Subject: [eap] [issue] 2284bis - 7.2 security claim [f] excessive?

From: [email-masked] (Henrik Levkowetz)
Date: Tue, 4 Feb 2003 01:48:42 +0100

Reviewing the 2284bis -eap -00b changes myself, I see there's
one change which I think may warrant an issue after all:

Issue: 7.2 security claim [f] excessive?
Submitter name: Henrik Levkowetz
Submitter email address: [email-masked]
Date first submitted: 4 Feb 2003
Document: draft-ietf-eap-rfc2284bis-00a.txt
Comment type: Editorial 
Priority: 1
Section: 7.2
Rationale:

2284bis itself does not adhere to item [f] of section 7.2. So it seems
that this item may be an excessive requirement, and might be removed
or reworded?

Discussion:

In section 7.2, item [f] says about security claims for EAP methods:

 [f] Indication of vulnerabilities. In addition to the security claims	
that are made, the specification MUST indicate which of the	
security claims detailed in Section 1.2 are NOT being made, and	
discuss the security implications.

However, for the methods specified in this draft in sections 5.4, 
5.5, 5.6, there is no discussion of the security implications of
the security claims not made. Either this requirement is excessive,
or we need to produce discussions of the security implications made
and not made for the MD5-challenge, One Time Password and Generic Token
Card methods.

Proposal:
The last part of Section 7.2 item [f] is removed, producing this text:

 [f] Indication of vulnerabilities. In addition to the security claims	
that are made, the specification MUST indicate which of the	
security claims detailed in Section 1.2 are NOT being made.

	Regards,
		Henrik