Subject: [eap] Re: eap digest, Vol 1 #412 - 7 msgs

From: Bernard Aboba <[email-masked]>
Date: Tue, 16 Sep 2003 05:30:46 -0700 (PDT)

> ****	  ii) upon failure to verify - ????
>
>        b) an EAP-Response/Sim/Challenge
> 	  i) verify AT-MAC. If valid, transition to 3) SUCCESS.
> ****	  ii) If AT-MAC failes then ????
>
> ****   c) an EAP/Identity message. Transition to 1) START ????
>
>        d) OTHER MESSAGES - unsure. Drop?

I believe that dropping all but an EAP-Response/Sim/Challenge is the
appropriate thing, given RFC 2284bis.  Even EAP-Response/Identity should
be dropped.

>   3) SUCCESS
>
>   The transition into the SUCCESS state will result in an EAP-Success
>   message being sent.
>
>   When in state SUCCESS, receipt of any message results in a transition
>   back to (0).

I don't believe this is correct.  For example, an EAP-Request should be
handled as per RFC 3579.

_______________________________________________
eap mailing list
[email-masked]
http://mail.frascone.com/mailman/listinfo/eap

---

From: Michael Richardson <[email-masked]>
Date: Sun, 21 Sep 2003 13:00:57 -0400

-----BEGIN PGP SIGNED MESSAGE-----

>>>>> "Bernard" == Bernard Aboba <[email-masked]> writes:

    Bernard> I believe that dropping all but an EAP-Response/Sim/Challenge is
    Bernard> the 
    Bernard> appropriate thing, given RFC 2284bis.  Even
    Bernard> EAP-Response/Identity should 
    Bernard> be dropped.

  I'm not convinced, given:
      1) radius puts the responsability on the "NAS" to retransmit.
      2) EAP puts the responsonability on the authenticator to retransmit.

  I have to read the EAP-state machine document though.

    >> When in state SUCCESS, receipt of any message results in a transition

    Bernard> I don't believe this is correct.  For example, an EAP-Request
    Bernard> should be 
    Bernard> handled as per RFC 3579.

  okay. My opinion, as an implementor who came to this topic relatively
cold a month ago, is that either EAP-SIM is plug-in actions to another state
machine, or it documents a state machine itself. 
  Either way, section 5 needs massive revisions.

]      Out and about in Ottawa.    hmmm... beer.                |  firewalls  [
]   Michael Richardson, Sandelman Software Works, Ottawa, ON    |net architect[
] [email-masked] http://www.sandelman.ottawa.on.ca/ |device driver[
] panic("Just another Debian/notebook using, kernel hacking, security guy");  [