>    o  All RADIUS work MUST be backward compatible with existing RADIUS
>       RFCs, including RFCs 2865-2869, 3162, 3575, 3576, 3579, 3580 and
>       4668-4671.

  Should cite all the RFCs for which compatibility is being required.

  From the Gen-ART Review by Vijay K. Gurbani...

  1) Section 1: s/[RFC3957] all based/[RFC3957], all based
  (The comma improves readibility)

  2) Section 3: s/reqiuired/required

  3) Section 3.1: In the first and third bullet item, it appears
  appropriate that the word "required" be upper-cased to denote its
  use as a normative declaration.  More so since bullet item two
  contains the word "MUST" in normative fashion.  I believe that
  the authors are making a normative set of declarations for the
  goals, so it appears uneven to have a MUST in the second bullet
  item and not a pair of REQUIREDs in the other two bullets.

Some "Minor nits" from Pasi Eronen's SecDir review:

1) Section 6, "When it comes to protecting attributes in Access
Request, RFC 2868 section 3.5 provides a mechanism for encrypting
RADIUS attributes": This should probably refer to Access-Accept
messages, not Access-Requests.

2) The document contains many references to various RFCs that are not
listed in the References section. To give just one example: "Existing
RADIUS authentication procedures, e.g.  Message-Authenticator (80)
described in RFC2869, are used."

3) Section 3.1, "It is required of the RADIUS servers to be able to
understand and process the attributes described in this specification"
...except that no attributes are described in this specification.

4) From idnits (if these references are useful, they should be
mentioned somewhere in the text as well).

== Unused Reference: 'I-D.nakhjiri-radius-mip4' is defined on line
231, but no explicit reference was found in the text
== Unused Reference: 'RFC2868' is defined on line 236, but no explicit
reference was found in the text
== Unused Reference: 'RFC3579' is defined on line 239, but no explicit
reference was found in the text