Subject: RE: [eap] Issue 213: Cleanup issues

From: Bernard Aboba <[email-masked]>
Date: Sun, 1 Feb 2004 15:12:27 -0800 (PST)

> [Joe] Here again we have a mix of authentication and authorization.  It
> would be better to qualify the above statement.
>
> "Protected result indications
> A method provides result indications if after the
> method has finished:
>
> 1) When peer successfully completes the authentication, it
> knows whether the authenticator has successfully completed the
> authentication.
>
> 2) When the authenticator successfully completes the authentication, it
> knows whether the peer has successfully completed the authentication.

What about failure indications?

> In the case where successful authentication is sufficient to authorize
> access then the peer and authenticator will also know if the other party
> is willing to provide or accept access.  This may not always be the
> case."

I don't think this is compatible with Section 4.2, which says:

      As described in Section 2.1, only a single EAP authentication
      method is allowed within an EAP conversation. EAP methods MAY
      implement protected result indications. After the authenticator
      sends a method-specific failure indication to the peer, regardless
      of the response from the peer, it MUST subsequently send a Failure
      packet.  After the authenticator sends a method-specific success
      indication to the peer, and receives a method-specific success
      indication from the peer, it MUST subsequently send a Success
      packet.

      On the peer, once the method completes unsuccessfully (that is,
      either the authenticator sends a method-specific failure
      indication, or the peer decides that it does want to continue the
      conversation, possibly after sending a method-specific failure
      indication), the peer MUST terminate the conversation and indicate
      failure to the lower layer.  The peer MUST silently discard
      Success packets and MAY silently discard Failure packets.  As a
      result, loss of a Failure packet need not result in a timeout.

      On the peer, after protected successful result indications have
      been exchanged by both sides, a Failure packet MUST be silently
      discarded.  The peer MAY, in the event that an EAP Success is not
      received, conclude that the EAP Success packet was lost and that
      authentication concluded successfully.
_______________________________________________
eap mailing list
[email-masked]
http://mail.frascone.com/mailman/listinfo/eap

---

From: "Joseph Salowey" <[email-masked]>
Date: Sun, 1 Feb 2004 19:56:49 -0800

> -----Original Message-----
> From: Bernard Aboba [mailto:[email-masked]] 
> Sent: Sunday, February 01, 2004 3:12 PM
> To: Joseph Salowey
> Cc: [email-masked]
> Subject: RE: [eap] Issue 213: Cleanup issues
> 
> 
> > [Joe] Here again we have a mix of authentication and 
> authorization.  
> > It would be better to qualify the above statement.
> >
> > 1) When peer successfully completes the authentication, it knows 
> > whether the authenticator has successfully completed the 
> > authentication.
> >
> > 2) When the authenticator successfully completes the 
> authentication, 
> > it knows whether the peer has successfully completed the 
> > authentication.
> 
[Joe] Failure indications are harder to protect, but if the peer or
authenticator receives a protected failure message that it can verify
then it should assume that the authentication has not successfully
completed.  

> > access then the peer and authenticator will also know if the other 
> > party is willing to provide or accept access.  This may not 
> always be 
> > the case."
> 
[Joe] Which part is incompatible?