Xauth Transaction Identifier

[Leemay Yen <leemay_yen@xxxxxxxxxxxxxxx>]

Hi, Stephane:

Thank you in advance to answer my following questions about
 your xauth draft (Oct. 2000).

1. In Section 6, it says:
    "All ISAKMP-Config messages in an extended authentication transaction
     MUST contain the same ISAKMP-Config transaction identifier."

Does it mean that a single "identifier" value shall be used in the whole
xauth
transaction ?

Then if the whole xauth exchange looks like:
	Request -->
		 <--  Reply
	Request -->
		 <--  Reply
	Set	 -->
		 <--  Ack

Only one id value will be used  no matter how many pairs of messages 
(Request/Reply, Set/Ack) ?

2. What is the starting value for this "identifier" ? 
Is it always incremented by 1 ?
What will be the cases to use different identifier values ?

3. Should we change the identifier value for the "authentication failure
retry" ?
or even the re-authentication phase (per RADIUS, as described in section 6)
?

In addition, have you thought about how to support "password change", which
can be initiated by the end host or even the edge device ?

Thanks again for your advise.

Leemay Yen
RapidStream, Inc.