Subject: Re: [Nea] NEA WG Next Steps: Call for Comments on PT-EAP I-D

From: Carolin Latze <[email-masked]>
Date: Fri, 03 Feb 2012 17:42:58 +0100

Hi all,

I have a few comments:

Section 3.2

- "The NEA Client SHOULD choose the value sent by
    the NEA Server if the NEA Client supports it. However, the NEA Client
    MAY set the Version field to a value less than the value sent by the
    NEA Server"

-> does this mean, the client is allowed to choose an older version even 
he supports the same version like the server. Wouldn't it be better to 
require the client to use the version the server requested if he 
supports it and only allow to use older versions if the client does not 
support the server's version?

Section 4.2.1

2n paragraph: "In order to protect again NEA assessment message theft" 
-> against

Section 4.3

5th paragraph: "Whether the communication channel is established with 
both or
    one party performing a cryptographic authentication, the resulting
    channel needs to provide strong integrity and confidentiality
    protection to its contents.  These protections are to be bound to at
    least the authentication of the NEA Client, so the session is
    cryptographically bound to a particular authentication event."

-> ok this can be my bad English, but I thought it is bound to at least 
the authentication of the NEA _server_, not the client since most of the 
tunnel protocols authenticate the server only. Did I just misunderstand 
this paragraph?

Section 4.4

4th paragraph: "Each
    of these methods employs at least a NEA Server authentication using
    an X.509 certificates" -> certificate (= only one)

Regards
Carolin

On 01/26/2012 09:56 PM, Susan Thomson wrote:
> Hi all
>
> There has been good feedback on the PT-TLS I-D - thank you! The plan is for
> the editors to update the I-D based on comments received  and post the
> revision to the list within a few weeks. The goal is to do a 2nd WGLC prior
> to the next IETF.
>
> In contrast, we have not received much feedback on the PT-EAP I-D. Please
> review the document (http://tools.ietf.org/id/draft-ietf-nea-pt-eap-00.txt)
> and send your comments to the mailing list by Friday, February 10, 2012.
> This will allow time to revise the document and to issue a WGLC on the
> document prior to the next meeting.
>
> Thanks very much to those who have posted comments on the PT-TLS I-D, and we
> look forward to the same level of feedback on the PT-EAP I-D.
>
> Thanks
> Susan
>
>
> _______________________________________________
> Nea mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/nea
>