Subject: RFC 4851 errata (fwd)

From: Alfred Hönes <[email-masked]>
Date: Sat, 12 May 2007 20:42:00 +0200 (MESZ)

----- Forwarded message from Alfred Hönes -----

>From [email-masked] Sat May 12 20:31:41 MES 2007
From: Alfred Hönes <[email-masked]>
To: [email-masked], [email-masked], [email-masked], [email-masked]
Date: Sat, 12 May 2007 20:31:38 +0200 (MESZ)
Subject: RFC 4851 errata

Hello,
despite of all the effort that went into the final version of
your EAP-FAST specification, I unfortunately found some more
flaws in the recently published RFC 4851.  The items below are
listed in RFC textual order; item (5) is the most important one.

(1)  Section 3.2.1 -- terminological mismatch

Only in this section, the RFC uses the spelling "SessionID" (4 x);
throughout the remainder of the text, "Session ID" is used.

(2)  Section 3.2.3 -- typo

In the 3rd text line of Section 3.2.3, on page 12,
the RFC test:

             ... contains a empty Session ID
should say:
             ... contains an empty Session ID
                            ^

(3)  Section 3.3.1 -- typo

In the second line of the last paragraph of Section 3.3.1,
on page 13, the RFC text:

             ... If either indicates failure. then the method is
should say:
             ... If either indicates failure, then the method is
                                            ^

(4)  Section 3.7 -- typo

In the first line of the second paragraph of Section 3.7,
the RFC text:

   Since EAP is an lock-step protocol, [...]
                 ^
should say:

   Since EAP is a lock-step protocol, [...]

(5)  Section 4.2.9 -- missing specification

At the bottom of page 31, something strange must have happened,
causing the 'Action' code points to be dropped from the final text.

The RFC says:

      Action

         The Action field is two octets.  Values include:

|           Process-TLV

|           Negotiate-EAP
         ^

It should say:

      Action

         The Action field is two octets.  Values include:

|        1  Process-TLV

|        2  Negotiate-EAP
         ^

(6)  Section 5.5 -- typo

In the third line of Section 5.5 (on page 35), as in many other
places in the RFC, the initial

   Where

should be

   where

(7)  Section 6 -- inconsistent use of established terms

The RFC 2434 requirements terms are spelled inconsistently.
For uniformity, at the bottom of page 36,

           ... based on specifications required ...
                        ^            ^ ^
should be:
           ... based on Specification Required ...

and in the fourth line on page 37,

           ... on a specification required basis ...
                    ^             ^
should be:
           ... on a Specification Required basis ...

(8)  Section 7.4.1 -- typos

there are two typos in the last part of the first paragraph
of Section 7.4.1; the lines on top of page 40,
                      vvv
|  is unauthenticated an may not have any relevance to the authenticated
   identity.  EAP-FAST implementations should not attempt to compare any
   identity disclosed in the initial cleartext EAP Identity response
|  packet with those Identities authenticated in Phase 2
                                                        ^
should say:
                        v
|  is unauthenticated and may not have any relevance to the authenticated
   identity.  EAP-FAST implementations should not attempt to compare any
   identity disclosed in the initial cleartext EAP Identity response
|  packet with those Identities authenticated in Phase 2.
                                                        ^

[For clarity, I have not re-adjusted to RFC margins the modified text.]

Item (5) apparently is a significant flaw that should be addressed
by an RFC Errata Note as soon as possible.  I leave it to your
choice whether to include more of the items listed above, as well,
making freely use of the material supplied above.

Kind regards,
  Alfred Hönes.

-- 

+------------------------+--------------------------------------------+
| TR-Sys Alfred Hoenes   |  Alfred Hoenes   Dipl.-Math., Dipl.-Phys.  |
| Gerlinger Strasse 12   |  Phone: (+49)7156/9635-0, Fax: -18         |
| D-71254  Ditzingen     |  E-Mail:  [email-masked]                     |
+------------------------+--------------------------------------------+

----- End of forwarded message from Alfred Hönes -----