[netext] AD Evaluation: draft-ietf-netext-wifi-epc-eap-attributes

[Brian Haberman <[e-mail]>]

All,
     I have performed my review of
draft-ietf-netext-wifi-epc-eap-attributes as a part of the IETF
publication process.  These comments will need to be addressed prior to
IETF Last Call.

1. The draft has several nits that need to be fixed.  Please run id-nits
and resolve the warnings generated.

2. The document states that these new EAP attributes can be used in WiFi
networks.  Later, it talks about networks that employ 802.1X.  Please be
more specific as to what is covered under the generic WiFi in the
context of this specification.

3. Please change all occurrences of EUTRAN to E-UTRAN (per RFC 6459).

4. Given the use of PMIP as an example, please include an informative
reference to the relevant PMIP RFC(s).

5. There is no expansion/definition of P-TMSI or M-TMSI in the draft.
Those terms do not appear in RFC 6459.  Please clarify these acronyms on
first use.

6. The document notionally mentions 3GPP and references GPRS.  Are those
the target 3G/4G networks?  Is this applicable to LTE or other
technologies? More clarity here would be useful.

7. In section 4, it would be beneficial to include forward references to
the actual option specification sections for the AT_* attributes.

8. Several of the attributes include strings in the data.  What is the
encoding for these strings?

9. The attributes all contain Length fields with no description of what
fields are included in the length.

10. Are the sub-types and types in 5.2, 5.3, 5.5, & 5.6 set in stone?
Could new ones be defined in the future?  If so, you will want to
consider if they should be IANA registries.  Otherwise, future RFCs will
need to update this spec to extend the type/sub-type values supported.

11. I am confused by the relationship between the attributes defined in
sections 5.4 and 5.5.  Would the AT_HANDOVER_SESSION_ID attribute ever
be used without the AT_HANDOVER_INDICATION?  If not, why have the
session id in a separate attribute?  It seems straightforward to include
the session id info in the AT_HANDOVER_INDICATION attribute if Type=1.
Am I missing something?

12. The formatting of figure 7 is messed up.

13. I see that there are no normative references.  At a minimum, it
seems like the EAP specs should be normative.

14. The Security Considerations section tells me nothing.  Are there new
threats with these new pieces of information flowing across the network?
 What are the privacy implications of these messages?  Can any of the
possible threat vectors be minimized?

Regards,
Brian