Re: [secdir] SECDIR review of draft-ietf-hokey-key-mgm

Kurt Zeilenga [mailto://Kurt.Zeilenga@Isode.com] writes:

...

> The security consideration starts by saying:
>     This section provides security requirements and an analysis on
> transporting EAP keying material using an AAA protocol.
> While 6.1 appears to provide the former, 6.2 (the remaining section)
> seems to discuss a particular concern in transporting EAP keying
> material in an APP protocol.  

No.  AFAIK, the only existing protocols in which EAP key transport take
place are AAA.

> That is, the "analysis" appears to be
> limited to a particular concern.  

What the double quotes?

? Is this the only concern?

I would assume so; does that need to be spelled out?

> I would like to see the Security Consideration section to incorporate
> by informative references general discussions of security
> considerations for key technologies (e.g., EAP).

Why?  The EAP (or ERP) authentication is by definition complete by the time
any keys are exported by the EAP method, so it's hard to see how those
considerations are relevant.

> Beyond this, I'm afraid I do not have sufficient experience in the key
> technologies to be able to determine if security considerations are
> well covered or not.
> Regards, Kurt
> 
> 
> 
> 
> _______________________________________________
> secdir mailing list
> secdir@ietf.org
> https://www.ietf.org/mailman/listinfo/secdir