rfc2243.txt

radius协议的经典实现

Network Working Group                                           C. Metz
Request for Comments: 2243                                The Inner Net
Category: Standards Track                                 November 1997




                         OTP Extended Responses


Status of this Memo

   This document specifies an Internet standards track protocol for the
   Internet community, and requests discussion and suggestions for
   improvements.  Please refer to the current edition of the "Internet
   Official Protocol Standards" (STD 1) for the standardization state
   and status of this protocol.  Distribution of this memo is unlimited.

Copyright Notice

   Copyright (C) The Internet Society (1997).  All Rights Reserved.

Abstract

   This document provides a specification for a type of response to an
   OTP [RFC 1938] challenge that carries explicit indication of the
   response's encoding. Codings for the two mandatory OTP data formats
   using this new type of response are presented.

   This document also provides a specification for a response that
   allows an OTP generator to request that a server re-initialize a
   sequence and change parameters such as the secret pass phrase.

1. Conventions, Terms, and Notation

   This document specifies the data formats and software behaviors
   needed to use OTP extended responses. The data formats are described
   three ways: using an ad-hoc UNIX manual page style syntax, using
   augmented BNF described in sections two and three of RFC 822, and by
   examples. Should there be any conflict between these descriptions,
   the augmented BNF takes precedence. The software behaviors are
   described in words, and specific behavior compliance requirements are
   itemized using the requirements terminology (specifically, the words
   MUST, SHOULD, and MAY) defined in RFC 2119.







Metz                        Standards Track                     [Page 1]

RFC 2243                 OTP Extended Responses            November 1997


2. Extended Challenges and Extended Responses

   This document builds on the protocol and terminology specified in RFC
   1938 and assumes that you have already read this document and
   understand its contents.

   An extended challenge is a single line of printable text terminated
   by either a new line sequence appropriate for the context of its use
   (e.g., ASCII CR followed by ASCII LF) or a whitespace character. It
   contains a standard OTP challenge, a whitespace character, and a list
   that generators use to determine which extended responses are
   supported by a server.

   An extended response is a single line of printable text terminated by
   a new line sequence appropriate for the context of its use. It
   contains two or more tokens that are separated with a single colon
   (':') character. The first token contains a type specifier that
   indicates the format of the rest of the response. The tokens that
   follow are argument data for the OTP extended response. At least one
   token of data MUST be present.

2.1. Syntax

   In UNIX manual page like syntax, the general form of an extended
   challenge could be described as:

      <standard OTP challenge> ext[,<extension set id>[, ...]]

   And the general form of an extended response could be described as:

      <type-specifier>:<arg1>[:<arg2>[:...]]

   In augmented BNF syntax, the syntax of the general form of an
   extended challenge and an extended response is:

   extended-challenge = otp-challenge 1*LWSP-char capability-list
                        (NL / *LWSP-char)
   otp-challenge     = <a standard OTP challenge>
   capability-list   = "ext" *("," extension-set-id)
   extension-set-id  = *<any CHAR except LWSP, CTLs, or ",">
   extended-response = type 1*(":" argument) NL
   type              = token
   argument          = token
   token             = 1*<any CHAR except ":" and CTLs>
   NL                = <new line sequence appropriate for the context
                        in which OTP is being used>





Metz                        Standards Track                     [Page 2]

RFC 2243                 OTP Extended Responses            November 1997


   An example of an extended challenge indicating support for OTP
   extended responses and for a mythical response set "foo" is:

      otp-md5 123 mi1234 ext,foo

   An example of an extended response using a mythical type named "foo"
   is:

      foo:some data:some more data:12345

2.2. Requirements

   A server compliant with this specification:

      1. MUST be able to receive and parse the general form of an
         extended response
      2. MUST be able to receive, parse, and correctly process all
         extended responses specified in this document
      3. MUST process the type field in a case-insensitive manner
      4. MUST reject any authentication attempt using an extended
         response if it does not support that type of response
      5. SHOULD provide an appropriate indication to the generator
         if the response was rejected because of (4)
      6. MUST limit the length of the input reasonably
      7. MUST accept otherwise arbitrary amounts of whitespace
         wherever a response allows it
      8. MUST be able to receive and correctly process standard OTP
         responses

   A generator compliant with this specification:

      1. MUST be able to generate standard OTP responses
      2. MUST use standard responses unless an extended challenge
         has been received for the particular server AND seed
      3. MUST generate the type field in lower case
      4. MUST NOT send a response type for which the server has not
         indicated support through an extended challenge

   Extension set identifiers and extension type identifiers named with
   the prefix "x-" are reserved for private use among mutually
   consenting implementations. Implementations that do not recognise a
   particular "x-" extension MUST ignore that extension. This means that
   all "x-" extensions are likely to be non-interoperable with other
   extensions. Careful consideration should be given to the possibility
   of a server interacting with with a generator implementation which,
   although it recognizes a given "x-" extension, uses it for a
   different purpose. All of the remaining extension namespace is
   reserved to IANA, which will only officially assign the extension



Metz                        Standards Track                     [Page 3]

RFC 2243                 OTP Extended Responses            November 1997


   into this namespace after the IESG approves of such an assignment.
   During the lifetime of the OTP WG, it is recommended that the IESG
   consult with the OTP WG prior to approving such an assignment.

3. The "hex" and "word" Responses

   There exists a very rare case in which a standard OTP response could
   be a valid coding in both the hexadecimal and six-word formats. An
   example of this is the response "ABE ACE ADA ADD BAD A."  The
   solution to this problem mandated by the OTP specification is that
   compliant servers MUST attempt to parse and verify a standard
   response in both hexadecimal and six-word formats and must consider
   the authentication successful if either succeeds.

   This problem can be solved easily using extended responses. The "hex"
   response and the "word" response are two response types that encode
   an OTP in an extended response that explicitly describes the
   encoding. These responses start with a type label of "hex" for a
   hexadecimal OTP and "word" for a six-word coded OTP. These responses
   contain one argument field that contains a standard OTP response
   coded in the indicated format.

3.1. Syntax

   In UNIX manual page like syntax, the format of these responses could
   be described as:

      hex:<hexadecimal number>
      word:<six dictionary words>

   In augmented BNF syntax and with the definitions already provided,
   the syntax of these responses is:

      hex-response  = "hex:" hex-64bit NL
      hex-64bit     = 16(hex-char *LWSP-char)
      hex-char      = ("A" / "B" / "C" / "D" / "E" / "F" /
                       "a" / "b" / "c" / "d" / "e" / "f" /
                       "0" / "1" / "2" / "3" / "4" / "5" /
                       "6" / "7" / "8" / "9")

      word-response = "word:" word-64bit NL
      word-64bit    = 6(otp-word 1*LWSP-char)
      otp-word      = <any valid word in the standard OTP coding
                      dictionary>







Metz                        Standards Track                     [Page 4]

RFC 2243                 OTP Extended Responses            November 1997


   Examples of these responses are:

      hex:8720 33d4 6202 9172
      word:VAST SAUL TAKE SODA SUCH BOLT

3.2. Requirements

   A server compliant with this specification:

      1. MUST process all arguments in a case-insensitive manner

   A generator compliant with this specification:

      1. SHOULD generate otp-word tokens in upper case with single
         spaces separating them
      2. SHOULD generate hexadecimal numbers using only lower case
         for letters

4. The "init-hex" and "init-word" Responses

   The OTP specification requires that implementations provide a means
   for a client to re-initialize or change its OTP information with a
   server but does not require any specific protocol for doing it.
   Implementations that support the OTP extended responses described in
   this document MUST support the response with the "init-hex" and
   "init-word" type specifiers, which provide a standard way for a
   client to re-initialize its OTP information with a server. This
   response is intended to be used only by automated clients. Because of
   this, the recommended form of this response uses the hexadecimal
   encoding for binary data. It is possible for a user to type an "init-
   hex" or "init-word" response.

4.1. Syntax

   In UNIX manual page like syntax, the format of these responses could
   be described as:

      init-hex:<current-OTP>:<new-params>:<new-OTP>
      init-word:<current-OTP>:<new-params>:<new-OTP>

   In augmented BNF syntax and with the definitions already provided,
   the syntax of the "init-hex" response is:

   init-hex-response = "init-hex:" current-OTP ":" new-params ":"
                        new-OTP NL

   current-OTP     = hex-64bit
   new-OTP         = hex-64bit



Metz                        Standards Track                     [Page 5]