Subject: [eap] Issue 41: NAK of Vendor-Specific

From: [email-masked] (Bernard Aboba)
Date: Wed, 23 Oct 2002 09:37:25 -0700 (PDT)

Submitter: Bernard Aboba
Submitter email address: [email-masked]
Date first submitted: October 23, 2002
Reference:
Document: RFC2284bis-07
Comment type: T
Priority: S
Section:  5.5
Rationale/Explanation of issue:

It is possible that both a peer and authenticator will support the
Vendor-Specific Type (255), but may support multiple Vendor-Ids and
Vendor-Types within those Vendor-Ids.

If so, what happens when the authenticator proposes the Vendor-Specific
EAP Type, and the client supports the Vendor-Specific type (255), but not
the vendorID or Vendor-Specific Type that is being proposed?

Here is the example Vendor-ID payload:

0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type=255 |                    Vendor-Id                       |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                              Vendor-Type                      |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Vendor-Specific...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Do we need to allow for a "Vendor-Specific NAK", which might include a
list of vendor-Ids and Vendor-Types that are supported?

Or does the peer just NAK with an alternate type, and force the
authenticator to guess what Vendor-Ids or Vendor-Types within those
Vendor-IDs might be supported?