eap Mailing List: Re: EAP-AKA review

[Jari Arkko (jari.arkko]

Hi Henry,

> The definition of the integrity protection security claim in RFC 3748 
> says that "When making this claim, a method specification MUST describe the EAP 
> packets and fields within the EAP packet that are protected."
> There is similar language for other security claims, too.

That's right, I forgot that.

> The text in Section 9.6 discusses which EAP packets are protected,
> and EAP Notifications are only mentioned in order to make it clear
> that EAP-AKA does not protect them.

That seems appropriate. Perhaps we just need to clarify that
EAP-AKA does not specify notifications need to be used, but
if they are used they should be used according to RFC 3748.
EAP-AKA does not need to prohibit Notifications, as far as
I can determine.

--Jari