Subject: [abfab] Last Call: <draft-ietf-abfab-gss-eap-08.txt> (A GSS-API Mechanism for the Extensible Authentication Protocol) to Proposed Standard

From: The IESG <[email-masked]>
Date: Tue, 26 Jun 2012 09:58:32 -0700

The IESG has received a request from the Application Bridging for
Federated Access Beyond web WG (abfab) to consider the following
document:
- 'A GSS-API Mechanism for the Extensible Authentication Protocol'
  <draft-ietf-abfab-gss-eap-08.txt> as Proposed Standard

The IESG plans to make a decision in the next few weeks, and solicits
final comments on this action. Please send substantive comments to the
[email-masked] mailing lists by 2012-07-10. Exceptionally, comments may be
sent to [email-masked] instead. In either case, please retain the
beginning of the Subject line to allow automated sorting.

Abstract

   This document defines protocols, procedures, and conventions to be
   employed by peers implementing the Generic Security Service
   Application Program Interface (GSS-API) when using the EAP mechanism.
   Through the GS2 family of mechanisms, these protocols also define how
   Simple Authentication and Security Layer (SASL, RFC 4422)
   applications use the Extensible Authentication Protocol.

The normative reference to the IANA registry [GSS-IANA] might be
considered a downref. 

The file can be obtained via
http://datatracker.ietf.org/doc/draft-ietf-abfab-gss-eap/

IESG discussion can be tracked via
http://datatracker.ietf.org/doc/draft-ietf-abfab-gss-eap/ballot/

No IPR declarations have been submitted directly on this I-D.

---

From: Sam Hartman <[email-masked]>
Date: Tue, 26 Jun 2012 15:14:35 -0400

EAP (RFC 3748) has a applicability statement  scoped very strictly to
network access.
This document  provides a mechanism that falls well outside that
applicability statement and permits the use of EAP for general
application authentication.

When ABFAB was chartered, there was a charter item to update the EAP
applicability statement. I think A number of people in the room at the
BOF, including myself, would have objected to the work being chartered
had that charter item not been present.

I think that work is important because I believe there are a number of
important concerns that apply to the use of EAP for authentication
beyond network access that need to be documented.

Unfortunately, the technical specification has gotten ahead of the
applicability statement update.
I'm OK with that provided that we're still firmly committed to an
applicability statement update. As part of approving this document now,
I want to confirm that we have consensus at least within the ABFAB
working group and the IESG to do that update.
If there is any doubt I'd far prefer that this document be held until
the applicability statement catches up.

--Sam