eap Mailing List: Re: issue 379: Definitions

[Bernard Aboba (bernard_aboba]

I think there is a disctinction between the Session-Id and the lifetime of 
the keys that it is used to refer to.

The Session-Id should be unique both globally and temporally, so in theory 
it should have an infinite lifetime.  Of course, the keys that the 
Session-Id can be used to name do have a lifetime.

Is the problem with the definition that it refers to an "EAP authentication 
exchange", seeming to imply that once the exchange has completed it is no 
longer useful?

> > Session-Id
> > The EAP Session-Id uniquely identifies an EAP authentication exchange
> > between an EAP peer
> > (as identified by the Peer-Id) and server (as identified by the
> > Server-Id).  For more information, see Section 1.4.
>
> Is the "session-id" good until the EAP-Success/Failure exchange, or until
> the expiration of the MSK/EMSK? I think it is the latter.