Subject: [Emu] draft-aura-eap-noob-08 NAI

From: Max Crone <[email-masked]>
Date: Wed, 22 Apr 2020 12:29:00 +0300

While implementing EAP-NOOB, I found the explanation on the Invalid NAI 
(error code 1001) in the draft to be unclear.

The document formulates it as follows:
 >   If the NAI structure is invalid, the server SHOULD send the error
 >   code 1001 to the peer.

However, does this mean that the EAP-NOOB server should verify that the 
NAI follows the formal syntax as specified in RFC 7542, or should it 
verify that the NAI follows the specification of EAP-NOOB, i.e., it is 
of the form "noob@{eap-noob.net||RESERVED_DOMAIN}". I think this section 
could be formulated more clearly to address these concerns.

On that note, Figure 2 seems to be incomplete. The EAP-Response/Identity 
specifies the NAI parameter to be "[email-masked]", while the 
specification also has the option of configuring this to a reserved 
domain. In that case, the NAI should not use the default realm anymore. 
Currently, this is not reflected in the figure.

If anything remains unclear, I am open for discussion.

~Max Crone

---

From: Mohit Sethi M <[email-masked]>
Date: Fri, 24 Apr 2020 13:02:06 +0000

Hi Max,

Tuomas can give you a definite answer. My understanding is that error 
1001 should be sent by the server if the received identity does not 
follow the requirements of draft-aura-eap-noob. Besides, implementing 
the stricter checks of this draft is easier than validating the ABNF of 
RFC7542 (after which you would anyways need to verify compliance with 
this draft).

And you are right. The absence of server-assigned realm in Figure 2 is 
probably an editorial oversight. However, I wouldn't call the optional 
server assigned realm as RESERVED_DOMAIN. If anything, I would call 
eap-noob.net as a reserved/special use domain.

--Mohit

On 4/22/20 12:29 PM, Max Crone wrote:
> While implementing EAP-NOOB, I found the explanation on the Invalid 
> NAI (error code 1001) in the draft to be unclear.
>
> However, does this mean that the EAP-NOOB server should verify that 
> the NAI follows the formal syntax as specified in RFC 7542, or should 
> it verify that the NAI follows the specification of EAP-NOOB, i.e., it 
> is of the form "noob@{eap-noob.net||RESERVED_DOMAIN}". I think this 
> section could be formulated more clearly to address these concerns.
>
> On that note, Figure 2 seems to be incomplete. The 
> EAP-Response/Identity specifies the NAI parameter to be 
> "[email-masked]", while the specification also has the option of 
> configuring this to a reserved domain. In that case, the NAI should 
> not use the default realm anymore. Currently, this is not reflected in 
> the figure.
>
> _______________________________________________
> Emu mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/emu

---

From: Eliot Lear <[email-masked]>
Date: Fri, 24 Apr 2020 15:22:48 +0200

Hi Mohit

> On 24 Apr 2020, at 15:02, Mohit Sethi M <mohit.m.sethi=[email-masked]> wrote:
> 
> Hi Max,
> 

There are all manner of reasons not to use eap-noob.net.  I think we talked to the IAB about this at some point and they were comfortable with something in .ARPA, but we’d need to reconfirm.  This is a small matter that should be cleared up with a few email exchanges.

Eliot

---

From: Mohit Sethi M <[email-masked]>
Date: Fri, 24 Apr 2020 13:29:53 +0000

Hi Eliot,

On 4/24/20 4:22 PM, Eliot Lear wrote:

Hi Mohit

On 24 Apr 2020, at 15:02, Mohit Sethi M <mohit.m.sethi=[email-masked]><mailto:mohit.m.sethi=[email-masked]> wrote:

Hi Max,

Absolutely. Using something in .arpa makes perfect sense. But until that is allocated, implementations need a temporary placeholder. The current text in section 3.3.1 of the draft even says (https://tools.ietf.org/html/draft-aura-eap-noob-08#section-3.3.1):

The default realm for the peer is "eap-noob.net" (.arpa domain TBA).

--Mohit

Eliot
_______________________________________________
Emu mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/emu