Extensible Authentication Protocol (EAP) Method Requirements for Wireless LANs
draft-walker-ieee802-req-04

[Ballot discuss]
Tracking the following discuss for Bert while he is on vacation:

[2004-06-10] The document mentions:
  Open issues:
    http://www.drizzle.com/~aboba/EAP/eapissues.html
and that web page lists issue 243 as "Pending for resolution".
So what is the status?

Based on OPS Directorate review (by Pekka):
There is a citation to [RFC3579] in Security COnsiderations Section
which seems to be normative to me. So I'd say that the reference
must be moved to the normative references section. Can be done by
RFC Editor note.

Comment:
[2004-06-10]
There is a normative ref to this "work in progress"
  [IEEE802.11i]
          Institute of Electrical and Electronics Engineers, "Unapproved
          Draft Supplement to Standard for Telecommunications and
          Information Exchange Between Systems - LAN/MAN Specific
          Requirements - Part 11: Wireless LAN Medium Access Control
          (MAC) and Physical Layer (PHY) Specifications: Specification
          for Enhanced Security", IEEE Draft 802.11i (work in progress),
          2003.
We may want/need to check that this will not deadlock the requested for
publication by IEEE.

[Ballot discuss]
The document mentions:
  Open issues:
    http://www.drizzle.com/~aboba/EAP/eapissues.html
and that web page lists issue 243 as "Pending for resolution".
So what is the status?

Based on OPS Directorate review (by Pekka):
There is a citation to [RFC3579] in Security COnsiderations Section
which seems to be normative to me. So I'd say that the reference
must be moved to the normative references section. Can be done by
RFC Editor note.

[Ballot comment]
There is a normative ref to this "work in progress"
  [IEEE802.11i]
          Institute of Electrical and Electronics Engineers, "Unapproved
          Draft Supplement to Standard for Telecommunications and
          Information Exchange Between Systems - LAN/MAN Specific
          Requirements - Part 11: Wireless LAN Medium Access Control
          (MAC) and Physical Layer (PHY) Specifications: Specification
          for Enhanced Security", IEEE Draft 802.11i (work in progress),
          2003.
We may want/need to check that this will not deadlock the requested for
publication by IEEE.

[Ballot discuss]
Blue Team reviewer Discuss, entered in the tracker:
I think this is a very reasonable document, but I see one glitch, a
gap between the mandatory requirements and the Security Considerations.

In the mandatory requirements (2.2[3]), the requirement is only for
mutual authentication support, but the Security Considerations state
that authorization as well as mutual authentication is required:

    EAP peer and authenticator authorization must be performed.  Issues
    relating to authorization are discussed in [RFC3748] Section 7.15,
    and [RFC3579] Section 4.3.7.

I haven't heard any discussions of authorization by 802.11i, so I have
no knowledge of whether authorization is feasible, out-of-scope, etc.
But the section sticks out, and it makes relationship of the Security
Considerations to the rest of the document unclear.  Does the Security
Considerations section provide further requirements for IEEE 802.11i?
If it doesn't, then there needs to be a sentence noting that the
section is there to provide advisory information.

I don't know if it's possible to give an RFC Editor Note to a document
that comes to the IETF approved by IEEE, but my suggestion is a sentence
introducing the Security Considerations clarifying its role.

I'll change this Discuss to a comment if the AD and Russ (as the
author whose Security Considerations are quoted) believe that there is
no benefit to the community in making a change to the document.

[Ballot discuss]
The document mentions:
  Open issues:
    http://www.drizzle.com/~aboba/EAP/eapissues.html
and that web page lists issue 243 as "Pending for resolution".
So what is the status?