Re: [pcp] Implementation Analysis: strong preference for PCP-specific approach

[Margaret Wasserman <[e-mail]>]

Hi Alper,

On Sep 20, 2012, at 4:45 AM, Alper Yegin wrote:
> The major missing piece is the support for EAP re-authentication. It's totally omitted.

See my other message about that.
> 
> Security considerations section is too light on content. Please see PANA's. We need to see a thorough analysis to conclude that the design is complete. For example, there's a mention of DoS resilience, but it's not sufficient. Please refer back to PANA to see how DoS resilience is achieved with EAP lower-layer.
> 
> Also, I don't see the message validity checks (again, see PANA). It's not possible to get a standard state machine w/o that (either in a dedicated section like in RFC 5191, or captured in a distributed way in the document).

Thanks for this feedback.  I will take it into account, as appropriate, depending on how we decide to go forward tomorrow.

Margaret