Subject: RE: [AAA-WG]: Wrapping up Diameter EAP...

From: <[email-masked]>
Date: Mon, 17 May 2004 18:27:49 +0300

Yoshihiro Ohba wrote :
> 
> I have a couple of issues when the State attribute/AVP is used for
> handling the reset operation:
> 
> - What the Diameter EAP client (i.e., the NAS) should do when EAP is
> reset while it has an outstanding DER?  (a) Can the Diameter EAP
> client immediately send a new DER used for restarting EAP conversation
> without waiting for a DEA for the outstanding DER, or (b) Should the
> Diameter EAP client wait for a DEA for the outstanding DER before
> sending a new DER used for restarting EAP conversation?

This seems to be related to the question when the NAS should
pick a new Session-Id... I think that at least (a) with a new 
Session-Id would be one reasonable choice.

But is (a) with the same Session-Id ok? The state machine
in RFC3588 doesn't seem to consider multi-round authentication
at all, so it's not very clear...

> - In the case of a), it might be possible that the Diameter EAP client
> receives a DEA for the previously outstanding DER after it has sent a
> new DER used for restarting EAP conversation.  How can the Diameter
> EAP client distinguish between the DEA for the previously outstanding
> DER and the DEA for the new DER?

Even if the same Session-Id was used, the "Hop-by-hop Identifier" 
in the Diameter header can match responses to requests.

Best regards,
Pasi

---

From: Yoshihiro Ohba <[email-masked]>
Date: Mon, 17 May 2004 10:01:11 -0700

> Session-Id would be one reasonable choice.

With using a new Session-Id how the EAP server can choose which EAP
session to restart (I guess a State AVP should be included in the DER
that is used for restarting the EAP conversation for this purpose)?

> at all, so it's not very clear...

That is true even during the normal EAP conversation.  For example,
Open Diameter implementation came up with modifying the Diameter
session state machine to deal with multi-round authentication 
(we realized this after RFC3588 has been issued).

> in the Diameter header can match responses to requests.

OK.

Yoshihiro Ohba