Subject: Multilink with unidirectional authentication

From: John Bray <[email-masked]>
Date: Mon, 19 Jan 1998 15:21:49 -0800 (PST)

There has been much discussion in the past on the relationship between
the endpoint discriminator and authentication when bundling links to
together using MP. However, I haven't seen the following issue
specifically addressed, and I'd like to get some opinions as to how to
interpret RFC 1990, Section 5.1.3.

Consider a bundle in which there are two links between host A and host
B. Host A supplies the same ED in its LCP Config-requests on both
links. Host B does likewise. In the absence of authentication, this
means both links must be bundled together (scenario (2)). Now consider
what happens if A authenticates B on one link, and B authenticates A
on the other.  Do we have one bundle or two? 

My interpretation is that we have two bundles, since the
authentication does not match between the two links. This falls under
scenario (4). Host A has an authenticated name for B on the first
link, but not the second. Host B has an authenticated name for A on
the second link, but not the first. To me, that's a mismatch.

However, I've run across another vendor that has chosen to put both
links in one bundle in this case. I'm not sure whether they are just
keying on the ED when one link is not authenticated, or whether they
assume that since they initiated the dialup call for the link they
didn't authenticate (i.e. B called A for the first link, A called B
for the second), it is safe to rely on the name in the CHAP challenge
from the remote peer to match the authenticated link.

Comments?

John Bray

---

From: John Shriver <[email-masked]>
Date: Tue, 20 Jan 1998 09:52:18 -0500

Date: Mon, 19 Jan 1998 15:21:49 -0800 (PST)
   From: John Bray <[email-masked]>
   To: [email-masked]
   Subject: Multilink with unidirectional authentication

I agree, those are two bundles.

However, during the period of time that A has authenticated B on the
first link, but the authentication has not occured on the second link,
there is one bundle at B, but two bundles at A!

Yet another really degenerate case.

Of course, this degenerateness could be eliminated by stating that
Multilink does not apply until Network Phase.  (Or only applies in
Network Phase?)  RFC 1990 only mentions Establish and Authenticate
Phases, with no mention of how they relate to Multilink.