Subject: [Gen-art] Gen-ART review of draft-ietf-hokey-erp-aak-07

From: "Miguel A. Garcia" <[email-masked]>
Date: Thu, 2 Feb 2012 15:51:36 +0100

I have been selected as the General Area Review Team (Gen-ART)
reviewer for this draft. For background on Gen-ART, please see the FAQ at
<http://wiki.tools.ietf.org/area/gen/trac/wiki/GenArtfaq>

Please resolve these comments along with any other comments you may receive.

Document: draft-ietf-hokey-erp-aak-07
Reviewer: Miguel Garcia <[email-masked]>
Review Date: 2011-01-02
IETF LC End Date: 2012-02-07

Summary: This draft is on the right track but has open issues, described 
in the review.

Major issues:

- None

Minor issues:

- The main problem I have with this draft is the lack of normative text 
(RFC 2119 reserved words) in relevant paragraphs. If interoperability is 
to be granted, an effort should be taken in adding quite a few more 
normative statements.

However, having said that, the section where I find more that there 
should be more normative text, is Section 3, which is an "Overview" 
section. In general, an overview section should use descriptive, but not 
normative text.

For example, take the last paragraph in Page 5 (that continues to Page 
6). One possible change is to make normative the text and move it outside 
a section whose title is "Overview".

    Upon receiving the message, the ERP/AAK server MUST first use the
    keyName indicated in the keyName-NAI to look up the rIK and MUST
    check the integrity and freshness of the message. Then the ERP/AAK
    server MUST verify the identity of the peer by checking the username
    portion of the KeyName-NAI.  If any of the checks fail, the server
    MUST send an early- authentication finish message (EAP-Finish/Re-auth
    with E-flag set) with the Result flag set to '1'.  Next, the server
    MUST authorize the CAP specified in the CAP-Identifier TLV.  In
    success case, the server MUST derive a pMSK from the pRK for each CAP
    carried in the the CAP-Identifier field using the sequence number
    associated with CAP-Identifier as an input to the key derivation.
    (see d. in the figure 1).

    Then the ERP/AAK server MUST transport the pMSK to the authorized CAP
    via AAA Section 7 as described in figure 2 (see e.1,e.2 in the figure
    2). Note that key distribution in the figure 2 is one part of step d.
    in the figure 1.

The the last paragraph in Section 3 also contains an "Optionally", which 
I believe should be replaced with a capitalized "OPTIONAL"

Another instance: towards the end of Section 5.2, the text reads:

    HMAC-SHA256-128 is mandatory to implement and should be enabled in
    the default configuration.

and should probably be:

    HMAC-SHA256-128 is REQUIRED to be implemented and SHOULD be enabled in
    the default configuration.

Similarly, the last paragraph in Section 5.2 reads:

    If the EAP-Initiate/Re-auth packet is not supported by the SAP, it is
    discarded silently.

and should probably be:

    If the EAP-Initiate/Re-auth packet is not supported by the SAP, it
    SHOULD be discarded silently.

- Another topic, Section 9 (IANA Considerations) reads:

    Further, this document registers a Early authentication usage label
    from the "USRK Key Labels" name space with a value:

       EAP Early-Authentication Root [email-masked]

I am missing the sentence to name the master registry where the USRK Key 
Labels subregistry is stored. This is the Extended Master Session Key 
(EMSK) Parameters registry (I guess). And probably this comment is also 
valid for the rest of the IANA actions: the main registry is not named, 
and it is hard to find it.

/Miguel
-- 
Miguel A. Garcia
+34-91-339-3608
Ericsson Spain

---

From: "Miguel A. Garcia" <[email-masked]>
Date: Fri, 3 Feb 2012 08:18:40 +0100

Zhen,

The issue with IANA is double:

On one side, you need to clearly indicate to IANA which registry they 
need to change.

On another side, someone reading this RFC should be able to go to 
www.iana.org and find the registry.

The solve both issues you don't need a reference to RFC 5295. What you 
need to say "Extended Master Session Key (EMSK) Parameters registry" in 
the IANA considerations section, because this is the official name by 
which the registry is known.

BR,

          Miguel

On 03/02/2012 8:11, Zhen Cao wrote:
>> >        EAP Early-Authentication [email-masked]
>> >
>> >
>> >  Labels subregistry is stored. This is the Extended Master Session Key (EMSK)
>> >  Parameters registry (I guess). And probably this comment is also valid for
>> >  the rest of the IANA actions: the main registry is not named, and it is hard
>> >  to find it.
> [CZ]: EMSK or DSRK lable is defined in the section 8.1 "Key Lables" of
> RFC5295. We will add reference to RFC5295 to fix this. Thanks.
>
>> >

-- 
Miguel A. Garcia
+34-91-339-3608
Ericsson Spain

---

From: "Miguel A. Garcia" <[email-masked]>
Date: Fri, 3 Feb 2012 08:57:12 +0100

Hi Qin Wu:

As far as I remember, there is a policy in force that does not allow URLs 
in RFCs, in particular in the IANA section. I believe that the motivation 
is that URLs can change with time.

The proposal is (something around these lines):

     Further, this document instructs IANA to add a new lable in the User 
Specific Root Keys (USRK) Key Labels of the Extended Master Session Key 
(EMSK) Parameters registry, as follows:

/Miguel

On 03/02/2012 8:43, Qin Wu wrote:
> Hi, Miguel:
> I think you are looking for this registry.
> http://www.iana.org/assignments/emsk-parameters/emsk-parameters.xml
> To make clear, the proposed change is replace the OLD Text
> "
> "
> With the NEW Text:
> "
>     from the "User Specific Root Keys (USRK) Key Labels" name space maintained at
> http://www.iana.org/assignments/emsk-parameters/emsk-parameters.xml
>   with a value:
>
> "
> Hope this addresses your comment.
>
> Regards!
> -Qin Wu
> ----- Original Message -----
> From: "Miguel A. Garcia"<[email-masked]>
> To: "Zhen Cao"<[email-masked]>
> Cc: "Hui Deng"<[email-masked]>;<[email-masked]>; "Stephen Farrell"<[email-masked]>; "General Area Review Team"<[email-masked]>
> Sent: Friday, February 03, 2012 3:18 PM
> Subject: Re: Gen-ART review of draft-ietf-hokey-erp-aak-07
>
>
>> Zhen,
>>

-- 
Miguel A. Garcia
+34-91-339-3608
Ericsson Spain

---

From: Zhen Cao <[email-masked]>
Date: Fri, 3 Feb 2012 15:11:24 +0800

Dear Miguel,

Thanks for the valuable view, see our replies inline.

Best regards,
Zhen

On Thu, Feb 2, 2012 at 10:51 PM, Miguel A. Garcia
<[email-masked]> wrote:
> Summary: This draft is on the right track but has open issues, described in
> the review.
>
> Major issues:
>
> - None
>
> Minor issues:
>
> - The main problem I have with this draft is the lack of normative text (RFC
> 2119 reserved words) in relevant paragraphs. If interoperability is to be
> granted, an effort should be taken in adding quite a few more normative
> statements.
>
> However, having said that, the section where I find more that there should
> be more normative text, is Section 3, which is an "Overview" section. In
> general, an overview section should use descriptive, but not normative text.
>
> For example, take the last paragraph in Page 5 (that continues to Page 6).
> One possible change is to make normative the text and move it outside a
> section whose title is "Overview".
>
> The the last paragraph in Section 3 also contains an "Optionally", which I
> believe should be replaced with a capitalized "OPTIONAL"

[CZ]: Good suggestion, we will revise the draft to reflect this.

>   the default configuration.

[CZ] Okay.

>   SHOULD be discarded silently.

[CZ] Okay.

-- 
Best regards,
Zhen

---

From: Qin Wu <[email-masked]>
Date: Fri, 03 Feb 2012 15:43:03 +0800

Hi, Miguel:

Regards!
-Qin Wu

---

From: Qin Wu <[email-masked]>
Date: Fri, 03 Feb 2012 16:01:12 +0800

Okay, your proposal looks good to me, many thanks.

Regards!
-Qin Wu

---

From: Stephen Farrell <[email-masked]>
Date: Wed, 08 Feb 2012 16:45:28 +0000

Thanks Miguel,

(cc'ing gen-art to close that loop)

S.

On 02/08/2012 02:01 PM, Miguel A. Garcia wrote:
> I did a quick past to the changes that I requested, and I think they are
> successfully implemented in version -08.
>
> /Miguel
>
> On 08/02/2012 13:52, Qin Wu wrote:
>> Hi, Stephen and all:
>> We have just done the update. Diff from previous version:
>> http://tools.ietf.org/rfcdiff?url2=draft-ietf-hokey-erp-aak-08
>>
>> Would you like to go ahead?
>>
>> Regards!
>> -Qin
>> From: "Stephen Farrell"<[email-masked]>
>> To: "Tina TSOU"<[email-masked]>
>> Cc:<[email-masked]>;<[email-masked]>
>> Sent: Wednesday, February 08, 2012 7:41 PM
>> Subject: Re: [HOKEY] Fwd: Gen-ART review of draft-ietf-hokey-erp-aak-07
>>
>>
>>>
>>> Hi,
>>>
>>> IETF LC is ended for this.
>>>
>>> I think the only comment I saw a gen-art review (is
>>> that right?) but that there are changes resulting from
>>> that so I've marked this as revised I-D needed. Please
>>> submit a -08 that includes the changes needed. (I'm not
>>> sure if any of those will require something different
>>> from IANA, but if they do please also respond to IANA's
>>> mail, cc'ing me, if their actions are changed.)
>>>
>>> As soon as we have that I can put this on an IESG
>>> telechat agenda,
>>>
>>> Thanks,
>>> Stephen.
>>>
>>>
>>> On 02/04/2012 07:21 PM, Tina TSOU wrote:
>>>> Good catch. Thank u, Miguel.
>>>>
>>>> Sent from my iPad
>>>>
>>>> On Feb 2, 2012, at 7:04 AM, "Stephen
>>>> Farrell"<[email-masked]> wrote:
>>>>
>>>>>
>>>>> FYI
>>>>>
>>>>> -------- Original Message --------
>>>>> Subject: Gen-ART review of draft-ietf-hokey-erp-aak-07
>>>>> Date: Thu, 2 Feb 2012 15:51:36 +0100
>>>>> From: Miguel A. Garcia<[email-masked]>
>>>>> To: Zhen Cao<[email-masked]>, Hui Deng<[email-masked]>,
>>>>> [email-masked], Stephen Farrell<[email-masked]>
>>>>> CC: General Area Review Team<[email-masked]>
>>>>>
>>>>> Reviewer: Miguel Garcia<[email-masked]>
>>>>> Review Date: 2011-01-02
>>>>> _______________________________________________
>>>>> HOKEY mailing list
>>>>> [email-masked]
>>>>> https://www.ietf.org/mailman/listinfo/hokey
>>>>
>>> _______________________________________________
>>> HOKEY mailing list
>>> [email-masked]
>>> https://www.ietf.org/mailman/listinfo/hokey
>