Re: [radext] Extended IDs

[Alexander Clouter <[e-mail]>]

> This email starts a two week call for adoption of at most one of the
> following two drafts:
>
> * draft-chen-radext-identifier-attr-02
> * draft-dekok-radext-request-authenticator-02
>
> Since the two drafts treat the same topic, at most one can be selected
> to serve as the basis for future work.

My post deadline £0.02...

Though on every ones lips is extending the ID, I would disagree that the drafts
cover the same topic and that draft-dekok only solves this problem indirectly.

draft-dekok covers a real problem, not considered by draft-chen, on how to 
handle late responses to authentications where the ID collides, this is 
something that should be firmed up.  Firming up with draft-dekok happens to 
mean there is no need to also push ahead with draft-chen.  Pushing with 
draft-chen, still leaves everyone with this ambiguity around ID collisions.

I do not perceive anything to indicate that draft-chen is easier to reason 
about than draft-dekok, they strike me as in effect identical as both return a 
special attribute in the *response*.

The request packet though is less interesting and for me irrelevant where the 
extra entropy appears from.  From an implementation perspective the difficulty 
exists at the NAS/proxy rather than the server.  The impact of doing duplicate 
work at the server is negligible compare to a NAS/proxy not being able to 
reconcile replies to their requests.

In regards to the draft its self, draft-chen looks straight forward, but having 
had the unsavoury experience of implementing a specification that states only 
the 'what' rather than the 'why' or 'how' (TACACS, I am looking at you...) I 
find it hard to rally behind something I am hesitant to believe is as simple as 
it looks.

draft-chen reads as "this is what is baked in an existing codebase" with no 
information on the 'what if' or detailing any edge cases the implementers 
experienced.

I need to know about problems and caveats I need to know about, I do not need 
to know how to clone an existing implementation, I have tcpdump for that :)

...draft-dekok gets my, no doubt too late for consideration, vote.