Re: [secdir] review of draft-ietf-hokey-arch-design-08

[Glen Zorn <[e-mail]>]

On 11/14/2011 5:01 PM, Ondřej Surý wrote:
> Hi,
> 
> I have reviewed this document as part of the security directorate's
> ongoing effort to review all IETF documents being processed by the
> IESG.  These comments were written primarily for the benefit of the
> security area directors.  Document editors and WG chairs should treat
> these comments just like any other last call comments.
> 
> I haven't been following HOKEY at all, so the comments are basically
> from innocent bystander who knows as much about EAP as needed to type
> the password for WiFi in the 802.1x (and is user of eduroam network).
> 
> The HOKEY architectural document seems to be clearly written and can
> be understood even by me.  It does not introduce neither any new protocol
> nor security issues and is just a summary of existing standards or I-Ds,
> so there are no security concerns in this particular document.  Some
> security concerns are referenced to other RFCs (Section 7), but they
> are just #includes from other documents and not something new introduced
> by this document.
> 
> One minor nit:
> 
> - You suddenly start to use rRK and DSrRK in the tables (4 and 5) in section 5.
> It would help readability to explain somewhere what these abbreviations mean.

How's this:

2.  Terminology

   This document contains no normative language, hence [RFC2119]
   language does not apply.

   This document reuses terms defined in Section 2.2 of Ohba, et al.
   [RFC5836] and Section 2 of Wu, et al.  [I-D.ietf-hokey-rfc5296bis].
   In addition, it defines the following:

   DSrRK
      Domain-Specific reauthentication Root Key.

...