RE: [Emu] WGLC comments for draft-simon-emu-rfc2716bis

["Bernard Aboba" <bernard_aboba at hotmail.com>]

Here are some of the changes to deal with the privacy comment.  Let me know 
if this resolves the issue.

In Section 2.6:

  An EAP-TLS server supporting privacy MUST NOT treat a certificate
  list containing no entries as a terminal condition;  instead it MUST
  bring up the TLS session and then send a hello_request.  The
  handshake then proceeds normally; the client sends a client_hello and
  the server replies with a server_hello, certificate,
  server_key_exchange, certificate_request, server_hello_done, etc.
  For an example, see Appendix B.

The example:

     2. In the case where the peer and server support privacy and
     mutual authentication, the conversation will appear as follows:

     Authenticating Peer     Authenticator
     -------------------     -------------
                             <- EAP-Request/
                             Identity
     EAP-Response/
     Identity (AnonymousNAI) ->

                             <- EAP-Request/
                             EAP-Type=EAP-TLS
                             (TLS Start)
     EAP-Response/
     EAP-Type=EAP-TLS
     (TLS client_hello)->
                             <- EAP-Request/
                             EAP-Type=EAP-TLS
                             (TLS server_hello,
                              TLS certificate,
                      [TLS server_key_exchange,]
                       TLS certificate_request,
                          TLS server_hello_done)
     EAP-Response/
     EAP-Type=EAP-TLS
     (TLS certificate (no cert),
      TLS client_key_exchange,
      TLS change_cipher_spec,
      TLS finished) ->
                             <- EAP-Request/
                             EAP-Type=EAP-TLS
                             (TLS change_cipher_spec,
                               hello_request)
     EAP-Response/
     EAP-Type=EAP-TLS
     (TLS client_hello)->
                             <- EAP-Request/
                             EAP-Type=EAP-TLS
                             (TLS server_hello,
                              [TLS certificate,]
                      [TLS server_key_exchange,]
                       TLS certificate_request,
                          TLS server_hello_done)
     EAP-Response/
     EAP-Type=EAP-TLS
     (TLS certificate,
      TLS client_key_exchange,
      TLS certificate_verify,
      TLS change_cipher_spec,
      TLS finished) ->
                             <- EAP-Request/
                             EAP-Type=EAP-TLS
                             (TLS change_cipher_spec,
                              TLS finished)
     EAP-Response/
     EAP-Type=EAP-TLS ->
                             <- EAP-Success

A version of the document with most of the changes made is available here:
http://www.drizzle.com/~aboba/EMU/draft-simon-emu-rfc2716bis-06.txt



_______________________________________________
Emu mailing list
Emu at ietf.org
https://www1.ietf.org/mailman/listinfo/emu