Subject: [eap] rfc2284bis-08: identity requery

From: [email-masked] (James Carlson)
Date: Thu, 2 Jan 2003 07:48:15 -0500

The Identity description limits usage such that this message cannot be
sent in the "middle of another method."  Since EAP itself isn't
stateful in this way -- there's no indication on the wire of whether
the authenticator is in the "middle" of a method or has suddenly
decided to start over from the beginning -- this restriction doesn't
appear to help, and does hurt.

Submitter name: James Carlson
Submitter email address: [email-masked].
Date first submitted: January 2, 2003
Document: RFC2284bis
Comment type: T
Priority: 1
Section: 5.1
Rationale/Explanation of issue: 

The restriction doesn't appear to be warranted.  There's no visible
difference between, for example, an authenticator suddenly deciding to
start authentication over because the current method cannot proceed
(which should be allowed), and sending an Identity message in the
"middle" of a method (which has been proscribed).  Since there's no
distinction, the requirements can't be different.

Requested change: 

from:

   The Identity Type is used to query the identity of the Peer. The
   Authenticator will typically issue this as the initial Request;
   however, an Identity Request MAY also be sent multiple times within a
   sequence of methods. An Identity Request MUST NOT be sent in the
   middle of another method conversation.

to:

   The Identity Type is used to query the identity of the Peer. The
   Authenticator will typically issue this as the initial Request;
   however, an Identity Request MAY be sent at any time.

-- 
James Carlson, Solaris Networking         <[email-masked]>
Sun Microsystems / 1 Network Drive         71.234W   Vox +1 781 442 2084
MS UBUR02-212 / Burlington MA 01803-2757   42.497N   Fax +1 781 442 1677