Subject: [eap] Issue 62: Protected success/failure

From: [email-masked] (Bernard Aboba)
Date: Wed, 8 Jan 2003 06:52:19 -0800 (PST)

I've created a new issue to deal with this particular problem, which was
formerly part of Issue 58. We will need to deal with it when the section
that it refers to is rewritten from scratch (in progress), but there is no
proposed fix at the moment.

---------------------------------------------------------------------
Issue 62: Protected success/failure
Submitter name: Jesse Walker
Submitter email address: [email-masked]
Date first submitted: January 3, 2003
Document: RFC2284bis-08
Comment type: T
Priority: S
Section: Various
Rationale/Explanation of issue:

Page 6: "Protected success/failure" is never defined.

Page 6: There is a sentence which says:

Where a protected success/failure indication has been
received at the EAP layer by an EAP Peer, it MUST accept
and process the protected indication.

This is a vacuous requirement, because there is no definition of what it
means to "process" the "protected indication". At the very least this
should
indicate that "to process" means something like (a) apply all the
protections of whatever ciphersuite that one believes to have been applied
to the message to (b) extract a success/failure message, which is then
handled according to the normal rules for EAP success/failure messages,
and
(c) received EAP success/failure messages that arrive unprotected are
silently discarded if protection is expected.