Subject: [Emu] I-D Action: draft-ietf-emu-rfc5448bis-01.txt

From: [email-masked]
Date: Mon, 02 Jul 2018 07:06:23 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the EAP Method Update WG of the IETF.

        Title           : Improved Extensible Authentication Protocol Method for 3rd Generation Authentication and Key Agreement (EAP-AKA')
        Authors         : Jari Arkko
                          Vesa Lehtovirta
                          Vesa Torvinen
                          Pasi Eronen
	Filename        : draft-ietf-emu-rfc5448bis-01.txt
	Pages           : 34
	Date            : 2018-07-02

Abstract:
   This specification defines a new EAP method, EAP-AKA', a small
   revision of the EAP-AKA method.  The change is a new key derivation
   function that binds the keys derived within the method to the name of
   the access network.  The new key derivation mechanism has been
   defined in the 3rd Generation Partnership Project (3GPP).  This
   specification allows its use in EAP in an interoperable manner.  In
   addition, EAP-AKA' employs SHA-256 instead of SHA-1.

   This specification also updates RFC 4187 EAP-AKA to prevent bidding
   down attacks from EAP-AKA'.

   This version of the EAP-AKA' specification updates a reference to
   constructing one field in the protocol, so that EAP-AKA' becomes
   compatible with 5G deployments as well.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-emu-rfc5448bis/

There are also htmlized versions available at:
https://tools.ietf.org/html/draft-ietf-emu-rfc5448bis-01
https://datatracker.ietf.org/doc/html/draft-ietf-emu-rfc5448bis-01

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-emu-rfc5448bis-01

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: John Mattsson <[email-masked]>
Date: Tue, 17 Jul 2018 18:11:25 +0000

Hi,

I reviewed the new -01 version. Looks very good. Some additional comments:

-- Section 1 

- Section 5 and 6 is missing from the document structure description. Is this intentional?

- OLD "updates to RFC 5448 AKA' and"
  NEW "updates to RFC 5448 EAP-AKA' and"

-- Section 3

- Some of the lines in Figure 1 are not correctly aligned

-- Section 3.1
  
- OLD "distinghuishable"
  NEW "distinguishable"

-- Section 5

- OLD "the right type of identifiers are used"
  NEW "the right type of identifiers is used"

-- Section 5.2

- OLD "signalling"
  NEW "signaling" (Other parts of the draft is US english, e.g. "authorized")
  
-- Security Consideration

I think the security considerations should be updated to be aligned with current security and privacy practices. They security considerations need to talk more about privacy and pervasive monitoring [RFC6973][RFC7258].

- The privacy issues when SUCI is not used should be described (i.e. passive and/or active IMSI catchers are sniffing cellular identities to identify and/or track users). The security considerations should probably also include a strong recommendation to use SUCI.

- The lack of perfect forward secrecy in EAP-AKA' and it's effects on pervasive monitoring should be described, e.g. attacks on manufacturers of SIM cards opening up for large scale pervasive monitoring and active attacks.

-- Section 8.3

The table in Section 8.3 should be updated to refer to "this document" instead to the to be obsoleted RFC 5448.

-- Appendix E

- OLD "Milenage" 
  NEW "MILENAGE"

- The test vectors in case 1 and case 2 should be as beautifully aligned as case 3 and case 4.

Cheers,
John