I think any EAP lower layer should be required to implement validation of the MSK between the EAP peer and EAP authenticator. If you are going to mention re-ordering you might also mention fragmentation. Here is some suggested text, but I don't think I captured all the information from the thread on this topic.
"2.4. EAP over IP The original EAP applicability statement states that EAP is applicable in cases where "IP layer connectivity may not be available". The wording in the applicability statement leaves open whether the transport of EAP over IP is in scope or not. Since protocols which carry EAP over IP already exist and have been deployed, it is due to make this use case explicit and reflect it in the revised applicability statement. Examples of EAP over IP protocols include PANA protocol [RFC5191] and IKEv2. Since protocols which carry EAP over IP already exist and have been deployed, it is due to make this use case explicit and reflect it in the revised applicability statement. There are some considerations to consider when EAP is used over other transports. The statement needs to take into account though that EAP requires ordering guarantees from its lower layers, which are not delivered by IP in itself. This limits the use of EAP to transport layers which are on top of IP, and provide their own ordering guarantees. In addition, many EAP methods do not provide fragmentation so lower layers that limit the payload size may artificially constrain the use of some EAP methods. Since it is common for the authentication server to be separated by from the authenticator lower layer protocols MUST provide a mechanism for the EAP Peer and EAP authenticator to prove possession of the EAP MSK to ensure the EAP Peer and EAP authenticator are authenticated to one another. " _______________________________________________ abfab mailing list [email protected] https://www.ietf.org/mailman/listinfo/abfab
