Subject: RFC 4746 errata

From: Alfred Hönes <[email-masked]>
Date: Sun, 26 Nov 2006 21:09:42 +0100 (MEZ)

Hello,
studying the recently published RFC 4647 (EAP-PAX) authored by you,
I found a couple of textual issues, two of which seem to be rather
significant.

After presenting these two issues, further typos are reported
in RFC textual order.

I use change bars ('|' in column 1) and occasionally up/down
pointing marker lines ('^^^'/'vvv') to emphasize the location
of textual issues and/or proposed corrections.

(1)  IMPORTANT -- wrong data length specified !

On top of page 18, Section 3.2 says:
          v
|  These 52+L octets are then attached to the packet as the payload.
   [...]

It should say:
          v
|  These 54+L octets are then attached to the packet as the payload.
   [...]

Rationale: cf. preceding text (page 16), and Figure 8 (page 18)!

(2)  IMPORTANT - misleading text / missing unit !

The 1st paragraph of Section 4.3.7, on page 22, contains the sentence:

                  [...].  Consequently, EAP-PAX requires the use of a
|  Diffie-Hellman group with modulus larger than 3000.  [...]
                                                 ^^^^^
It should say instead:

                  [...].  Consequently, EAP-PAX requires the use of a
|  Diffie-Hellman group with modulus larger than 3000 bits.  [...]

Rationale: evident!

(3)  [typo]

On page 6 of RFC 4647, the 1st paragraph of Section 2.1 says:

   PAX_STD is a simple nonce-based authentication using the strong
   long-term key.  [...]

It should say:

|  PAX_STD is a simple nonce-based authentication using a strong
   long-term key.  [...]

(4)  [grammar]

Within Section 2.2, near the bottom of page 8, RFC 4647 says:

   When using EAP-PAX with Wireless LAN, clients SHOULD validate that
   the certificate's wlanSSID extension matches the SSID of the network
   to which it is currently authenticating.

It should say either:

|  When using EAP-PAX with a Wireless LAN, clients SHOULD validate that
   the certificate's wlanSSID extension matches the SSID of the network
   to which it is currently authenticating.

or:

|  When using EAP-PAX with Wireless LANs, clients SHOULD validate that
   the certificate's wlanSSID extension matches the SSID of the network
   to which it is currently authenticating.

(5)  [missing article]

On page 9, the 1st paragraph of Section 2.3 says:

   Messages PAX_STD-2, PAX_STD-3, PAX_SEC-4, PAX_SEC-5, and PAX_ACK
   contain optional component ADE.  [...]

It should say:

   Messages PAX_STD-2, PAX_STD-3, PAX_SEC-4, PAX_SEC-5, and PAX_ACK
|  contain an optional component ADE.  [...]

(6)  [extraneous word]

The 2nd paragraph of Section 4, at the bottom of page 19, says:

                                          [...].  Also note that the
   security of PAX can be proved using under the Random Oracle model.

It should say either:
                                          [...].  Also note that the
|  security of PAX can be proved under the Random Oracle model.

or:
                                          [...].  Also note that the
|  security of PAX can be proved using the Random Oracle model.

Please comment.

In particular, items (1) and (2) seem to deserve an Errata Note.

Preferrably, you should submit an Author's Errata Note to the
RFC Editor's RFC Errata web pages, making freely use of the
material supplied above.  But if you like, I can formally
submit an Errata Note on my own, with your consent.

Best regards,
  Alfred Hönes.

-- 

+------------------------+--------------------------------------------+
| TR-Sys Alfred Hoenes   |  Alfred Hoenes   Dipl.-Math., Dipl.-Phys.  |
| Gerlinger Strasse 12   |  Phone: (+49)7156/9635-0, Fax: -18         |
| D-71254  Ditzingen     |  E-Mail:  [email-masked]                     |
+------------------------+--------------------------------------------+