Re: [secdir] Secdir last call review of draft-ietf-emu-eap-session-id-03

[Benjamin Kaduk <[e-mail]>]

Hi Mališa,

Thanks for the review!
I ended up putting a Discuss ballot on, for a (presumably) copy/paste error
in one of the message names, and wanting a reference for PEAP (which may be
challenging, as it seems to be a Microsoft proprietary protocol).

It would be nice if some cryptographic review of the new Session-Id
constructions was done, but I don't think either of us is the right person
to do it, so we're limited to just asking the authors what has already been
done.

-Ben

On Tue, May 26, 2020 at 06:52:56AM -0700, Mališa Vučinić via Datatracker wrote:
> Reviewer: Mališa Vučinić
> Review result: Has Nits
> 
> I have reviewed this document as part of the security directorate's ongoing
> effort to review all IETF documents being processed by the IESG.  These
> comments were written primarily for the benefit of the security area directors.
> Document editors and WG chairs should treat these comments just like any other
> last call comments.
> 
> The document updates RFC5247 to specify EAP Session-ID definition in case fast
> re-authentication is used with EAP-AKA and EAP-SIM. The Session-ID definition
> is based on a server-generated nonce and a MAC. The document also specifies the
> Session-ID definition for the PEAP method, following the definition of EAP-TLS.
> 
> The document is clear and well written. Security considerations section is
> clear and states no known security issues in the definitions used. A reference
> to PEAP is missing.
> 
> Nits:
> Section 3: s/to not modify/do not modify
> 
>