On Thu, Jul 7, 2011 at 12:47 PM, Sam Hartman <[email protected]> wrote: > If I'm understanding RFC 3748 you end up sending an eap success or > failure packet even if the method supports protected result indication. > Is my understanding correct?
Looking at RFC2716 (EAP-TLS), yes, that exactly so. I don't know how representative EAP-TLS is, but there we have protected _failure_ notifications only, followed by an unprotected echo of it, well, IIUC. I don't see a protected success message... > First, how should we handle cases where the protected result disagrees > with the failure/success message? If we get a shared key out of the method then GSS-EAP should probably use it to construct its own protected success and failure messages (which should be sent in addition to, and in parallel with the EAP messages). If not then GSS-EAP should use EAP as it is, with all the same exact issues as EAP. > Secondly, we should wait for the failure/success message before deciding > whether the context is established or not? Yes. But the security context could be PROT_READY before that. Nico -- _______________________________________________ abfab mailing list [email protected] https://www.ietf.org/mailman/listinfo/abfab
