Subject: [eap] Re: EAP WG Charter strawman

From: [email-masked] (Bernard Aboba)
Date: Sun, 26 May 2002 09:58:05 -0700 (PDT)

> >8.  Clarification and documentation of EAP keying framework.
> 
> What is this?  Does it exist?

Here are some drafts that relate to this issue:

http://www.ietf.org/internet-drafts/draft-aboba-pppext-key-problem-01.txt
http://www.ietf.org/internet-drafts/draft-walker-aaa-key-distribution-00.txt

> >9.  EAP method requirements.
> 
> This seems extremely vague to me.  Are we going to define method 
> requirements for every possible environment (PPP, 3G cellular, WLAN)?  With 
> the possible exception of the first (which probably be done in the pppext 
> WG anyway), that seems extraordinarily presumptuous.

The intent is for EAP WG to produce a document to set the stage for a
rechartered EAP WG (or a new WG, EAPEXT) to review methods. The following
questions will arise in such a review effort:

a. On what basis are the methods reviewed? What do we look for?
b. What are the requirements for methods that are standardized?

Since there has already been some input from 802.11 (who have sent a
letter to IESG) and 3G (who also made requests) relating to EAP methods,
this might consist of writing up the requirements we've already gotten
from them,  and perhaps elaborating on them a bit. I would agree that it
is probably not appropriate for an IETF WG to decide what is required for
802.11 or 3G by itself. 

> >The EAP WG is not currently chartered to review or standardize EAP
> >methods.
> 
> Since this is the main request of 802.11i (as I understand it the major 
> driver behind the creation of this proposed WG), I can't see how this is 
> very helpful.  Maybe there is a need for yet another BOF?

The IESG appears willing to consider chartering an EAP WG based on the
results of the last BOF. However, before adding a charter item for method
review, there is the need to articulate the basis for that review and the
goals that are going to be accomplished by it. 

The EAP IANA considerations describe the process for assignment of type
codes, including review requirements. So that establishes the mechanism
by which the review occurs. However, there is also the need for some
guidelines in the review process; that is what item #9 is about. If the
requests of 802.11i were written up in a draft, that would help start the
discussion.

Out of curiosity, what are you advocating needs to be added to the
charter? 

a. Standardization of a single method that fulfills the requirements
articulated by 802.11i?

b. Standarization of any method meeting those requirements?

c. Review of methods submitted for type code allocation, for correctness
in EAP usage?

d. Security review of methods submitted for type code allocation?