Subject: [AAA-WG]: [issue] Increase randomness of Session-Id to 64 bits

From: Paul Funk <[email-masked]>
Date: Sat, 26 May 2001 21:18:10 -0400

Submitter name: Paul Funk 
Submitter email address: [email-masked] 
Date first submitted: May, 20001 
Reference: 
Document: Base 
Comment Type: Technical 
Priority: ?
Section: 10.3 
Rationale/Explanation of issue: 

A 32 bit monotonically increasing value is not sufficient to guarantee 
uniqueness of Session-Id, especially if a starting value is randomly 
selected at startup. Also, Session-Id ought to be unique for longer 
than the lifetime of the session, since it will have to be used to match 
up historical authorization and accounting information.

Requested change:

Basically, make the monotonically increasing value 64 bits rather 
than 32 bits.

Note that I went beyond what was discussed at the interim meeting in 
the language below, specifying that the FQDN part of Session-ID is a 
MUST, rather than a SHOULD. Session-Ids generated by different 
devices have to be distinguishable, hence the MUST. I also added 
semicolon delimiters, to guarantee that ambiguity cannot result from 
FQDN followed immediately by some numeric value.

Suggested language:

The Session-Id MUST be globally and eternally unique, as it is meant 
to uniquely identify a user session without reference to any other 
information, and may be needed to correlate historical authentication 
information with accounting information. The Session-Id includes a 
mandatory portion and an implementation-defined portion; a recommended 
format for the implementation-defined portion is outlined below.

The Session-Id MUST begin with the client FQDN. If the client uses a 
non-standard authorization port, the FQDN MUST be followed by a colon 
(:) and the port number. The next character MUST be a semicolon (;). 
The remainder of the Session-Id MAY be any sequence that the client can 
guarantee to be eternally unique; however, the following format is 
recommended, (square brackets [] indicate an optional element):

<client FQDN>[:<port>];<high 32 bits>;<low 32 bits>[;<optional value>]

<high 32 bits> and <low 32 bits> are decimal representations of the high 
and low 32 bits of a monotonically increasing 64-bit value. The 64-bit 
value is rendered in two part to simplify formatting by 32-bit processors. 
At startup, the high 32 bits of the 64-bit value MAY be initialized to the 
time, and the low 32 bits MAY be initialized to 0. This will for 
practical purposes eliminate the possibility of overlapping Session-Ids 
after a reboot, assuming the reboot process takes longer than a second.
Alternatively, an implementation MAY keep track of the increasing value 
in non-volatile memory.

<optional value> is implementation specific but may include a modem's 
device Id, a layer 2 address, timestamp, etc.

Example, in which the standard port is used and there is no optional 
value:

accesspoint7.acme.com;1876543210;523

Example, in which a non-standard port is used and there is an optional 
value:

accesspoint7.acme.com:831;1876543210;523;[email-masked]

Paul

Paul Funk
Funk Software, Inc.
617 497-6339
[email-masked]