Subject: two questions about PAP

From: "Kendall, Greg" <[email-masked]>
Date: Wed, 16 Aug 2000 10:56:51 -0700

In the following interaction:

	PAP AUTH_REQ(ID 1)----------------------->

	time out
	PAP AUTH_REQ(ID 2)----------------------->

> 		  <-------------------------------PAP AUTH_ACK (ID 1)
> 
Should the ID have been incremented in the timeout retransmission?

Should the AUTH_ACK with the previous ID be ignored or accepted?

Thanks for your comments.

---

From: James Carlson <[email-masked]>
Date: Wed, 16 Aug 2000 14:00:16 -0400 (EDT)

> Should the ID have been incremented in the timeout retransmission?

Yes.  RFC 1334 states this as a "MUST."

> Should the AUTH_ACK with the previous ID be ignored or accepted?

It might be ignored, but I wouldn't be unhappy with an implementation
that accepted it.  PAP Authenticate-Ack means only that the peer is
happy with your identity.  There's no reason to be picky about this
message or to torture your peer with repeated PAP Authenticate-Request
messages as long as one was accepted.  There's no reduction in
security caused by proceeding at this point.

-- 
James Carlson, Internet Engineering       <[email-masked]>
SUN Microsystems / 1 Network Drive         71.234W   Vox +1 781 442 2084
MS UBUR02-212 / Burlington MA 01803-2757   42.497N   Fax +1 781 442 1677
"PPP Design and Debugging" --- http://people.ne.mediaone.net/carlson/ppp