Subject: [radext] [Technical Errata Reported] RFC5090 (5115)

From: RFC Errata System <[email-masked]>
Date: Thu, 14 Sep 2017 13:07:40 -0700 (PDT)

The following errata report has been submitted for RFC5090,
"RADIUS Extension for Digest Authentication".

--------------------------------------
You may review the report below and at:
http://www.rfc-editor.org/errata/eid5115

--------------------------------------
Type: Technical
Reported by: Denis Ovsienko <[email-masked]>

Section: 3

Original Text
-------------
3.17.  Digest-Domain Attribute
[...]
   Length
         3
[...]

3.18.  Digest-Stale Attribute
[...]
   Length
         3

Corrected Text
--------------
3.17.  Digest-Domain Attribute
[...]
   Length
         >= 3
[...]

3.18.  Digest-Stale Attribute
[...]
   Length
         >= 3

Notes
-----
Those two attributes contain string values. All other such attributes in Section 3 uniformly define Length >= 3.

Instructions:
-------------
This erratum is currently posted as "Reported". If necessary, please
use "Reply All" to discuss whether it should be verified or
rejected. When a decision is reached, the verifying party  
can log in to change the status and edit the report, if necessary. 

--------------------------------------
RFC5090 (draft-ietf-radext-rfc4590bis-02)
--------------------------------------
Title               : RADIUS Extension for Digest Authentication
Publication Date    : February 2008
Author(s)           : B. Sterman, D. Sadolevsky, D. Schwartz, D. Williams, W. Beck
Category            : PROPOSED STANDARD
Source              : RADIUS EXTensions
Area                : Operations and Management
Stream              : IETF
Verifying Party     : IESG

---

From: Warren Kumari <[email-masked]>
Date: Fri, 15 Sep 2017 09:44:40 -0400

[ - RFC Errata System (for clutter) ]

Hi all,

I'm not a RADIUS person, and I'd like some advice / feedback here -
from my brief reading of RFC5090 (and RFC4590) and a twisty maze of
references, which seemed to end at RFC 7616 is does look like
Digest-Domain is indeed a (unbounded) string, and so I think that the
errata is correct for at least that part.

It also seems that Digest-Stale is a string, but should only be 'true'
or 'false' and so should likely be >=6 (4 chars for 'true' + type +
length), but I'd assume that >=3 is likely better, because otherwise
someone is likely to trip over pointy parser edges (e.g if someone
decided to return 'x' instead of 'true' I think that this should be  a
failure somewhere other than in the parser).

Thoughts?
W

-- 
I don't think the execution is relevant when it was obviously a bad
idea in the first place.
This is like putting rabid weasels in your pants, and later expressing
regret at having chosen those particular rabid weasels and that pair
of pants.
   ---maf

---

From: Alan DeKok <[email-masked]>
Date: Fri, 15 Sep 2017 10:52:26 -0400

> errata is correct for at least that part.

  Yes.

> failure somewhere other than in the parser).

  I agree.

  The RADIUS specs are usually fairly vague.  But using "== 3" in a place where it everything else uses ">= 3" is definitely wrong.

  Alan DeKok.