Subject: [eap] Issue #3: No state machine

From: [email-masked] (Bryan D. Payne)
Date: Tue, 2 Apr 2002 10:45:12 -0500 (EST)

> > In this case, the authenticator could simply time
> > out and send a success / failure message.
>
> If no response is received, a timeout will occur -- but the behavior of
> existing implementations would be to drop the connection. Sending another
> packet isn't possible because RADIUS servers don't retransmit. Since the
> NAS hasn't received a response, it can't send an Access-Request to the
> RADIUS server, and therefore the connection will stall.

Hmmm...but only the new implementations would have to deal with the
timeout issue.  The old implementations would never need to worry about
that because they wouldn't be sending this new message.

However, I do see that this would lead to problems with a type of
downgrade attack.  That is, an authenticator could always run the older
version of the protocol (using just success / failure messages) if it
wanted to do something malicous.  Backwards compatibility can certainly be
a pain sometimes... ;-)

> I think the issue is not with silent discard, but in the fact the
> retransmission behavior.

Perhaps the original idea (making these new messages part of the normal
request / reply structure) is still the best for backwards compatibility.
I'll think about how this can be represented in the state machine.

-bryan