Subject: [eap] Comments after eap-03 edits

From: [email-masked] (Henrik Levkowetz)
Date: Tue, 6 May 2003 14:58:59 +0200

Hi, 

        I've now done the edits for issues 104 & 108-117. I came across a few
inconsistencies and question marks, listed below:

* In the new definition of authenticator (Issue 114), the word authenticator
is capitalized, while Issue 110 requests it to be all lowercase. The same 
issue crops up in section 7.9, the rewritten security considerations section, 
which says 
	"... the Authenticator or Supplicant can re-authenticate at ..."

If "Authenticator" should be changed to "authenticator" throughout, how do we
handle "Supplicant"?

* The new text for Section 2.2 (Issue 115) says in one place:
	"The Nak (Type 3) or Expanded Nak (Type 254) are utilized for the
	purpose of method negotiation" 
which reads a bit awkward to me. I'd propose
	"Nak (Type 3) or Expanded Nak (Type 254) are utilized for the
	purpose of method negotiation"

* In section 3.1, the rewritten item 3 (Issue 111) has the following
slightly awkward text:	
	"...where subsequently protected data is not protected by
	per-packet authentication, integrity and replay protection." 
I'd propose s/protected data/sensitive data/:	
	"...where subsequently sensitive data is not protected by
	per-packet authentication, integrity and replay protection."

Further on in 3.1, the last paragraph starts
	"Lower lower transports..."
which I guess should be 
	"Lower level transports..."

* In the rewritten section 7 (Issue 113) there's one dangling "adversary" left,
which I assume should be attacker.

	Henrik

-- 
  "If we don't succeed, we run the risk of failure." 
    -- J. Danforth Quayle

---

From: [email-masked] (Bernard Aboba)
Date: Tue, 6 May 2003 06:15:48 -0700 (PDT)

> If "Authenticator" should be changed to "authenticator" throughout, how do we

"Authenticator" and "Supplicant" are terms from IEEE 802.1X -- and that
means we cannot include our own definitions for them, since they're
already defined. My understanding was that "authenticator" was to be used
to refer to an EAP authenticator. So I think that in the terminology
section, that we need to use "authenticator" instead of "Authenticator".

> 	purpose of method negotiation"

That seems fine, but it should be done consistently.

> 	per-packet authentication, integrity and replay protection."

how about "where subsequent data is not protected by..."

> 	"Lower level transports..."

I think it is "Lower layer transports"

> which I assume should be attacker.

Yes.

---

From: [email-masked] (Henrik Levkowetz)
Date: Tue, 6 May 2003 15:50:28 +0200

On Tue, 6 May 2003 06:15:48 -0700 (PDT)

> section, that we need to use "authenticator" instead of "Authenticator".

Ok.

> That seems fine, but it should be done consistently.

Ok. 

> how about "where subsequent data is not protected by..."

Yes, that's fine.

> I think it is "Lower layer transports"

Ok.

> > which I assume should be attacker.

Good. Fixes going in.

	Henrik

-- 
  Does the name Pavlov ring a bell?