Subject: [eap] EAP methods, EAP charter, the marketplace and the IETF

From: [email-masked] (Luca Salgarelli)
Date: 27 Sep 2002 12:39:19 -0400

Hello all.

I am sure that many of you have noticed the increasing frequency with
which many manufacturers of networking gear, networking software and
operating systems publish press releases related to the inclusion in
their products of solutions based on specific EAP methods.

I know that the EAP WG charter has been approved, and that decision was
taken not to include in it any work on EAP methods, or even on
requirements for EAP methods for specific applications or classes of
networks.

As I did in the past, I would like to voice my concern about this
approach.  The press releases mentioned above reflect a real and
immediate need of the marketplace for the standardization of EAP
methods. If no standardization efforts will be taken on, the risk is
that only de-facto standards will be implemented in products. And this,
in my opinion, will create real interoperability issues in the long run.

To make a not-so-distant parallel, think about what happened with user
authentication in the IPSec world, how XAuth extensions were not
properly standardized to begin with, how that has brought us to
non-interoperable IPSec clients, and how lengthy has it been the process
to correct that situation.

I know that we, the IETF, have limited bandwidth, and I understand that
this played a key role in how the EAP WG charter was drafted.  However,
in view of the marketplace situation, I believe that waiting for the
current EAP charter to be completed before initiating work on EAP
methods, or at least on requirements for specific classes of networks
for EAP methods, is a mistake.

No matter how many people will work on the current work charter, and I
apologize for one for not having been able to help much with them so
far, the charter will not be completed at least for another six months. 
I think by then de-facto standards for EAP methods could be a reality in
the marketplace, and any further work by the IETF to standardize EAP
methods could become rather difficult.

Is it possible to reserve half an hour at the next EAP meeting in
Atlanta to discuss these issues?

Thanks, and I apologize for the long message.

Cheers
Luca

---

From: [email-masked] (Bernard Aboba)
Date: Fri, 27 Sep 2002 09:39:26 -0700 (PDT)

> Atlanta to discuss these issues?

We have two slots for EAP WG, so that some time can be made available for
this discussion.

---

From: [email-masked] (Bernard Aboba)
Date: Mon, 30 Sep 2002 13:16:17 -0700 (PDT)

> The main concern is that if the IETF (or the EAP WG in particular)
> is going to evaluate EAP methods, it should presumably know beforehand
> what to evaluate them against.

Specifically, the IANA considerations section of RFC 2284bis will trigger
a new procedure for allocation of EAP types, with a spec and some kind of
Expert Review required prior to allocation.

RFC 2248bis does lay out guidelines by which the Expert Review might be
conducted. But that isn't the same things as describing guidelines for
standardization, which seems to be what Luca is suggesting is needed.

---

From: Erik Nordmark <[email-masked]> (Erik Nordmark)
Date: Mon, 30 Sep 2002 17:55:31 +0200 (CEST)

> this played a key role in how the EAP WG charter was drafted. 

That wasn't the main concern - I don't even know if it came up as a concern.

The main concern is that if the IETF (or the EAP WG in particular)
is going to evaluate EAP methods, it should presumably know beforehand
what to evaluate them against. But there isn't a clear document that
can be used as a basis for such evaluations. The intent is that the
initial deliverables provide a basis for something that can be used
to evaluate EAP methods.

Of course, this doesn't prevent folks that are proposing new EAP methods
to develop and refine the individual I-Ds in parallel with the refinement
of the EAP specification, so that when the base spec is more clear there
is less time needed to switch into EAP method evaluation.

   Erik