Subject: [eap] Re: Issue 208: Editorial questions

From: Bernard Aboba <[email-masked]>
Date: Thu, 8 Jan 2004 18:20:32 -0800 (PST)

On Fri, 9 Jan 2004, Henrik Levkowetz wrote:

> Hi,
>
> In the resolution to issue 208, I'd propose changing
>
>   "Identity Requests and Responses are sent in cleartext, so
>   that an attacker may snoop on the identity, or even modify
>   or spoof identity exchanges. To address these threats,
>   it is preferable for an EAP method to include an identity
>   exchange that supports per-packet authentication,
>   integrity and replay protection and confidentiality."
>
> by replacing "so that an attacker may" with "so an attacker may"
> because "so that an attacker may" can be understood as "in order
> that an attacker may".

ok.

> Requirements language:
> In Section 7.6, should
>
>   "In order to protect against dictionary attacks, authentication
>   methods resistant to dictionary attacks (as defined in Section 7.2.1)
>   are recommended."
>
> end with "... are RECOMMENDED" ?

I think we need to leave this lower case.  Otherwise we are saying that
the mandatory-to-implement method should not be used.

> Similarly, in 7.11, should
>
>   "To protect against data modification, spoofing or snooping, it is
>   recommended that EAP methods supporting mutual authentication,
>   and key derivation (as defined by Section 7.2.1) be used, along with
>   a lower layers providing per-packet confidentiality, authentication,
>   integrity and replay protection."
>
> instead read "... it is RECOMMENDED that EAP methods supporting ..."?

I believe this is lower case as well, for the same reasons.  Elsewhere in
the text we are citing other documents (such as the IEEE 802.11i liaison
letter) that specify EAP method requirements for specific environments.
It's best to leave that kind of recommendation out of RFC 2284bis, much as
the IKE/IPsec documents do not provide guidance as to various IPsec
features need to be turned on.
_______________________________________________
eap mailing list
[email-masked]
http://mail.frascone.com/mailman/listinfo/eap

---

From: Henrik Levkowetz <[email-masked]>
Date: Fri, 9 Jan 2004 17:04:35 +0100

Friday  9 January 2004, Jari Arkko wrote:
[Henrik]
> >>instead read "... it is RECOMMENDED that EAP methods supporting ..."?
[Bernard]
> > features need to be turned on.
[Jari]
> I agree with Bernard. By the way, the 7.11 text seems funny to
> me when it says "... along with a lower layers ...". Shouldn't that
> be "along with a lower layer" or "along with lower layers"?

Yes. I provisionally used "along with a lower layer providing..." in the
text later last night, but was to tired to send out another mail
regarding it at that time. What do the others say?

	Henrik

---

From: Henrik Levkowetz <[email-masked]>
Date: Fri, 9 Jan 2004 02:13:12 +0100

Hi,

Requirements language: 
In Section 7.6, should

	Henrik

---

From: Jari Arkko <[email-masked]>
Date: Fri, 09 Jan 2004 08:50:25 +0200

--Jari

---

From: Bernard Aboba <[email-masked]>
Date: Fri, 9 Jan 2004 12:18:24 -0800 (PST)

One other small thing:

"Protected success/failure:" should probably be changed to
"Protected result ind.:" throughout the document, to match the term
defined in 7.2.1.
_______________________________________________
eap mailing list
[email-masked]
http://mail.frascone.com/mailman/listinfo/eap

---

From: Henrik Levkowetz <[email-masked]>
Date: Fri, 9 Jan 2004 22:32:14 +0100

> "Protected result ind.:" throughout the document, to match the term

Yes, that's appropriate.  That, and the (current) resolution of issues
206, 207, 208, 209, 211 and 212 have now been applied to the draft and
are available as an intermediary draft numbered -08.j at
  http://ietf.levkowetz.com/drafts/eap/rfc2284bis/

	Henrik