Subject: Re: (radius) Some questions

From: Carl Rigney <[email-masked]>
Date: Tue, 14 Mar 2000 12:38:23 -0800 (PST)

1.  What are "undistinguished octets" exactly?

It means they should be treated as 8-bit values without any particular
internal structure; i.e. don't assume its ASCII text or in a specific
format.

	2.  Why is the minimum length for a CHAP-Challenge 7?  With RFC
	defaults, it would be three (1+1+1 since a STRING value cannot
	be NULL).  Is there some CHAP requirement of a minimum of a 5
	byte challenge?

There's a 1-octet Chap ID, and the minimum CHAP-Challenge is 32 bits (4
octets), so that's a minimum length of 7 octets.  A CHAP-Challenge
shorter of 24 bits or shorter is only pretend security since it would
be easily dictionary-attacked.  Actually even a challenge of 32-bits is
pretty short, but at least one major RADIUS vendor supported 32-bit
challenges, so that was set as the minimum.

	3.  How does everyone feel about the attribute name guideline?
	It seems desirable to have all implementations use the same
	printable text names for attributes but real-world evaluation
	shows this is not the case (ie User-Service vs Service-Type for
	example).

It's an implementation issue.  User-Service was the old name for
Service-Type, so some RADIUS servers still use it, or support both for
backwards compatibility (6 years later...).

	Even though the text name won't affect the operation of the
	protocol, it does shorten negotiation time when coming to
	common terms with different implementations that might use
	different attribute names in dictionaries.

When comparing different implementations you should use the attribute
numbers, which must be the same.  The attribute names are an
implementation detail.  Its convenient if implementers wind up using
the same attribute names, but I wouldn't depend on it.  And in some
cases the attributes wind up getting renamed, like Signature in the
latest extensions draft being renamed Message-Authenticator.

--
Carl Rigney
[email-masked]
-
To unsubscribe, email [email-masked]' with
'unsubscribe ietf-radius' in the body of the message.