Subject: Re: (radius) Tagged attribute question

From: Aydin Edguer <[email-masked]>
Date: Wed, 14 Apr 1999 13:46:47 -0400 (EDT)

> > But if we're going to say the tag byte should always be present in Tunnel-
> > Password, we should make it zero when not used.
> 
> OK.

No!  Please don't!!  The whole point behind the "no tags" is backwards
compatibility.  If an implementation does not support tags at all, then
the attributes should have no tag field.  For an integer attribute,
this would make that the location in the attribute, where the TAG would
normally reside, have a value of zero.  For a string attribute, it would
be the first octet of the string.

If an implementation supports tags then it must use a valid non-zero
value for the tag - 0x01 - 0x1F.  Any values outside this range are
used to denote the lag of TAG support.  This is the reason why the
most significant bit (leftmost) of the Salt field MUST be set (1).
It guarantees that a salt cannot be mistaken for a TAG.
-
To unsubscribe, email [email-masked]' with
'unsubscribe ietf-radius' in the body of the message.

---

From: "Glen Zorn" <[email-masked]>
Date: Wed, 14 Apr 1999 11:42:17 -0700

> be the first octet of the string.

Yes.

> It guarantees that a salt cannot be mistaken for a TAG.

Mu understanding of Barney's proposal was that if the Tag field is always
present in the Tunnel-Password Attribute, just say it's zero if not used.
This seems to be reasonable.  Are people treating the Tag field the same in
Tunnel-Password as in integer attributes (i.e., it disappears)?  If so, then
this obviously doesn't work.  BTW, I thought that his remarks dealt _only_
w/the Tunnel-Password attribute.

-