Subject: [secdir] SecDir Review of draft-ietf-radext-nai-10

From: Yoav Nir <[email-masked]>
Date: Thu, 13 Nov 2014 12:19:53 -1000

I have reviewed this document as part of the security directorate's
ongoing effort to review all IETF documents being processed by the
IESG.  Document editors and WG chairs should treat these comments just
like any other last call comments.

Summary: Document is ready.

Some nits:

In section 2.6:
   Conversion to Unicode as well as normalization SHOULD be performed by
   edge systems such as laptops that take "local" text as input.  These
   edge systems are best suited to determine the users intent, and can
   best convert from "local" text to a normalized form.

I think it’s weird to use “laptop” here, as the luggability plays no part. “PC” would be better. In fact, I don’t think mobile phones are any different in this respect.

The same section says that Edge systems should normalize text, so AAA systems should not. It then goes on to say that today edge systems don’t always normalize text, so the AAA systems should. That’s a strange way to move forward, unless we’re sure that double-normalization does not cause problems.

The security considerations text is copied from RFC 4282. It still seems sufficient. This is remarkable considering that privacy is a big part of it, and privacy was not a hot topic on everyone’s mind in 2005 when RFC 4282 was written.

Yoav

---

From: Alan DeKok <[email-masked]>
Date: Fri, 14 Nov 2014 09:02:44 -0500

Yoav Nir wrote:
> I think it’s weird to use “laptop” here, as the luggability plays no
> part. “PC” would be better. In fact, I don’t think mobile phones are any
> different in this respect.

  True.  That could be:

... edge systems (e.g. laptops, desktops, mobile phones, etc.) that ...

> The same section says that Edge systems should normalize text, so AAA
> systems should not. It then goes on to say that today edge systems don’t
> always normalize text, so the AAA systems should. That’s a strange way
> to move forward, unless we’re sure that double-normalization does not
> cause problems.

  We can tell that the text is normalized.  So there's no possibility to
double normalize it.

  The problem here is that we WANT edge systems to normalize.  They
should have been normalizing.  We had a discussion about this Tuesday in
RADEXT.  Bernard (as author of EAP - 3579) admitted it was an oversight
that the document didn't say EAP-Identity MUST be UTF-8.

  RADEXT also has interest in working on an EAP document to fix this
issue in EAP.

 So the document has (a) the recommendation for EAP systems to behave
properly, and (b) recommendations for what AAA servers should do until
the EAP systems are fixed.

  Alan DeKok.