RE: RADIUS keywrap attributes

["Nelson, David" <dnelson@enterasys.com>]

Glen Zorn writes...

> Hmm.  Since RADIUS clients and servers are required to ignore unknown
> packet types (by specification, not tradition), I don't really
understand
> why this same logic would not apply to the protocol in general.

I would suggest that one level of forwards and backwards compatibility
is obtained by ignoring individual attributes that are not understood,
while a very different (IMHO much lower) level of compatibility might be
obtained by ignoring entire protocol PDUs.

This discussion side-steps the whole issue of whether new attributes (or
indeed new commands) may safely be ignored by either clients or servers,
if the subject matter of said protocol elements is important or
"security sensitive".  We have the Mandatory header bit in Diameter to
address this issue.  I don't see any good solution to this problem,
short of adding a Mandatory bit in RADIUS attributes, which raises a
whole other backwards compatibility issue. 


--
to unsubscribe send a message to radiusext-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://psg.com/lists/radiusext/>