Subject: [eap] session-timeout usage

From: [email-masked] (Yoshihiro Ohba)
Date: Thu, 27 Feb 2003 17:22:32 -0500

I have a question on RADIUS Session-Timeout attribute
usage in EAP:

  "When run over a reliable lower layer (e.g. EAP over ISAKMP/TCP,
  as within [PIC]), the authenticator retransmission timer SHOULD
  be set to an infinite value, so that retransmissions do not
  occur at the EAP layer. Note that in this case the peer may
  still maintain a timeout value so as to avoid waiting
  indefinitely for a Request.

  Where the authentication process requires user input, the
  measured round trip times are largely determined by user
  responsiveness rather than network characteristics, so that RTO
  estimation is not helpful. Instead, the retransmission timer
  SHOULD be set so as to provide sufficient time for the user to
  respond, with longer timeouts required in certain cases, such
  as where Token Cards (see Section 5.6) are involved.

  In order to provide the EAP authenticator with guidance as to
  the appropriate timeout value, a hint can be communicated to
  the authenticator by the backend authentication server (such as
  via the RADIUS Session-Timeout attribute)."

When EAP runs over a reliable lower-layer, does the RADIUS
Session-Timeout attribute always need to be used for retransmission
timer?  I think in this case, if the authenticator does not receive
EAP Response, the reason is either (i) the peer received the EAP
Request but it is taking time to generate an EAP Response or (ii)
link-layer connectivity is lost.  For either case, it seems that there
is no reason for the authenticator to retransmit the EAP Request by
using Session-Timeout attribute as a hint, and the authenticator can
use the Session-Timeout attribute for authentication timer (i.e., if
there is no EAP Response received within the Session-Timeout period
the authentication would fail), instead of use it for retransmission
timer.  In other words, I think the third paragraph is basically for
the case in which EAP runs over unreliable lower-layer.

Is my understanding correct?

Yoshihiro Ohba