Subject: Re: [Emu] Session identifiers for fast re-authentication

From: Jouni Malinen <[email-masked]>
Date: Fri, 1 Feb 2019 23:25:54 +0200

On Mon, Jan 28, 2019 at 8:46 PM Alan DeKok <[email-masked]>
wrote:

>   The EMU charter says:
>
> - Define session identifiers for fast re-authentication for
> EAP-SIM, EAP-AKA, and EAP-AKA’. The lack of this definition
> is a recently discovered bug in the original RFCs.
>
>   I have recently uploaded a document which addresses this point.
>
> https://datatracker.ietf.org/doc/draft-dekok-emu-eap-session-id/

Thanks!

As far as the [FILS] reference is concerned, it should be pointing to IEEE
Std 802.11ai-2016. Which would be something like this in IETF RFC, I guess:
IEEE, "IEEE Standard for Information technology--Telecommunications and
information exchange between systems Local and metropolitan area
networks--Specific requirements - Part 11: Wireless LAN Medium Access
Control (MAC) and Physical Layer (PHY) Specifications - Amendment 1: Fast
Initial Link Setup", IEEE Std 802.11ai-2016.

And a small typo in Section 2.3.1: "[RFC5247] id not define" should be
"[RFC5247] did not define"

For Section 3, it might be clearer to talk about enabling FILS or ERP
rather than fast re-authentication. EAP-SIM and EAP-AKA as currently
defined do allow fast re-authentication (the one defined explicitly for
those EAP methods to be used), i.e., the case that is being enabled here is
establishment of the ERP key hierarchy (which is needed for FILS) when
using EAP-SIM/EAP-AKA fast re-authentication. In other words, replace the
last sentence with something like:
It therefore enables ERP key hierarchy establishment using fast
re-authentication with EAP-SIM and EAP-AKA.

- Jouni