 { Result-Code }
> 
>                                 { Origin-Host }
> 
>                                 { Origin-Realm }
> 
>                                 [ User-Name ]
> 
>                                 [ EAP-Payload ]
> 
>                                 [ EAP-Reissued-Payload ]
> 
>                                 [ EAP-Master-Session-Key ]
> 
>                                 [ EAP-Key-Name ]
> 
>                                 [ Multi-Round-Time-Out ]
> 
>                               * [ Accounting-EAP-Auth-Method ]
> 
>                                 [ Service-Type ]
> 
> Notes
> -----
> When one or more EAP methods used for authenticating the user, for each
> used EAP method an Accounting-EAP-Auth-Method AVP is added in the
> Diameter-EAP-Answer with a successful result code. In the message format
> of Diameter-EAP-Answer, one or more Accounting-EAP-Auth-Method AVPs can
> be included.
> 
> Instructions:
> -------------
> This errata is currently posted as "Reported". If necessary, please use
> "Reply All" to discuss whether it should be verified or rejected. When a
> decision is reached, the verifying party (IESG) can log in to change the
> status and edit the report, if necessary.
> 
> --------------------------------------
> RFC4072 (draft-ietf-aaa-eap-10)
> --------------------------------------
> Title               : Diameter Extensible Authentication Protocol (EAP)
> Application
> Publication Date    : August 2005
> Author(s)           : P. Eronen, Ed., T. Hiller, G. Zorn
> Category            : PROPOSED STANDARD
> Source              : Authentication, Authorization and Accounting
> Area                : Operations and Management
> Stream              : IETF
> Verifying Party     : IESG
> _______________________________________________
> DiME mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dime

---

From: Souheil Ben Ayed <[email-masked]>
Date: Thu, 01 Jul 2010 18:23:58 +0900

Dear all,

Please read the section " 2.7.  Accounting" of the RFC 4072.

In this section, it is described that one or more
Accounting-EAP-Auth-Method AVPs may be added in a Diameter-EAP-Answer
with a successful result code.

So what is correct ?

- Allow adding one or more Accounting-EAP-Auth-Method AVPs?

- or only one Accounting-EAP-Auth-Method AVP can be included in a
Diameter-EAP-Answer?

Souheil Ben Ayed

Glen Zorn wrote:

Dime WG,

Thanks and Regards,

Dan

-----Original Message-----
From: RFC Errata System [mailto:[email-masked]]
Sent: Thursday, July 01, 2010 7:31 AM
To: [email-masked]; [email-masked]; [email-masked];

Section: 3.2.

Original Text
-------------

< Session-Id >

{ Auth-Application-Id }

{ Auth-Request-Type }

{ Result-Code }

{ Origin-Host }

{ Origin-Realm }

[ User-Name ]

[ EAP-Payload ]

[ EAP-Reissued-Payload ]

[ EAP-Key-Name ]

[ Multi-Round-Time-Out ]

[ Service-Type ]

Corrected Text
--------------

< Session-Id >

{ Auth-Application-Id }

{ Auth-Request-Type }

{ Result-Code }

{ Origin-Host }

{ Origin-Realm }

[ User-Name ]

[ EAP-Payload ]

[ EAP-Reissued-Payload ]

[ EAP-Key-Name ]

[ Multi-Round-Time-Out ]

[ Service-Type ]

Notes
-----

Instructions:
-------------

---

From: Souheil Ben Ayed <[email-masked]>
Date: Thu, 01 Jul 2010 17:52:32 +0900

Dear all,

So what is correct ?

Souheil

Glen Zorn wrote:

Dime WG,

Thanks and Regards,

Dan

-----Original Message-----
From: RFC Errata System [mailto:[email-masked]]
Sent: Thursday, July 01, 2010 7:31 AM
To: [email-masked]; [email-masked]; [email-masked];

Section: 3.2.

Original Text
-------------

< Session-Id >

{ Auth-Application-Id }

{ Auth-Request-Type }

{ Result-Code }

{ Origin-Host }

{ Origin-Realm }

[ User-Name ]

[ EAP-Payload ]

[ EAP-Reissued-Payload ]

[ EAP-Key-Name ]

[ Multi-Round-Time-Out ]

[ Service-Type ]

Corrected Text
--------------

< Session-Id >

{ Auth-Application-Id }

{ Auth-Request-Type }

{ Result-Code }

{ Origin-Host }

{ Origin-Realm }

[ User-Name ]

[ EAP-Payload ]

[ EAP-Reissued-Payload ]

[ EAP-Key-Name ]

[ Multi-Round-Time-Out ]

[ Service-Type ]

Notes
-----

Instructions:
-------------

---

From: "Glen Zorn" <[email-masked]>
Date: Thu, 1 Jul 2010 16:58:31 +0700

Souheil Ben Ayed [mailto:[email-masked]] writes:

Dear all,

In this section, it is described that one or more
Accounting-EAP-Auth-Method AVPs may be added in a Diameter-EAP-Answer with a
successful result code.

So what is correct ?

The latter, I think.

Souheil

Glen Zorn wrote: 

Dime WG,

 

Thanks and Regards,
 
Dan
 
-----Original Message-----
From: RFC Errata System [mailto:[email-masked]]
Sent: Thursday, July 01, 2010 7:31 AM
To: [email-masked]; [email-masked]; [email-masked];

--------------------------------------
You may review the report below and at:
http://www.rfc-editor.org/errata_search.php?rfc=4072
<http://www.rfc-editor.org/errata_search.php?rfc=4072&eid=2317> &eid=2317
 
--------------------------------------
Type: Editorial
Reported by: Souheil Ben Ayed  <mailto:[email-masked]>
<[email-masked]>
 
Section: 3.2.
 
Original Text
-------------
 
                                < Session-Id >
 
                                { Auth-Application-Id }
 
                                { Auth-Request-Type }
 
                                { Result-Code }
 
                                { Origin-Host }
 
                                { Origin-Realm }
 
                                [ User-Name ]
 
                                [ EAP-Payload ]
 
                                [ EAP-Reissued-Payload ]

                                [ EAP-Key-Name ]
 
                                [ Multi-Round-Time-Out ]

                                [ Service-Type ]
 
Corrected Text
--------------
 
                                < Session-Id >
 
                                { Auth-Application-Id }
 
                                { Auth-Request-Type }
 
                                { Result-Code }
 
                                { Origin-Host }
 
                                { Origin-Realm }
 
                                [ User-Name ]
 
                                [ EAP-Payload ]
 
                                [ EAP-Reissued-Payload ]

                                [ EAP-Key-Name ]
 
                                [ Multi-Round-Time-Out ]

                                [ Service-Type ]
 
Notes
-----
 
Instructions:
-------------

---

From: Souheil Ben Ayed <[email-masked]>
Date: Fri, 02 Jul 2010 17:50:53 +0900

> - or only one Accounting-EAP-Auth-Method AVP can be included in a 
When only one Accounting-EAP-Auth-Method AVP is included in a 
Diameter-EAP-Answer, which EAP method will be included in this AVP in 
the case of an authentication with EAP-TTLS/EAP-MD5, EAP-TTLS/EAP-TLS or 
any other EAP method that creates a tunnel then authenticates the user 
with a second EAP method? Should we include only the first used EAP 
method (in this case EAP-TTLS Type 21), or the second EAP method used 
for the authentication ?

Souheil
>     To: [email-masked] <mailto:[email-masked]>; [email-masked] <mailto:[email-masked]>; [email-masked] <mailto:[email-masked]>;
>
>     Romascanu, Dan (Dan); [email-masked] <mailto:[email-masked]>; [email-masked] <mailto:[email-masked]>;
>
>     [email-masked] <mailto:[email-masked]>; [email-masked] <mailto:[email-masked]>
>
>     Cc: [email-masked] <mailto:[email-masked]>; [email-masked] <mailto:[email-masked]>
>
>     http://www.rfc-editor.org/errata_search.php?rfc=4072&eid=2317 <http://www.rfc-editor.org/errata_search.php?rfc=4072&eid=2317>
>
>      
>
>     Reported by: Souheil Ben Ayed <[email-masked]> <mailto:[email-masked]>
>
>      
>
>     Section: 3.2.
>
>      
>
>     Original Text
>
>     -------------
>
>     [email-masked] <mailto:[email-masked]>
>
> [email-masked] <mailto:[email-masked]>

---

From: Souheil Ben Ayed <[email-masked]>
Date: Fri, 02 Jul 2010 17:22:59 +0900

Souheil