Subject: [eap] Proposed resolution to Issue 233: WLAN Comments

From: Bernard Aboba <[email-masked]>
Date: Mon, 10 May 2004 20:30:00 -0700 (PDT)

The text of Issue 233 is enclosed below.  The proposed resolution is as
follows:

For the "Protected Result Indication" issue, see the resolution of Issue
224.

For the "Non-compliant methods" issue, see the resolution of Issue 225.

Accept the editorial changes relating to capitalization.
------------------------------------------------------------------------
Issue 233: WLAN Comments
Submitter name: Avi Lior
Submitter email address: [email-masked]
Date first submitted: 3/23/2004
Reference:
http://mail.frascone.com/pipermail/public/eap/2004-March/002394.html
Document: draft-walker-ieee802-req-00
Comment type: 'T'
Priority: '1' Should fix
Section: Various
Rationale/Explanation of issue:
I have been reading draft-walker-ieee802-req-00.txt and comparing it to
2284bis-09  Note that its 09 and not 07.  I found the following:

In walker you say:

[3] Synchronization of state.  This corresponds to the "Protected
     result indication" security claim defined in [RFC2284bis], Section
     7.2.1.

The problem:
Section 7.2.1 of 2284bis-09 does not contain "Protected result
indication".
This now appears in section 7.16 of 2284bis-09.

EDITORIAL COMMENT

[5]  Protection against man-in-the-middle attacks.  This corresponds to
     the "Cryptographic binding", "Integrity Protection", "Replay
     protection", and "Session Independence" security claims defined in
     [RFC2284bis], Section 7.2.1.

In the above use:
 "Integrity protection" instead of "Integrity Protection"
 "Session independence" instead of "Session Independence"

EDITORIAL COMMENT

Rewrite:
2.5.  Non-compliant EAP authentication methods

EAP-MD5-Challenge (the current mandatory-to-implement EAP authentication
method), is defined in [RFC2284bis] Section 5.4.  EAP-MD5-Challenge and
two EAP authentication methods defined in [RFC2284bis], One-Time
Password (Section 5.5) and Generic Token Card (Section 5.6), are non-
compliant with the requirements defined in this document.

As:

2.5.  Non-compliant EAP authentication methods

EAP-MD5-Challenge (the current mandatory-to-implement EAP authentication
method), defined in [RFC2284bis] (Section 5.4) and the
two EAP authentication methods defined in [RFC2284bis], One-Time
Password (Section 5.5) and Generic Token Card (Section 5.6), are non-
compliant with the requirements defined in this document.

_______________________________________________
eap mailing list
[email-masked]
http://mail.frascone.com/mailman/listinfo/eap