eap Mailing List: Comments on draft-walker-ieee802-req-00.txt

[Avi Lior (avi]

I have been reading draft-walker-ieee802-req-00.txt and comparing it to
2284bis-09  Note that its 09 and not 07.  I found the following:

In walker you say:

[3] Synchronization of state.  This corresponds to the "Protected
     result indication" security claim defined in [RFC2284bis], Section
     7.2.1.

The problem:
Section 7.2.1 of 2284bis-09 does not contain "Protected result indication".
This now appears in section 7.16 of 2284bis-09.

EDITORIAL COMMENT

[5]  Protection against man-in-the-middle attacks.  This corresponds to
     the "Cryptographic binding", "Integrity Protection", "Replay
     protection", and "Session Independence" security claims defined in
     [RFC2284bis], Section 7.2.1.

In the above use:
 "Integrity protection" instead of "Integrity Protection"
 "Session independence" instead of "Session Independence"

EDITORIAL COMMENT

Rewrite:
2.5.  Non-compliant EAP authentication methods

EAP-MD5-Challenge (the current mandatory-to-implement EAP authentication
method), is defined in [RFC2284bis] Section 5.4.  EAP-MD5-Challenge and
two EAP authentication methods defined in [RFC2284bis], One-Time
Password (Section 5.5) and Generic Token Card (Section 5.6), are non-
compliant with the requirements defined in this document.

As:

2.5.  Non-compliant EAP authentication methods

EAP-MD5-Challenge (the current mandatory-to-implement EAP authentication
method), defined in [RFC2284bis] (Section 5.4) and the
two EAP authentication methods defined in [RFC2284bis], One-Time
Password (Section 5.5) and Generic Token Card (Section 5.6), are non-
compliant with the requirements defined in this document.

-----------------------------
Avi Lior
Bridgewater Systems Corp.
Phone: 613.591.9104 x 6417
Cell   : 613.297.2177