Subject: [eap] Yet more on Issue 74

From: [email-masked] (Bernard Aboba)
Date: Sun, 9 Feb 2003 16:46:48 -0800 (PST)

Here is the text I would propose to add to RFC 2869bis to complete the
proposed fix of Issue 74:

2.5.  Invalid packets

EAP methods may contain a per-packet Message Integrity Check (MIC).
Although EAP methods such as EAP-TLS [RFC2716] treat MIC check failures
as fatal errors, it may be desirable for an EAP method to silently
discard an invalid EAP packet, and subsequently continue the
conversation. This provides additional resilience against Denial of
Service (DoS) attacks.

When a RADIUS server receives an Access-Request containing an EAP-
Message attribute encapsulating an invalid EAP packet, it SHOULD NOT
silently discard the Access-Request without informing the NAS. This
would cause the NAS to retransmit the Access-Request, then eventually
time-out and initiate failover.  As a result, it is best for the RADIUS
server to formulate a response of some kind.

If the error is considered fatal, an Access-Reject can be sent.  In
order for the RADIUS server to communicate that an invalid EAP packet
has been received, but that the problem is non-fatal, an Access-
Challenge containing an EAP-Start MAY be sent. A NAS receiving an
Access-Challenge with an EAP-Start MUST discard the EAP packet that it
had previously encapsulated within an Access-Request. It will then check
whether it has received additional EAP Response packets with an
Identifier matching that of the last Request. If so, a new EAP Response
packet will be sent to the RADIUS server within an Access-Request
packet.  Once the RADIUS server responds with a packet containing a non-
null EAP-Message attribute, the NAS updates the Identifier value, and
any pending Responses that do not match this value can be discarded.

---

From: [email-masked] (John Vollbrecht)
Date: Tue, 11 Feb 2003 14:06:20 -0500

This sounds good to me.

--On Sunday, February 9, 2003 4:46 PM -0800 Bernard Aboba 
<[email-masked]> wrote:

> _______________________________________________
> eap mailing list
> [email-masked]
> http://mail.frascone.com/mailman/listinfo/eap

---

From: [email-masked] (Jari Arkko)
Date: Wed, 12 Feb 2003 00:25:02 +0200

> This sounds good to me.

I like it as well.

Jari