Subject: [radext] #153: Section 2.8 Access-Info

From: "radext issue tracker" <[email-masked]>
Date: Sat, 04 May 2013 22:52:17 -0000

#153: Section 2.8 Access-Info

 The Access-Info Attribute is utilized by implementations of
       IEEE-802.1X [IEEE-802.1X] to specify the Access status information
       field within an Access Information Type Length Value Tuple (TLV)
       to be sent to the user within MACsec Key Agreement (MKA) or EAPoL-
       Announcement frames.

       A single Access-Info Attribute is permitted within a RADIUS
       Access-Accept, Access-Challenge, Access-Reject or Accounting-
       Request packet.

 [BA] The above paragraph seems to imply that the Access-Info Attribute
 could cause the Access status information to change during and after
 authentication.  It is unclear how supplicants would respond to such a
 change.  For example, the potential response to a change in MKA (which is
 authenticated) could be quite different from a change in an EAPoL-
 Announcement frame (which is not).  As a result, the desired behavior is
 unclear.

-- 
-------------------------------------+-------------------------------------
 Reporter:                           |      Owner:  draft-ietf-radext-
  [email-masked]          |  [email-masked]
     Type:  defect                   |     Status:  new
 Priority:  critical                 |  Milestone:  milestone1
Component:  ieee802ext               |    Version:  1.0
 Severity:  In WG Last Call          |   Keywords:
-------------------------------------+-------------------------------------

Ticket URL: <http://wiki.tools.ietf.org/wg/radext/trac/ticket/153>
radext <http://tools.ietf.org/radext/>

---

From: "Joseph Salowey (jsalowey)" <[email-masked]>
Date: Tue, 7 May 2013 00:26:51 +0000

> Announcement frame (which is not).  As a result, the desired behavior is

[Joe]  The EAPoL-announcement may be protected with MACSEC if a connectivity association exists.   IEEE-802.1X-2010 specifies that the access status information in section 10.1.  Do you think it is within our scope to specify something in addition to this?