Subject: [eap] Issue #1: EAP NAK Allows only one alternative method

From: [email-masked] (Bernard Aboba)
Date: Mon, 25 Mar 2002 09:32:59 -0800 (PST)

Issue 1: EAP NAK Allows only one alternative method
Submitter: Bernard Aboba
Submitter email address: [email-masked]
Date first submitted: March 25, 2002
Reference:
Document: RFC2284bis-02
Comment type: T
Priority: 2
Section: 5.3
Rationale/Explanation of issue:
If the server supports a large number of methods, then it may take a long
time to converge on a method that the client can also support. Convergence
will be quicker if the client can NAK with a list of methods that it
supports, so that the server can pick one. 
Note: before making this change, it will be necessary to determine whether
existing EAP implementations are backwards compatible with the
change. This should be true if the implementations only look at the first
type within the NAK, but are "liberal in what they accept" and don't drop
the NAK entirely due to its being too large. 
Change:
" This field MUST contain a single octet indicating the desired
authentication type."
To:
"This field contains one or more octets indicating the acceptable
authentication types, in order of preference."