Dear Deb,
Thank you for your time to review the document.
El 25/7/23 a las 1:01, Deb Cooley via Datatracker escribió:
Reviewer: Deb Cooley
Review result: Has Issues
I have reviewed this document as part of the security directorate's
ongoing effort to review all IETF documents being processed by the
IESG. These comments were written primarily for the benefit of the
security area directors. Document editors and WG chairs should treat
these comments just like any other last call comments.
Document: draft-ietf-ace-wg-coap-eap-08
Reviewer: Deb Cooley
Review Date: 2023-07-24 (early review)
The summary of the review is 'Has Issues'.
0. I agree with the terminology comment made by Elliott. I kept losing the
connections between all the IOT device/Controller, COaP Client/Server, and EAP
Authenticator/Peer terminology. My suggestion would be to pick one (Elliott
suggests the EAP terminology) for the document and then construct use
cases/examples linking that terminology to the COaP and IOT terminology.
Thank you for confirming the new direction that should be taken with the
terminology, we will address it in the next version.
1. Section 3.2, steps for the operation: There are overlap in these steps?
Step 0 has part of Step 1 ('the Controller MUST send the first message)? I
would consolidate these steps to remove the overlap. Step 0 is done by the IOT
device, Step 1 is done by the Controller, etc.
Good point, thank you. There should not be any overlap between the
steps, we will remove the text to avoid any confusion.
2. Section 3.3: The IOT device is the EAP authenticator, but it determines
when to initiate re-authentication? This seems awkward. Is it typical?
The IoT device is always the EAP peer, even in the re-authentication
phase. Hopefully, after the terminology is rewritten this should be
clearer.
3. Section 5.1, cipher suite list #0: I'm unfamiliar with this notation, does
it imply that one could choose AES-CCM with 16, 64, or 128? Does one need to
be able to do all of these options? Note: this is also in the IANA section.
Thank you for pointing this out. Here we are referring to OSCORE's
cihpersuites.
We should explicitly state that those are COSE Algorithms, for that
case that is specifically referencing to the COSE algorithm 10. We will
refer to these property in the next version.
https://www.iana.org/assignments/cose/cose.xhtml#algorithms
4. General: There are some grammar/English changes required (note: the
authors' English is 1000% better than my Spanish). I did not have the cycles
to make specific comments on this, my apologies.
Thank you, we will surely review the grammar before resubmitting the
document.
_______________________________________________
Ace mailing list
Ace@ietf.org
https://urldefense.com/v3/__https://www.ietf.org/mailman/listinfo/ace__;!!D9dNQwwGXtA!QnIN9pARnbo037Mo0cKfXKFixr6ydUbxKQ6jtXkgC98wSWVCIxmgcv3U5Uql66IiYfisewb6TE2ySUTq$
_______________________________________________
Ace mailing list
Ace@ietf.org
https://www.ietf.org/mailman/listinfo/ace
