eap Mailing List: ISSUE: EAP keying section 1.4 - method and session ID

[Salowey, Joe (jsalowey]

Submitter name: Joe Salowey
Submitter email address: jsalowey [at] cisco.com
Date first submitted: 4/30/2006
Reference: 
Document: Keying Framework
Comment type: 'T'echnical
Priority: '1' Should fix 
Section: 1.4
Rationale/Explanation of issue:

This document defines both session and Method ID.  It seems that it
would be sufficient and less confusing to define only one called the
session ID.  

Suggested definition:

"Session-Id

   The Session-Id uniquely identifies an EAP session between an EAP peer
   (as identified by the Peer-Id) and server (as identified by the
   Server-Id).  The EAP Session-Id consists of the concatenation of the
   Expanded EAP Type Code (including the Type, Vendor-Id and Vendor-Type
   fields defined in [RFC3748] Section 5.7) and the temporally
   unique identifier obtained from the method.  This unique identifier
is 
   typically constructed from nonces
   or counters used within the EAP method exchange.  The
   inclusion of the Expanded Type Code in the EAP Session-Id ensures
   that each EAP method has a distinct Session-Id space.  Since an EAP
   session is not bound to a particular authenticator or specific ports
   on the peer and authenticator, the authenticator port or identity are
   not included in the Session-Id."

Replace references to method-ID with Session-ID.