Subject: [AAA-WG]: NASREQ Chap Changes

From: Pat Calhoun <[email-masked]>
Date: Mon, 27 Aug 2001 14:29:38 -0700

Following the thread earlier this week (or last week), here is my proposed
text:

3.1.1.2  CHAP-Auth AVP

   The CHAP-Auth AVP (AVP Code 409) is of type Grouped and contains
   the information necessary to authenticate a user using the
   PPP Challenge-Handshake Authentication Protocol (CHAP) [6]. If the
   CHAP-Auth AVP is found in a message, the CHAP-Challenge AVP (see
   section 3.1.1.6) MUST be present as well. The AVP containing the
   CHAP response depends upon the value of the CHAP-Algorithm AVP (see
   section 3.1.1.4 for more info). Its Data field has the following 
   ABNF grammar:

      CHAP-Auth  ::= < AVP Header: 409 >
                     { CHAP-Algorithm }
                     { CHAP-Ident }
                     [ CHAP-Response ]
                     [ AVP ]

3.1.1.3  CHAP-Ident AVP

   The CHAP-Ident AVP (AVP Code 410) is of type OctetString and 
   contains the one octet CHAP Identifier used in the computation
   of the CHAP response [6].

3.1.1.4  CHAP-Algorithm AVP

   The CHAP-Algorithm AVP (AVP Code 412) is of type Enumerated and 
   contains the algorithm identifier used in the computation of
   the CHAP response [6]. The following values are currently 
   supported:

      CHAP with MD5       5
         The CHAP response is computed using the procedure decribed in [6].
         The CHAP-Response AVP MUST be present in the CHAP-Auth AVP. 

3.1.1.5  CHAP-Response AVP

   The CHAP-Response AVP (AVP Code 411) is of type OctetString and 
   contains the 16 octet authentication data provided by the user
   in response to the CHAP challenge [16]. The actual computation of
   the CHAP response can be found in [6].

3.1.1.6  CHAP-Challenge AVP

   The CHAP-Challenge AVP (AVP Code 60) is of type OctetString and contains the
   CHAP Challenge sent by the NAS to a PPP Challenge-Handshake
   Authentication Protocol (CHAP) [6] user.

Comments welcomed!

Thanks,

PatC

---

From: Pat Calhoun <[email-masked]>
Date: Mon, 27 Aug 2001 14:55:14 -0700

Same e-mail as previously, but there was no issue open to handle this. 
I have formally opened issue 146.

PatC

---

From: James Carlson <[email-masked]>
Date: Tue, 28 Aug 2001 08:51:04 -0400 (EDT)

> >       CHAP-Auth  ::= < AVP Header: 409 >

This implies that the CHAP-Algorithm AVP is required, right?  That
might be too strong -- if I'm missing the CHAP-Ident, I know I can't
process anything correctly, and it's therefore an error, but if I'm
missing CHAP-Algorithm, I can reasonably assume 05 (MD5) and allow
others to fail on the hash validation.

(Requiring it is probably not a big deal, either ...)

-- 
James Carlson, Solaris Networking         <[email-masked]>
SUN Microsystems / 1 Network Drive         71.234W   Vox +1 781 442 2084
MS UBUR02-212 / Burlington MA 01803-2757   42.497N   Fax +1 781 442 1677