Re: [AAA-DOCTORS] draft-ietf-ipsecme-eap-mutual-03.txt

[David Mitton <[e-mail]>]

Sorry,

  I know I'm past yesterday's telechat with this item, but I still wanted to air this issue to this group, FWIW.

(first I had to find where I had sent it from and then move to the mailbox I'm subscribed from)

 

Since I sent the email below, I got a couple comments, and EAP-POTP was added to the list in the current draft.

So my squeak got greased, but I still don't think this is the right way to go about this.

 

Thanks,

Dave.

 

_____________________________________________
From: Mitton, Dave
Sent: Thursday, April 08, 2010 11:17 AM
To: [e-mail]; [e-mail]; [e-mail]
Cc: [e-mail]; [e-mail]; David Mitton
Subject: RE: draft-ietf-ipsecme-eap-mutual-00.txt

 

 

Pasi, Hannes, Yaron,

                I'm looking at this draft you have authored, and am a bit dismayed by the table in section 4, "Allowed EAP Methods"

with the sentence

"Methods not listed below (or in the IANA registry that extends this list) MUST NOT be used with the

   mechanism defined here."

 

The method we support here at RSA Security, EAP-POTP (RFC 4793) I believe meets the criteria of this draft, and I'm not happy by be excluded without reason.

It's not clear what criteria you used to generate this list, perhaps other than personal familiarity.

 

I would also pick a nit with your definition of "Allows Channel Binding".   If you want to distinguish Identity protection, then re-label it.

EAP-POTP has several Channel Binding and Cryptographic bindings techniques in it, which don't relate to directly to the identity.

 

In general, I'm sure I don't like the idea of burying an obscure evaluation of other EAP methods in a document without review by a wider audience.

I would prefer to see a set of criteria and/or required security properties instead of a list generated from a small number of authors.

 

This doesn't feel like something an open standard should be doing to other EAP developers.   

 

 

David Mitton

RSA Security Division of EMC, Inc.