[Emu] Re: WGLC for draft-ietf-emu-pqc-eapaka and draft-ietf-emu-hybrid-pqc-eapaka

[John Mattsson <[e-mail]>]

I made a very quick read of draft-ietf-emu-pqc-eapaka. Looks quite good to me. Some comments:

- IANA registry value collision (TBA3 used twice)

- "AT_MAC is calculated over the EAP packet exactly as transmitted on the wire"

With fragmentation there is no single "EAP packet transmitted over the wire

- "applicable to any post-quantum Key Encapsulation Mechanism (PQ-KEM)"

I think the fields are too small for Classic McEliece.

- MK_PQ_SHARED_SECRET = PRF'(IK'|CK'|ss,"EAP-AKA' FS"| Identity | ct)

This concatenates two variable-length fields (Identity and ct).  Normal cryptographic hygine would be to have a length field or a delimiter.

- "CEK: Content Encryption Key"

This term is never used.

- OLD "hereby refereed to"
  NEW "hereby referred to"

- OLD "traditional algorithms public-key algorithms"
  NEW "traditional public-key algorithms"

- "EAP-AKA prime"

This spelling is not used in RFC 9048... should maybe be discussed.

- "ML-KEMs"

I would suggest reformulate to not give the idea of several different ML-KEM

-- "in the PQ-KEM, one needs to apply Fujisaki-Okamoto [FO] transform"

I suggest removing text on FO. I think this is to low-level, and not all PQ-KEMs use the FO transform. Talking about IND-CCA2 seems enough.

- I think the encapsulation key and ciphertext sizes of the three ML-KEM variant would be good to list.

- "MAL-BIND-K-CT"

Talk about MAL-BIND-K-CT might be better suited for the security considerations.

Cheers,
John Preuß Mattsson