Subject: [eap] Issue 13: Identifier usage not specified

From: [email-masked] (Bernard Aboba)
Date: Mon, 25 Mar 2002 12:40:27 -0800 (PST)

Issue 13: Identifier usage not specified
Submitter: Bernard Aboba
Submitter email address: [email-masked]
Date first submitted: March 25, 2002
Reference:
Document: RFC2284bis-02
Comment type: T
Priority: 1
Section: 4.1

Rationale/Explanation of issue:
RFC 2284 specifies only that retransmitted EAP-Requests MUST contain the
same Identifier value. It does not provide any guidance on whether the
Identifier value can repeat within an EAP conversation. 

Change:
"Retransmitted Requests MUST be sent with the same Identifier value in
order to distinguish them from new Requests. Note that the Identifier
field need only be unique on a per-port basis, so that Authenticators
are not restricted to only 255 simultaneous authentication
conversations."

To:
"Retransmitted Requests MUST be sent with the same Identifier value in
order to distinguish them from new Requests. In order to avoid confusion
between new requests and retransmissions, the Identifier value chosen for
each new Request MUST be unique within the EAP conversation. If the
Authenticator receives an EAP-Response with an Identifier different from
the one within the last EAP-Response that it sent on that port, then the
messages is silently discarded. Note that the Identifier field need only
be unique on a per-port basis, so that Authenticators are not restricted
to only 255 simultaneous authentication conversations."