Subject: [eap] Re: Issue 131: Lower Layer Success Indications

From: [email-masked] (Bernard Aboba)
Date: Tue, 13 May 2003 06:02:08 -0700 (PDT)

The question is in what circumstances a peer is willing to accept a
Success message.

I think that includes any one-way method after completion of the method;
and any mutually authenticating method after the peer has authenticated
the authenticator. However, we're already covering the latter case in
Section 4.2.

So the question is whether we want to make this change purely to benefit
one-way methods. The problem is that the implementation survey disclosed
that none of the implementations surveyed implemented lower
layer success indications as described in RFC 2284.  Unless we've got
implementations that are willing to do this, I'm not sure that it makes a
difference.

-----------------------------------------------------------
Issue 131: Lower layer success indications
Submitter name: Pasi Eronen
Submitter email address: [email-masked]
Date first submitted: May 13, 2003
Reference:
Document: EAP-02
Comment type: T
Priority: S
Section: 3.4
Rationale/Explanation of issue:
Lower layer success indications could (or even
should) be processed in some circumstances (when the peer would
be willing to accept an EAP Success message).

In Section 3.4, Change:

"Lower layer failure indications provided to EAP by the lower layer
MUST be processed and will cause an EAP exchange in progress to be
aborted. However, lower layer success indications MUST NOT affect EAP
message processing so that an EAP implementation MUST NOT conclude
that authentication has succeeded based on those indications."

To:

   "If a peer receives a lower layer success indication when it
   would be willing to accept an EAP Success message, it MAY
   conclude that the Success message was lost, and behave as it
   had received a Success message. In all other circumstances,
   lower layer success indications MUST NOT affect EAP message
   processing."

(Or should that MAY be a SHOULD?)