Extensible Authentication Protocol (EAP)
draft-ietf-eap-rfc2284bis-09

I think there are many virtues to this spec, but it needs more attention to the applicability description - this is one reason that SMB has his Discuss, and the problem is epitomized by comments such as:

   Where transport efficiency is a consideration, and IP transport is
   available, it may be preferable to expose an artificially high EAP
   MTU to EAP and allow fragmentation to take place in IP.
   Alternatively, it is possible to choose other security mechanisms
   such as TLS [RFC2246] or IKE [RFC2409] or an alternative
   authentication framework such as SASL [RFC2222] or GSS-API [RFC2743].

How could the same application use GSS-API or SASL if it intended to use EAP?  
They seem to have very different domains of applicability.  It would be good to
discuss the ways that EAP is very applicable and ways in which it can be 
kind of wedged into use, with results that may be only just satisfactory.

  1.  Please pick one spelling and use it throughout the document: 
    - either 'passthrough' or 'pass-through'
    - either 'ad-hoc' or 'ad-hoc' or 'ad hoc'

  2.  In section 1.2, please add the definition of supplicant and 
  slightly revise the definition of EMSK as follows:
  
    supplicant
          The end of the link that responds to the authenticator in
          [IEEE-802.1X].  In this document, this end of the link is
          called the peer.

    Extended Master Session Key (EMSK)
          Additional keying material derived between the EAP client
          and server that is exported by the EAP method.  The EMSK is
          at least 64 octets in length.  The EMSK is not shared with
          the authenticator or any other third party.  The EMSK is
          reserved for future uses that are not defined yet.

  3.  In section 1.3, I find the last sentence of the 4th paragraph
  awkward.  I propose the following rewording:

    As a result, it may be necessary for an authentication algorithm
    to add one or two additional messages (at most one roundtrip)
    between the client and authenticator in order to run over EAP.

  4.  In section 2.4, 1st paragraph, last sentence, the term
  'authenticatees' is introduced.  I think that 'peers' should be used
  instead.  This leads to a problem because 'peers' is used elsewhere
  in the sentence.  Proposal:

    Both ends of the link may act as authenticators and peers at
    the same time.

  5.  In section 3.2, 1st paragraph, 1st sentence: s/must/MUST/
  
  6.  In section 4.2, 7th paragraph at the top of page 25, 1st sentence,
  I cannot figure out what the sentence means:
  
    A mutually authenticating method (such as EAP-TLS [RFC2716]) that
    provides authorization error messages provides protected result
    indications for the purpose of this specification.

  7.  In section 7.11, 2nd paragraph, last sentence:
  s/recommended/RECOMMENDED/