Subject: [eap] RE: NAK survey

From: [email-masked] (Bernard Aboba)
Date: Mon, 7 Oct 2002 09:32:40 -0700 (PDT)

For what it's worth, here's what Microsoft Windows XP does:

a. May the NAK be sent by the peer in response to any EAP request? For
example, may it be sent in the middle of an EAP method? OR

Windows XP peer will send a NAK only for the first packet after the
EAP-Response/Identity is sent. It does not NAK an EAP-Request/Identity.

b. May the NAK be sent by the peer only in response to a method proposal
(e.g. the first EAP Request for a given Type)?

Yes.

c. Does your implementation tolerate sending more than one Type within a
NAK (e.g. may not recognize additional Types, but doesn't blow up)?

Windows XP will only send a single EAP type in the NAK packet, but the
server will ignore types after the first one, if present.

d. Does your implementation permit a NAK to be sent in response to an
Identity Request? If so, what does it do if a NAK is sent?

Windows does not send a NAK in response to an Identity Request, and on the
server, if a NAK is received, then the conversation is terminated.

---

From: [email-masked] (James Carlson)
Date: Mon, 7 Oct 2002 14:12:42 -0400

> EAP-Response/Identity is sent. It does not NAK an EAP-Request/Identity.

Interesting question here: was the question above about what you'd
*accept* or about what you'd possibly *send*?

It looks like I read the question as the former (because "sent by the
peer" implies "received by the local system" to me), and you might
have read it as the latter.  If it's intended as the latter, then I'd
say this: I never send Nak in response to an Identity message, but I
*do* send Nak in response to *any* message that is malformed for the
method in use.  In other words, if the method specifies a 16 octet
message for the given message subtype, and you send me fewer than 16
octets, then I assume that you're running some new or different
version of the protocol, and I send Nak to suggest a different
authentication protocol since we're not going to converge.

-- 
James Carlson, Solaris Networking         <[email-masked]>
SUN Microsystems / 1 Network Drive         71.234W   Vox +1 781 442 2084
MS UBUR02-212 / Burlington MA 01803-2757   42.497N   Fax +1 781 442 1677