Subject: [eap] minor editorial nit

From: [email-masked] (Lauri Tarkkala)
Date: Mon, 21 Jul 2003 20:23:36 +0300

Minor Editorial Nit

Submitter name: Lauri Tarkkala
Submitter email address: [email-masked]
Date first submitted: 2003-07-21
Document: RFC2284bis
Comment type: 'E'
Priority: '2'
Section: 2.1
Rationale/Explanation of issue:

Third paragraph in Section 2.1 states

"A peer MUST NOT send a Nak (legacy or expanded) in reply to a
 Request, after an initial non-Nak Response has been sent.  Since
 spoofed EAP Request packets may be sent by an attacker, an
 authenticator receiving an unexpected Nak SHOULD silently
 discard it and log the event."

and in Section 1.2 we have the definition of silently discard:

"This means the implementation discards the packet
 without further processing.  The implementation
 SHOULD provide the capability of logging the
 event, including the contents of the silently discarded packet,
 and SHOULD record the event in a statistics counter."

Recommended change:

In section 2.1 change the third paragraph quoted above to
read:

"A peer MUST NOT send a Nak (legacy or expanded) in reply to a
 Request, after an initial non-Nak Response has been sent.  Since
 spoofed EAP Request packets may be sent by an attacker, an
 authenticator receiving an unexpected NAK SHOULD 
 discard it and log the event."

(e.g. remove the "silently", at first read I found this
 a bit confusing).

-- 
Lauri Tarkkala
SSH Communications Security Corp
http://www.ssh.com/

---

From: [email-masked] (Jari Arkko)
Date: Wed, 30 Jul 2003 20:20:20 +0300

> (e.g. remove the "silently", at first read I found this

Perhaps you are right. For Henrik: if you edit this, change
s/NAK/Nak/ in Lauri's text.

Another alternative is to simple say "... SHOULD silently
discard it", since the definition of silent discard already
includes logging...

--Jari