Re: DISCUSS and COMMENT: draft-ietf-radext-fixes

[Jari Arkko <jari.arkko@piuha.net>]

Ok for me.

Jari

Alan DeKok kirjoitti:
> Jari Arkko wrote:
> ...
>   
>> This is OK, I think (but it is up to you if you want to add the mitigation
>> feature -- I think at least suggesting Message-Authenticator
>> for every request is a good idea, unless you can see some backwards
>> compatibility issues).
>>     
>
>   I don't see any.  Old RADIUS servers don't validate
> Message-Authenticator, so they will ignore it.  New ones will validate
> it, and will gain from the added security.
>
>   I would prefer that the document says "... clients MUST add a
> Message-Authenticator attribute to every Access-Request".  But I'll
> leave it to the WG for consensus.
>
>   If there's no objection, I'm inclined to change the SHOULD to a MUST.
>
>   Alan DeKok.
>
>
>
>
>   


--
to unsubscribe send a message to radiusext-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://psg.com/lists/radiusext/>