Please release the hold on draft-ietf-ipsra-reqmts, with the following
paragraph to be added via an RFC Editor's note:

        IPSRA protocols derived from these requirements may be
        vulnerable to man-in-the-middle attacks if legacy credentials
        are reused in another context, or if the protocol or users
        do not support verify the identity of the server
        prior to undertaking legacy authentication. In these
        circumstances, an attacker may tunnel legacy authentication
        methods from an unsuspecting client through the IPSRA
        protocol, obtaining access to the network and potentially
        another credential such as a certificate.

It should replace the current Security Considerations section.

Please hold off processing draft-ietf-ipsra-reqmts.  Some serious
technical questions have been raised; it is not yet clear to me if only
the protocol document (which you don't yet have) needs to be fixed, or
if the requirements themselves need changing.  (I'm not *quite* ready
to yank it back, and I won't have time to think about it until next
week.)

State Changes to Ready for Telechat                                from Wait for Writeup                                  by scoya

State Changes to Last Call Issued                                  from Last Call Requested                              by scoya

State Changes to Last Call Requested                              from AD Evaluation                                    by bellovin

State Changes to AD Evaluation                                    from Approved                                          by scoya