Subject: [AAA-WG]: Issue 214: Unknown-User Result-Code provides too much info

From: Pat Calhoun <[email-masked]>
Date: Thu, 25 Oct 2001 17:32:14 -0700

Submitter name: Pat Calhoun
Submitter email address: [email-masked] 
Date first submitted: 25-Oct-01 
Reference:  
Document: base
Comment type: Technical 
Priority: 1
Section: 7.1
Rationale/Explanation of issue: 

Some text should be provided in the Result-Code value to state that
an alternative is to use Authentication-Failure. It is felt that Unknown
User provides too much info, and could lead to certain types of attacks.

---

From: Pat Calhoun <[email-masked]>
Date: Tue, 30 Oct 2001 04:28:14 -0800

All,

I modified the text to read as follows:

      DIAMETER_USER_UNKNOWN              5001
         A request was received for a user that is unknown, therefore
         authentication and/or authorization failed. Implementations may
         wish to use DIAMETER_AUTHENTICATION_REJECTED instead of this
         Result-Code value, since it is felt that returning an error 
         stating that a user is unknown may be providing too much 
         information to malicious users.

Comments welcomed,

PatC

---

From: Barney Wolff <[email-masked]>
Date: Tue, 30 Oct 2001 09:04:26 -0500

I'd undefine the error code altogether.  It invites a very poor
security practice even while warning against it.  The server can
always put something in its own logs that helps debugging without
compromising security.

-- 
Barney Wolff

"Nonetheless, ease and peace had left this people still curiously tough.
They were, if it came to it, difficult to daunt or to kill; and they were,
perhaps, so unwearyingly fond of good things not least because they could,
when put to it, do without them, and could survive rough handling by grief,
foe, or weather in a way that astonished those who did not know them well
and looked no further than their bellies and their well-fed faces." J.R.R.T.