CHAP XAuth draft contradiction?

[Will Price <wprice@xxxxxxxxxxx>]

Line 1167 of draft 00 says the RADIUS CHAP hash should proceed as: "(ID+challenge+secret)"

Line 408 of RFC 2138 (RADIUS) says that hash should proceed as: ID+secret+challenge.

We used the interpreation from the XAuth draft, but one of the vendors
we're testing with used the second interpretation.

I have changed our implementation to use RFC 2138's method, but this
should probably be clarified.

-- Will

Will Price, Director of Engineering
PGP Security, Inc.
a division of Network Associates, Inc.