Subject: Re: [precis] problem-statement #5 (new): Review RFC3748 (EAP)

From: "precis issue tracker" <[email-masked]>
Date: Thu, 11 Nov 2010 06:39:11 -0000

#5: Review RFC3748 (EAP)

Changes (by marc.blanchet@…):

  * owner:  => dthaler@…
  * component:  => problem-statement

-- 
---------------------------------------+------------------------------------
 Reporter:  marc.blanchet@…            |       Owner:  dthaler@…            
     Type:  task                       |      Status:  new                  
 Priority:  major                      |   Milestone:                       
Component:  problem-statement          |     Version:                       
 Severity:  -                          |    Keywords:                       
---------------------------------------+------------------------------------

Ticket URL: <http://trac.tools.ietf.org/wg/precis/trac/ticket/5#comment:2>
precis <http://tools.ietf.org/precis/>

---

From: "precis issue tracker" <[email-masked]>
Date: Mon, 22 Nov 2010 19:52:18 -0000

#5: Review RFC3748 (EAP)

Changes (by dthaler@…):

  * status:  new => closed
  * resolution:  => fixed

Comment:

 RFC 3748 section 5 references Stringprep, but the WG did not agree with
 the text (was added by IESG) and there are no known implementations that
 use Stringprep.  The main problem with that text is that the use of
 strings is a per-method concept, not a generic EAP concept and so RFC 3748
 itself does not really use Stringprep, but individual EAP methods could.
 As such, the answers to the template questions are mostly not applicable,
 but a few answers are universal across methods.  The list of IANA
 registered EAP methods is at http://www.iana.org/assignments/eap-numbers
 /eap-numbers.xml#eap-numbers-3

 Comparison Methods: n/a (per-method)

 Case Folding, Case Sensitivity, Case Preservation: n/a (per-method)

 Impact of comparison:
 A false positive results in unauthorized network access (and possibly
 theft of service if some else is billed).
 A false negative results in lack of authorized network access (no
 connectivity).

 User input: n/a (per-method)

 Normalization: n/a (per-method)

 Mapping: n/a (per-method)

 Disallowed characters: n/a (per-method)

 String classes:
 Although some EAP methods may use a syntax similar to other types of
 identifiers, EAP mandates that the actual values must not be assumed to be
 identifiers usable with anything else.

 Internal structure: n/a (per-method)

 User output:
 Identifiers are never human displayed except perhaps as they're typed by a
 human.

 Operations: n/a (per-method)

 Community considerations:
 There is no resistance to change for the base EAP protocol (as noted, the
 WG didn't want the existing text).  However actual use of stringprep, if
 any, within specific EAP methods may have resistance.  It is currently
 unknown whether any EAP methods use stringprep.

-- 
---------------------------------------+------------------------------------
 Reporter:  marc.blanchet@…            |        Owner:  dthaler@…            
     Type:  task                       |       Status:  closed               
 Priority:  major                      |    Milestone:                       
Component:  problem-statement          |      Version:                       
 Severity:  -                          |   Resolution:  fixed                
 Keywords:                             |  
---------------------------------------+------------------------------------

Ticket URL: <http://trac.tools.ietf.org/wg/precis/trac/ticket/5#comment:3>
precis <http://tools.ietf.org/precis/>