Skip to main content

Early Review of draft-ietf-ace-wg-coap-eap-08
review-ietf-ace-wg-coap-eap-08-secdir-early-cooley-2023-07-24-00

Request Review of draft-ietf-ace-wg-coap-eap
Requested revision No specific revision (document currently at 10)
Type Early Review
Team Security Area Directorate (secdir)
Deadline 2023-07-10
Requested 2023-06-26
Requested by Paul Wouters
Authors Rafael Marin-Lopez , Dan Garcia-Carrillo
I-D last updated 2023-07-24
Completed reviews Secdir Last Call review of -09 by Deb Cooley (diff)
Genart Last Call review of -09 by Roni Even (diff)
Secdir Early review of -08 by Deb Cooley (diff)
Iotdir Early review of -08 by Eliot Lear (diff)
Assignment Reviewer Deb Cooley
State Completed
Request Early review on draft-ietf-ace-wg-coap-eap by Security Area Directorate Assigned
Posted at https://mailarchive.ietf.org/arch/msg/secdir/nZVm7-AyQucU3YbYyKdMJhn3-hg
Reviewed revision 08 (document currently at 10)
Result Has issues
Completed 2023-07-24
review-ietf-ace-wg-coap-eap-08-secdir-early-cooley-2023-07-24-00
I have reviewed this document as part of the security directorate's
ongoing effort to review all IETF documents being processed by the
IESG.  These comments were written primarily for the benefit of the
security area directors.  Document editors and WG chairs should treat
these comments just like any other last call comments.

Document: draft-ietf-ace-wg-coap-eap-08
Reviewer: Deb Cooley
Review Date: 2023-07-24 (early review)

The summary of the review is 'Has Issues'.

0.  I agree with the terminology comment made by Elliott.  I kept losing the
connections between all the IOT device/Controller, COaP Client/Server, and EAP
Authenticator/Peer terminology.  My suggestion would be to pick one (Elliott
suggests the EAP terminology) for the document and then construct use
cases/examples linking that terminology to the COaP and IOT terminology.

1. Section 3.2, steps for the operation:  There are overlap in these steps? 
Step 0 has part of Step 1 ('the Controller MUST send the first message)?  I
would consolidate these steps to remove the overlap.  Step 0 is done by the IOT
device, Step 1 is done by the Controller, etc.

2. Section 3.3:  The IOT device is the EAP authenticator, but it determines
when to initiate re-authentication?  This seems awkward.  Is it typical?

3.  Section 5.1, cipher suite list #0:  I'm unfamiliar with this notation, does
it imply that one could choose AES-CCM with 16, 64, or 128?  Does one need to
be able to do all of these options?  Note:  this is also in the IANA section.

4.  General:  There are some grammar/English changes required (note:  the
authors' English is 1000% better than my Spanish).  I did not have the cycles
to make specific comments on this, my apologies.