Early Review of draft-ietf-ace-wg-coap-eap-08
review-ietf-ace-wg-coap-eap-08-secdir-early-cooley-2023-07-24-00

I have reviewed this document as part of the security directorate's
ongoing effort to review all IETF documents being processed by the
IESG.  These comments were written primarily for the benefit of the
security area directors.  Document editors and WG chairs should treat
these comments just like any other last call comments.

Document: draft-ietf-ace-wg-coap-eap-08
Reviewer: Deb Cooley
Review Date: 2023-07-24 (early review)

The summary of the review is 'Has Issues'.

0.  I agree with the terminology comment made by Elliott.  I kept losing the
connections between all the IOT device/Controller, COaP Client/Server, and EAP
Authenticator/Peer terminology.  My suggestion would be to pick one (Elliott
suggests the EAP terminology) for the document and then construct use
cases/examples linking that terminology to the COaP and IOT terminology.

1. Section 3.2, steps for the operation:  There are overlap in these steps? 
Step 0 has part of Step 1 ('the Controller MUST send the first message)?  I
would consolidate these steps to remove the overlap.  Step 0 is done by the IOT
device, Step 1 is done by the Controller, etc.

2. Section 3.3:  The IOT device is the EAP authenticator, but it determines
when to initiate re-authentication?  This seems awkward.  Is it typical?

3.  Section 5.1, cipher suite list #0:  I'm unfamiliar with this notation, does
it imply that one could choose AES-CCM with 16, 64, or 128?  Does one need to
be able to do all of these options?  Note:  this is also in the IANA section.

4.  General:  There are some grammar/English changes required (note:  the
authors' English is 1000% better than my Spanish).  I did not have the cycles
to make specific comments on this, my apologies.