eap Mailing List: Re: [Fwd: I-D ACTION:draft-walker-ieee802-req-00.txt]

[Jari Arkko (jari.arkko]

Hannes Tschofenig wrote:
> hi all, 
>
> thanks for the draft. i was not surprised about the requirements except
> for one:
>
> [3]  Synchronization of state.  This corresponds to the "Protected
>      result indication" security claim defined in [RFC2284bis], Section
>      7.2.1.
>
> why is this suddenly a MUST requirement? 

This is not really an answer to your question, but I'd note that
in the last few weeks, we at EAP WG have learned more about what
protected results indications can and can not do. In particular,
it seems that their usage may not cover all aspects of state
synchronization (e.g. authorization), current EAP methods such as
EAP-TLS generally do not provide the indications in all cases,
and that even new methods would not be able to provide them in
all cases. The indications can still be useful, but its important
that we all realize their limitations.

--Jari