Subject: RE: [Ips] Initiator CHAP authentication of target?

From: "Krueger, Marjorie" <[email-masked]>
Date: Thu, 30 Sep 2004 15:22:39 -0700

So if 

>     or, if it requires target authentication, with:
> 
>        CHAP_N=<N> CHAP_R=<R> CHAP_I=<I> CHAP_C=<C>
> 
>     If the initiator authentication fails, the target MUST 
> answer with a
>     Login reject with "Authentication Failure" status.  
> Otherwise, if the
>     initiator required target authentication, the target MUST either
>     answer with a Login reject with "Authentication Failure" or reply
>     with:
> 
>        CHAP_N=<N> CHAP_R=<R>

And the target replys with CHAP_N that is not defined and the initiator
accepts that (accepts anything) is that valid behavior?  In otherwords,
if the initiator ignores CHAP_N and only uses the target node name and
CHAP_R to authenticate, is that valid behavior?  Shouldn't the target be
able to force the use of CHAP_N?

-Marjorie 

_______________________________________________
Ips mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ips

---

From: William Studenmund <[email-masked]>
Date: Thu, 30 Sep 2004 15:32:16 -0700

> able to force the use of CHAP_N?

I'm confused. The initiator can't NOT use CHAP_N. Thus the target 
shouldn't be able to force something that's required. :-)

To quote the paragraph after the one above:

    Where N, (A,A1,A2), I, C, and R are (correspondingly) the Name,
    Algorithm, Identifier, Challenge, and Response as defined in
    [RFC1994], N is a text string, A,A1,A2, and I are numbers, and C and
    R are large-binary-values and their binary length (not the length of
    the character string that represents them in encoded form) MUST not
    exceed 1024 bytes.

So an initiator that just uses the target's name for CHAP purposes 
seems broken.

Take care,

Bill