Subject: [eap] Proposed resolution to Issue 144: Use of a Zero in a Nak

From: [email-masked] (Bernard Aboba)
Date: Tue, 8 Jul 2003 22:05:30 -0700 (PDT)

The text of Issue 144 is enclosed below. The proposed resolution is as
follows:

In Section 5.3.1, change:

"Type zero (0) is used to indicate that the sender
has no viable alternatives."

To:

"Type zero (0) is used to indicate that the sender
has no viable alternatives, and therefore the
authenticator SHOULD NOT send another Request
after receiving a Nak Response containing a zero
value."

----------------------------------------------------------------------
Issue 144: Use of Zero in a Nak
Submitter name: Henrik Levkowetz
Submitter email address: [email-masked]
Date first submitted: June 18, 2003
Reference:
Document: EAP-04
Comment type: T
Priority: 1
Section: 5.3
Rationale/Explanation of issue:

There is various text on the use of zero in a NAK, for instance,
Section 5.3.1 says:

      "The legacy Nak Type is valid only in Response messages.  It is
      sent in reply to a Request where the desired authentication Type
      is unacceptable.  Authentication Types are numbered 4 and above.
      The Response contains one or more authentication Types desired by
      the Peer.  Type zero (0) is used to indicate that the sender has
      no viable alternatives."

Reading this, I wondered: When is the value zero used in a NAK? When the
peer doesn't want to *disclose* alternatives, or when there are none
left? May the authenticator continue probing after receiving a zero NAK?

[Jari Arkko]

The text seems to say that the peer has no alternatives. Still,
I wonder if zero is used for other purposes as well. Has it been
used for implementations that can't  tell what methods might be
appropriate?

If not, I'd rather say SHOULD NOT probe after receiving
a zero NAK.