The eap.arpa. domain and EAP provisioning
draft-ietf-emu-eap-arpa-10

Received changes through RFC Editor sync (changed state to RFC, created became rfc relationship between draft-ietf-emu-eap-arpa and RFC 9965, changed IESG state to RFC Published)

[Ballot comment]
Hi Alan,

Thank you for the effort put into this specification. Appreciate the detailed operational considerations discussed through the document.

Please find below some few comments:

# Abstract

CURRENT:
  This document also updates RFC9140 to deprecate "eap-
  noob.arpa", and replace it with "noob@eap.arpa"

* There is no noob@eap.arpa mention in the document. Should this be changed to “eap.arpa”?

* Alternatively, given that RFC9140 reasons also with noob@eap-noob.arpa, should this text mention “@noob.eap.arpa"

# STD13 vs RFC1034

CURRENT:
  The subdomain MUST follow the syntax
  defined in [RFC7542], Section 2.2, which is a more restrictive subset
  of the domain name conventions specified in RFC1034.
  ..

  However, that registry does
  not follow the domain name conventions specified in RFC1034, so it is
  not possible to make a "one-to-one" mapping between the Method Type
  name and the subdomain.

I suggest to replace all occurrences of RFC1034 with [STD13]

# Experimental Use

CURRENT:
  For experimental uses, it is RECOMMENDED that the "ietf.org" realm is
  used.  Different uses SHOULD be distinguished by using the name of a
  working group or document, such as "emu.ietf.org.v.eap.arpa".

Why is this restricted to WGs? Couldn’t other experiment forms be considered beyond the IETF or you think that those can be covered by use of a vendor subdomain?

# Inappropriate use of normative language

OLD: Other EAP methods MAY omit the username as RECOMMENDED in [RFC7542].
NEW: Other EAP methods MAY omit the username as recommended in [RFC7542].

The reco is already covered in 7542.

# Field

CURRENT:
  result, the EAP peer MUST NOT have a field which lets the user
  identifier field be configured directly. 

Nots sure what “field” means here. I suspect that you meant configuration knob or something similar. If so, you can consider this change:

NEW:
  result, the EAP peer MUST NOT expose a configuration option which lets the user
  identifier field be configured directly. 

# Why this is not “MUST NOT”?

CURRENT:
  While EAP peers allow users to enter user identifiers directly for
  existing EAP methods, they SHOULD NOT check whether those identifiers
  match any EPI. 

# Redundant behavior

Section 3.4.1 has the following:
  EAP peers MUST rate limit attempts at
  provisioning, in order to avoid overloading the server.

Section 3.4.2 says:
  Peers MUST rate-limit their provisioning attempts. 

Please consider keeping this in 3.4.1 only. Pleas note that 3.4.2 is about servers.

# Unspecified behavior in Section 3.4.1

CURRENT:
  This rate
  limiting SHOULD include jitter and exponential backoff.

This text does not explicit how these parameters are defined/used to avoid overload. I see that Section 3.4.2 zooms into this:

  The peer SHOULD retry provisioning no more than once
  every few minutes, and SHOULD perform exponential back-off on its
  provisioning attempts.

I think that it is better to move para to be under 3.4.1 as this is about peers behavior and also answers some of the questions triggered by the current 3.4.1 text:

  Peers MUST rate-limit their provisioning attempts.  If provisioning
  fails, it is likely because provisioning is not available.  Retrying
  provisioning repeatedly in quick succession is not likely to change
  the server behavior.  Instead, it is likely to result in the peer
  being blocked.  The peer SHOULD retry provisioning no more than once
  every few minutes, and SHOULD perform exponential back-off on its
  provisioning attempts.

# General network access?!

CURRENT:
  The limited
  network MUST NOT permit general network access. 

I guess I understand what is meant here, maybe “unrestricted network access” is more explicit about the intent.

# Redundant behavior in Section 3.5

CURRENT:
  Implementations MUST NOT permit EAP method negotiation with
  provisioning credentials.  That is, when an EPI is used, any EAP Nak
  sent by a server MUST contain only EAP method zero (0). 

These are the same requirement. The second MUST is an explanation of the MUST NOT. Please fix this:

NEW:
  Implementations MUST NOT permit EAP method negotiation with
  provisioning credentials.  That is, when an EPI is used, any EAP Nak
  sent by a server must contain only EAP method zero (0). 

# Background and rationale

This section is very useful but too late in the document. Please consider adding a pointer to this section early in the document.

Cheers,
Med

[Ballot comment]
# Internet AD comments for draft-ietf-emu-eap-arpa-09
CC @ekline

* comment syntax:
  - https://github.com/mnot/ietf-comments/blob/main/format.md

* "Handling Ballot Positions":
  - https://ietf.org/about/groups/iesg/statements/handling-ballot-positions/

### S3.2

* "ietf.org" realm is used -> "ietf.org" domain is used

  I read "ietf.org" as the _domain_ that becomes part of the _realm_ per
  the example you give at the end of the sentence.

[Ballot discuss]
** Section 6.3.1

  NAIs in the registry SHOULD NOT contain more than one subdomain.

What is the designated expert supposed to do with this guideline as it relates to approving the registration?  Since “SHOULD NOT” is not a "MUST", does this practically mean this part of the review can be ignored by the expert?

This IESG statement provides guidance on BCP14 key words.  See https://datatracker.ietf.org/doc/statement-iesg-statement-on-clarifying-the-use-of-bcp-14-key-words/.

[Ballot comment]
Thank you to Ines Robles for the GENART review.

** Section 6.1.1

6.1.1.  Deprecating eap-noob.arpa
  IANA is instructed to update the "eap-noob.arpa" entry as follows.
  The USAGE field is updated to add the word DEPRECATED.

Is there a preference to where in the USAGE field the word DEPRECATED is added?  Should be the prefix?

[Ballot comment]
Many thanks to Ben Kaduk for their secdir review and follow up.

Informative References:  FYI... RFC 4210 has been obsoleted by RFC 9810 (https://datatracker.ietf.org/doc/rfc9810/)

[Ballot comment]
Consider introducing the term/abbreviation NAI in Sections 1 or 2. It's expanded in the abstract and used in the definition of EPI (Section 2) with an appropriate reference (thank you!), but the abbreviation isn't expanded in the main text until Section 3.

Section 3.2, it seems strange to scope "experimental" use to ietf.org. Experiments happen other places, too. Perhaps instead say that experiments should happen exclusively within an appropriate vendor space, and "*.ietf.org.v.eap.arpa" can be used for draft version of documents in an IETF working group?

Only need to expand EPI once -- it's not necessary to re-introduce the abbreviation in each section.

Section 4 seems like it would be more useful folded into the Introduction, or perhaps as an Appendix if you feel it's too long for that.

In Section 5.2, I would appreciate an informative reference for "802.11u NAI realm". Also, is it sufficient to advertise the entire universe of possible NAI realms when what's supported is specifically "portal@tls.eap.arpa"? Is it possible to make a more specific advertisement with that mechanism, and if so, why wouldn't we recommend that?

=== NITS FOLLOW ===

3.4: Period at end of sentence
3.4.1: "is no ... issues" => "is no ... issue" or "are no ... issues"
3.4.2: "actoer" => "actors"?
5.1: ". ." => "." and don't put commas around the parentheses
6: "number IANA" => "number of IANA"
8: delete comma after "registry"

[Ballot comment]
Thanks for this useful document and by addressing my previous DISCUSS ballot (including the revised -09 I-D and reply by email).

For archive: https://mailarchive.ietf.org/arch/msg/emu/cnAnNFaRpA8QepcbA-PXABuGjkM/

[Ballot comment]
Thank you for the work that you have put into this document.

The only transoport related topic I found was that peers MUST
rate-limit their provisioning attempts, which is already covered in
the current document. From a transport perspective, I have no
additional comments.

[Ballot discuss]

# Éric Vyncke, INT AD, comments for draft-ietf-emu-eap-arpa-08
CC @evyncke

Thank you for the work put into this document. Even with my DISCUSS ballot, I really like the idea.

Please find below two blocking DISCUSS points (trivial to address), some non-blocking COMMENT points/nits (replies would be appreciated even if only for my own education).

Special thanks to Peter Yee for the shepherd's detailed write-up including the WG consensus *and* the justification of the intended status.

I hope that this review helps to improve the document,

Regards,

-éric


## DISCUSS (blocking)

As noted in https://datatracker.ietf.org/doc/statement-iesg-handling-ballot-positions-20220121/, a DISCUSS ballot is a request to have a discussion on the points below; I really think that the document would be improved with a change here, but can be convinced otherwise.

### Abstract

As flagged by id-nits, when a document updates others, it must also mention them in the abstract (bonus with concise description about what is updated).

### Section 3.7

Please use a MUST NOT in `names in the "eap.arpa" domain SHOULD NOT be looked up in DNS`. Of course, existing implementations won't implement the MUST NOT but a SHOULD would allow cheap implementation to hammer the DNS.

[Ballot comment]

## COMMENTS (non-blocking)

### Title

s/The eap.arpa domain and EAP provisioning/The eap.arpa. domain and EAP provisioning/ (trailing dot after a FQDN). The RFC editor will have the final say.

### Section 1

s/EAP peer have pre-provisioned credentials/EAP peer*s* have pre-provisioned credentials/

### Section 3

Please always add a trailing dot to all FQDN in an I-D, this happens several times and has been noted bu the DNS directorate review.

Who is the "we" in `We note that this specification`? The author ? The WG ? The IETF ? Let's be clear ;-) Also in other sections, e.g., 3.4.

### Section 3.2

Please add an informative reference to `IANA Extensible Authentication Protocol (EAP) Registry`

About the RECOMMENDED and SHOULD in `It is RECOMMENDED that the first subdomain` and `realm registry SHOULD be similar enough` why not using "SHOULD" and "MUST" ?  If the terms are kept unchanged, then an explanation must be stated when the SHOULD can bypassed.

In addition to "v" for vendor, should there be one for private or experimental ?

### Section 3.4.2

What is `malformed EPI` ? Should examples be given (e.g., not matching the IANA registries) ?

In a world of randomized MAC address, how can a EAP server implement: `Servers SHOULD rate-limit provisioning attempts` ?

Should this be a MAY in `Implementations SHOULD use functionality such as the RADIUS Filter-Id` ? After it is a local deployment issue.

Should there be some text that the underlying network (e.g., Wi-Fi AP) MUST prevent inter-EAP-peer communication ? I.e., no hostile EAP peer can attack victim EAP peer while the latter is being provisionned ?

### Section 3.6.2

s/to create credentials which do not expire/to create credentials *that* do not expire/ ?

### Section 5.1

An informative reference to `web CAs` would be beneficial.

### Section 5?2

The 3rd paragraph is about network access restriction, why not simply pointing to section 3.4.2 ?

### Section 6

Unsure whether "deprecated" is the right term in `The "noob@eap-noob.arpa" registry entry is deprecated`, suggest using "deleted" but obviously IANA will have the final say.

Please provide informative references (including URI) for all registries, e.g., https://www.iana.org/domains/arpa

IESG/Authors/WG Chairs:

IANA has completed its review of draft-ietf-emu-eap-arpa-06. If any part of this review is inaccurate, please let us know.

IANA understands that, upon approval of this document, there are three actions which we must complete.

First, in the .ARPA Zone Management registry located at:

https://www.iana.org/domains/arpa

IANA will add eap.arpa with the following description and reference:

For provisioning within the Extensible Authentication Protocol framework.

Reference: [ RFC-to-be ]

Second, a new registry is to be created called the EAP Provisioning Identifiers registry. The new registry will be located in the Extensible Authentication Protocol (EAP) Registry group located at:

https://www.iana.org/assignments/eap-numbers/

The new registry will be managed via Expert Review as defined in [RFC8126].

There are two, initial registrations in the new registry as follows:

NAI Method Reference
---+-------+-----------
@noob.eap.arpa EAP-NOOB [RFC9140][ RFC-to-be ]
portal@tls.eap.arpa EAP-TLS [RFC9190][ RFC-to-be ]

Third, the Special Use Domain Names registry located at:

https://www.iana.org/assignments/special-use-domain-names/

will have a single new registration added as follows:

Name: eap.arpa.
Reference: [ RFC-to-be ]

We understand that these are the only actions required to be completed upon approval of this document.

NOTE: The actions requested in this document will not be completed until the document has been approved for publication as an RFC. This message is meant only to confirm the list of actions that will be performed.

For definitions of IANA review states, please see:

https://datatracker.ietf.org/help/state/draft/iana-review

Thank you,

David Dong
IANA Services Sr. Specialist

The following Last Call announcement was sent out (ends 2025-05-13):

From: The IESG
To: IETF-Announce
CC: draft-ietf-emu-eap-arpa@ietf.org, emu-chairs@ietf.org, emu@ietf.org, paul.wouters@aiven.io, peter@akayla.com
Reply-To: last-call@ietf.org
Sender:
Subject: Last Call:  (The eap.arpa domain and EAP provisioning) to Proposed Standard


The IESG has received a request from the EAP Method Update WG (emu) to
consider the following document: - 'The eap.arpa domain and EAP provisioning'
  as Proposed Standard

The IESG plans to make a decision in the next few weeks, and solicits final
comments on this action. Please send substantive comments to the
last-call@ietf.org mailing lists by 2025-05-13. Exceptionally, comments may
be sent to iesg@ietf.org instead. In either case, please retain the beginning
of the Subject line to allow automated sorting.

Abstract


  This document defines the eap.arpa domain as a way for Extensible
  Authentication Protocol (EAP) peers to signal to EAP servers that
  they wish to obtain limited, and unauthenticated, network access.
  EAP peers signal which kind of access is required via certain pre-
  defined identifiers which use the Network Access Identifier (NAI)
  format of RFC 7542.  A table of identifiers and meanings is defined,
  which includes entries for RFC 9140.




The file can be obtained via
https://datatracker.ietf.org/doc/draft-ietf-emu-eap-arpa/



No IPR declarations have been submitted directly on this I-D.

# Document Shepherd Write-Up for Group Documents

*This version is dated 4 July 2022.*

Thank you for your service as a document shepherd. Among the responsibilities is
answering the questions in this write-up to give helpful context to Last Call
and Internet Engineering Steering Group ([IESG][1]) reviewers, and your
diligence in completing it is appreciated. The full role of the shepherd is
further described in [RFC 4858][2]. You will need the cooperation of the authors
and editors to complete these checks.

Note that some numbered items contain multiple related questions; please be sure
to answer all of them.

## Document History

1. Does the working group (WG) consensus represent the strong concurrence of a
  few individuals, with others being silent, or did it reach broad agreement?

Of those active in the WG, there was broad agreement to advance this ancillary specification. Perhaps more telling, there’s already another (Standards Track) draft that makes use of this specification.

2. Was there controversy about particular points, or were there decisions where
  the consensus was particularly rough?

No. All points raised during the discussion were addressed satisfactorily. The author has been quick to make requested changes with little pushback.

3. Has anyone threatened an appeal or otherwise indicated extreme discontent? If
  so, please summarize the areas of conflict in separate email messages to the
  responsible Area Director. (It should be in a separate email because this
  questionnaire is publicly available.)

No one has expressed any discontent.

4. For protocol documents, are there existing implementations of the contents of
  the document? Have a significant number of potential implementers indicated
  plans to implement? Are any existing implementations reported somewhere,
  either in the document itself (as [RFC 7942][3] recommends) or elsewhere
  (where)?

This is an ancillary document in so much as it specifies the contents of an EAP NAI and an IANA registry for those values. Thus, the implementations of this specification are embodied in the implementation of specific EAP methods. It is already compatible with existing EAP implementations. Those implementations will not, of course, reference this specification, but the WIP draft-ietf-emu-bootstrapped-tls does reference this draft and use its IANA NAI registry.

## Additional Reviews

5. Do the contents of this document closely interact with technologies in other
  IETF working groups or external organizations, and would it therefore benefit
  from their review? Have those reviews occurred? If yes, describe which
  reviews took place.

This specification defines one way to organize the contents of the EAP NAI field, which is used by EAP methods. Those methods are primarily specified in the IETF in the EMU WG. The EAP method defined by Wi-Fi Alliance for HotSpot 2.0 does not conflict with this draft. Since the specification only defines the previously unspecified and unused eap.arpa realm, it should not impact any other EAP method of which we are not already aware. EAP methods are not required to use NAI conventions described in this draft. Overall, it is not believed that external review is merited.


6. Describe how the document meets any required formal expert review criteria,
  such as the MIB Doctor, YANG Doctor, media type, and URI type reviews.

The document has several requests of IANA. The first is registration of eap.arpa in the .ARPA Zone Management registry. That matter was previously discussed with Mirja Kühlewind and we believe the IAB would be amenable to this registration as the relevant body for .arpa registrations. A new registry called the “Extensible Authentication Protocol (EAP) Registry” is established with Expert Review required to add to it. That will be done with the concurrence of the IESG and the attendant publication of this specification.

7. If the document contains a YANG module, has the final version of the module
  been checked with any of the [recommended validation tools][4] for syntax and
  formatting validation? If there are any resulting errors or warnings, what is
  the justification for not fixing them at this time? Does the YANG module
  comply with the Network Management Datastore Architecture (NMDA) as specified
  in [RFC 8342][5]?

There is no YANG module in this specification.

8. Describe reviews and automated checks performed to validate sections of the
  final version of the document written in a formal language, such as XML code,
  BNF rules, MIB definitions, CBOR's CDDL, etc.

None of the document is written in a formal language.

## Document Shepherd Checks

9. Based on the shepherd's review of the document, is it their opinion that this
  document is needed, clearly written, complete, correctly designed, and ready
  to be handed off to the responsible Area Director?

The document shepherd asserts this to be the case.

10. Several IETF Areas have assembled [lists of common issues that their
    reviewers encounter][6]. For which areas have such issues been identified
    and addressed? For which does this still need to happen in subsequent
    reviews?

The document is subject to the issues listed for the Security Area. The Security Considerations in the document address those concerns that are believed to be relevant.

11. What type of RFC publication is being requested on the IETF stream ([Best
    Current Practice][12], [Proposed Standard, Internet Standard][13],
    [Informational, Experimental or Historic][14])? Why is this the proper type
    of RFC? Do all Datatracker state attributes correctly reflect this intent?

Proposed Standard. The document specifies a provisioning domain (eap.arpa) for use in certain EAP methods, many of which are Standards Track themselves. Given the domain registration requested and so that new EAP methods don’t have to use a downref to an Informational document, Proposed Standard seems logical. The Datatracker state attributes reflect the proposed status.

12. Have reasonable efforts been made to remind all authors of the intellectual
    property rights (IPR) disclosure obligations described in [BCP 79][7]? To
    the best of your knowledge, have all required disclosures been filed? If
    not, explain why. If yes, summarize any relevant discussion, including links
    to publicly-available messages when applicable.

Yes. It is not believed that the establishment of an IANA registry and the creation of a .arpa domain name have any IPR concerns. The author has also submitted a statement (https://mailarchive.ietf.org/arch/msg/emu/N7dMRn88jTGsqYoxH0lfKLZGtms/) of not being aware of any relevant IPR.

13. Has each author, editor, and contributor shown their willingness to be
    listed as such? If the total number of authors and editors on the front page
    is greater than five, please provide a justification.

There’s only one author and he would like to see this document published. (See above link to that statement.)

14. Document any remaining I-D nits in this document. Simply running the [idnits
    tool][8] is not enough; please review the ["Content Guidelines" on
    authors.ietf.org][15]. (Also note that the current idnits tool generates
    some incorrect warnings; a rewrite is underway.)

The document does pass idnits. Regarding the content guidelines, the draft is appropriately named. All required sections are present in the draft. There is a Privacy Concerns section, but not an Implementation Status section, both being optional and the latter being somewhat irrelevant. (See item #4.) Regarding language and style, the draft meets the requirements of the style guide, expands abbreviations appropriately, does not misrepresent its status, adheres to BCP 14, does not use non-inclusive language, and does not seem to contain stale text. There are no diagrams in the document, nor does it contain any use of formal language. The document looks fine in regard to the protocol checklist. Use of example domain names in the draft make correct use of “example.com” where appropriate.

15. Should any informative references be normative or vice-versa? See the [IESG
    Statement on Normative and Informative References][16].

The split between informative and normative references appears correct.

16. List any normative references that are not freely available to anyone. Did
    the community have sufficient access to review any such normative
    references?

All normative references are freely available. They are all RFCs.

17. Are there any normative downward references (see [RFC 3967][9] and [BCP
    97][10]) that are not already listed in the [DOWNREF registry][17]? If so,
    list them.

There are no normative downrefs.

18. Are there normative references to documents that are not ready to be
    submitted to the IESG for publication or are otherwise in an unclear state?
    If so, what is the plan for their completion?

All normative references are to published RFCs.

19. Will publication of this document change the status of any existing RFCs? If
    so, does the Datatracker metadata correctly reflect this and are those RFCs
    listed on the title page, in the abstract, and discussed in the
    introduction? If not, explain why and point to the part of the document
    where the relationship of this document to these other RFCs is discussed.

Publication of this document will not change the status of any existing RFCs. It will update one RFC, but it will not make any change to its status.

20. Describe the document shepherd's review of the IANA considerations section,
    especially with regard to its consistency with the body of the document.
    Confirm that all aspects of the document requiring IANA assignments are
    associated with the appropriate reservations in IANA registries. Confirm
    that any referenced IANA registries have been clearly identified. Confirm
    that each newly created IANA registry specifies its initial contents,
    allocations procedures, and a reasonable name (see [RFC 8126][11]).

The IANA considerations section was reviewed regarding both the .arpa domain registration requested and the new registry created. Both appear correct.

21. List any new IANA registries that require Designated Expert Review for
    future allocations. Are the instructions to the Designated Expert clear?
    Please include suggestions of designated experts, if appropriate.

A new registry for EAP Provisioning Identifiers Registry is created. The instructions to its Designated Experts are clear. (See sections 6.3.1 and 6.5.)

[1]: https://www.ietf.org/about/groups/iesg/
[2]: https://www.rfc-editor.org/rfc/rfc4858.html
[3]: https://www.rfc-editor.org/rfc/rfc7942.html
[4]: https://wiki.ietf.org/group/ops/yang-review-tools
[5]: https://www.rfc-editor.org/rfc/rfc8342.html
[6]: https://wiki.ietf.org/group/iesg/ExpertTopics
[7]: https://www.rfc-editor.org/info/bcp79
[8]: https://www.ietf.org/tools/idnits/
[9]: https://www.rfc-editor.org/rfc/rfc3967.html
[10]: https://www.rfc-editor.org/info/bcp97
[11]: https://www.rfc-editor.org/rfc/rfc8126.html
[12]: https://www.rfc-editor.org/rfc/rfc2026.html#section-5
[13]: https://www.rfc-editor.org/rfc/rfc2026.html#section-4.1
[14]: https://www.rfc-editor.org/rfc/rfc2026.html#section-4.2
[15]: https://authors.ietf.org/en/content-guidelines-overview
[16]: https://www.ietf.org/about/groups/iesg/statements/normative-informative-references/
[17]: https://datatracker.ietf.org/doc/downref/

# Document Shepherd Write-Up for Group Documents

*This version is dated 4 July 2022.*

Thank you for your service as a document shepherd. Among the responsibilities is
answering the questions in this write-up to give helpful context to Last Call
and Internet Engineering Steering Group ([IESG][1]) reviewers, and your
diligence in completing it is appreciated. The full role of the shepherd is
further described in [RFC 4858][2]. You will need the cooperation of the authors
and editors to complete these checks.

Note that some numbered items contain multiple related questions; please be sure
to answer all of them.

## Document History

1. Does the working group (WG) consensus represent the strong concurrence of a
  few individuals, with others being silent, or did it reach broad agreement?

Of those active in the WG, there was broad agreement to advance this ancillary specification. Perhaps more telling, there’s already another (Standards Track) draft that makes use of this specification.

2. Was there controversy about particular points, or were there decisions where
  the consensus was particularly rough?

No. All points raised during the discussion were addressed satisfactorily. The author has been quick to make requested changes with little pushback.

3. Has anyone threatened an appeal or otherwise indicated extreme discontent? If
  so, please summarize the areas of conflict in separate email messages to the
  responsible Area Director. (It should be in a separate email because this
  questionnaire is publicly available.)

No one has expressed any discontent.

4. For protocol documents, are there existing implementations of the contents of
  the document? Have a significant number of potential implementers indicated
  plans to implement? Are any existing implementations reported somewhere,
  either in the document itself (as [RFC 7942][3] recommends) or elsewhere
  (where)?

This is an ancillary document in so much as it specifies the contents of an EAP NAI and an IANA registry for those values. Thus, the implementations of this specification are embodied in the implementation of specific EAP methods. It is already compatible with existing EAP implementations. Those implementations will not, of course, reference this specification, but the WIP draft-ietf-emu-bootstrapped-tls does reference this draft and use its IANA NAI registry.

## Additional Reviews

5. Do the contents of this document closely interact with technologies in other
  IETF working groups or external organizations, and would it therefore benefit
  from their review? Have those reviews occurred? If yes, describe which
  reviews took place.

This specification defines one way to organize the contents of the EAP NAI field, which is used by EAP methods. Those methods are primarily specified in the IETF in the EMU WG. The EAP method defined by Wi-Fi Alliance for HotSpot 2.0 does not conflict with this draft. Since the specification only defines the previously unspecified and unused eap.arpa realm, it should not impact any other EAP method of which we are not already aware. EAP methods are not required to use NAI conventions described in this draft. Overall, it is not believed that external review is merited.


6. Describe how the document meets any required formal expert review criteria,
  such as the MIB Doctor, YANG Doctor, media type, and URI type reviews.

The document has several requests of IANA. The first is registration of eap.arpa in the .ARPA Zone Management registry. That matter was previously discussed with Mirja Kühlewind and we believe the IAB would be amenable to this registration as the relevant body for .arpa registrations. A new registry called the “Extensible Authentication Protocol (EAP) Registry” is established with Expert Review required to add to it. That will be done with the concurrence of the IESG and the attendant publication of this specification.

7. If the document contains a YANG module, has the final version of the module
  been checked with any of the [recommended validation tools][4] for syntax and
  formatting validation? If there are any resulting errors or warnings, what is
  the justification for not fixing them at this time? Does the YANG module
  comply with the Network Management Datastore Architecture (NMDA) as specified
  in [RFC 8342][5]?

There is no YANG module in this specification.

8. Describe reviews and automated checks performed to validate sections of the
  final version of the document written in a formal language, such as XML code,
  BNF rules, MIB definitions, CBOR's CDDL, etc.

None of the document is written in a formal language.

## Document Shepherd Checks

9. Based on the shepherd's review of the document, is it their opinion that this
  document is needed, clearly written, complete, correctly designed, and ready
  to be handed off to the responsible Area Director?

The document shepherd asserts this to be the case.

10. Several IETF Areas have assembled [lists of common issues that their
    reviewers encounter][6]. For which areas have such issues been identified
    and addressed? For which does this still need to happen in subsequent
    reviews?

The document is subject to the issues listed for the Security Area. The Security Considerations in the document address those concerns that are believed to be relevant.

11. What type of RFC publication is being requested on the IETF stream ([Best
    Current Practice][12], [Proposed Standard, Internet Standard][13],
    [Informational, Experimental or Historic][14])? Why is this the proper type
    of RFC? Do all Datatracker state attributes correctly reflect this intent?

Proposed Standard. The document specifies a provisioning domain (eap.arpa) for use in certain EAP methods, many of which are Standards Track themselves. Given the domain registration requested and so that new EAP methods don’t have to use a downref to an Informational document, Proposed Standard seems logical. The Datatracker state attributes reflect the proposed status.

12. Have reasonable efforts been made to remind all authors of the intellectual
    property rights (IPR) disclosure obligations described in [BCP 79][7]? To
    the best of your knowledge, have all required disclosures been filed? If
    not, explain why. If yes, summarize any relevant discussion, including links
    to publicly-available messages when applicable.

Yes. It is not believed that the establishment of an IANA registry and the creation of a .arpa domain name have any IPR concerns. The author has also submitted a statement (https://mailarchive.ietf.org/arch/msg/emu/N7dMRn88jTGsqYoxH0lfKLZGtms/) of not being aware of any relevant IPR.

13. Has each author, editor, and contributor shown their willingness to be
    listed as such? If the total number of authors and editors on the front page
    is greater than five, please provide a justification.

There’s only one author and he would like to see this document published. (See above link to that statement.)

14. Document any remaining I-D nits in this document. Simply running the [idnits
    tool][8] is not enough; please review the ["Content Guidelines" on
    authors.ietf.org][15]. (Also note that the current idnits tool generates
    some incorrect warnings; a rewrite is underway.)

The document does pass idnits. Regarding the content guidelines, the draft is appropriately named. All required sections are present in the draft. There is a Privacy Concerns section, but not an Implementation Status section, both being optional and the latter being somewhat irrelevant. (See item #4.) Regarding language and style, the draft meets the requirements of the style guide, expands abbreviations appropriately, does not misrepresent its status, adheres to BCP 14, does not use non-inclusive language, and does not seem to contain stale text. There are no diagrams in the document, nor does it contain any use of formal language. The document looks fine in regard to the protocol checklist. Use of example domain names in the draft make correct use of “example.com” where appropriate.

15. Should any informative references be normative or vice-versa? See the [IESG
    Statement on Normative and Informative References][16].

The split between informative and normative references appears correct.

16. List any normative references that are not freely available to anyone. Did
    the community have sufficient access to review any such normative
    references?

All normative references are freely available. They are all RFCs.

17. Are there any normative downward references (see [RFC 3967][9] and [BCP
    97][10]) that are not already listed in the [DOWNREF registry][17]? If so,
    list them.

There are no normative downrefs.

18. Are there normative references to documents that are not ready to be
    submitted to the IESG for publication or are otherwise in an unclear state?
    If so, what is the plan for their completion?

All normative references are to published RFCs.

19. Will publication of this document change the status of any existing RFCs? If
    so, does the Datatracker metadata correctly reflect this and are those RFCs
    listed on the title page, in the abstract, and discussed in the
    introduction? If not, explain why and point to the part of the document
    where the relationship of this document to these other RFCs is discussed.

Publication of this document will not change the status of any existing RFCs. It will update one RFC, but it will not make any change to its status.

20. Describe the document shepherd's review of the IANA considerations section,
    especially with regard to its consistency with the body of the document.
    Confirm that all aspects of the document requiring IANA assignments are
    associated with the appropriate reservations in IANA registries. Confirm
    that any referenced IANA registries have been clearly identified. Confirm
    that each newly created IANA registry specifies its initial contents,
    allocations procedures, and a reasonable name (see [RFC 8126][11]).

The IANA considerations section was reviewed regarding both the .arpa domain registration requested and the new registry created. Both appear correct.

21. List any new IANA registries that require Designated Expert Review for
    future allocations. Are the instructions to the Designated Expert clear?
    Please include suggestions of designated experts, if appropriate.

A new registry for EAP Provisioning Identifiers Registry is created. The instructions to its Designated Experts are clear. (See sections 6.3.1 and 6.5.)

[1]: https://www.ietf.org/about/groups/iesg/
[2]: https://www.rfc-editor.org/rfc/rfc4858.html
[3]: https://www.rfc-editor.org/rfc/rfc7942.html
[4]: https://wiki.ietf.org/group/ops/yang-review-tools
[5]: https://www.rfc-editor.org/rfc/rfc8342.html
[6]: https://wiki.ietf.org/group/iesg/ExpertTopics
[7]: https://www.rfc-editor.org/info/bcp79
[8]: https://www.ietf.org/tools/idnits/
[9]: https://www.rfc-editor.org/rfc/rfc3967.html
[10]: https://www.rfc-editor.org/info/bcp97
[11]: https://www.rfc-editor.org/rfc/rfc8126.html
[12]: https://www.rfc-editor.org/rfc/rfc2026.html#section-5
[13]: https://www.rfc-editor.org/rfc/rfc2026.html#section-4.1
[14]: https://www.rfc-editor.org/rfc/rfc2026.html#section-4.2
[15]: https://authors.ietf.org/en/content-guidelines-overview
[16]: https://www.ietf.org/about/groups/iesg/statements/normative-informative-references/
[17]: https://datatracker.ietf.org/doc/downref/