I have reviewed this document as part of the security directorate's
ongoing effort to review all IETF documents being processed by the
IESG.  These comments were written primarily for the benefit of the
security area directors.  Document editors and WG chairs should treat
these comments just like any other last call comments.

Document: draft-ietf-ace-wg-coap-eap-08
Reviewer: Deb Cooley
Review Date: 2023-07-24 (early review)

The summary of the review is 'Has Issues'.

0.  I agree with the terminology comment made by Elliott.  I kept losing the connections between all the IOT device/Controller, COaP Client/Server, and EAP Authenticator/Peer terminology.  My suggestion would be to pick one (Elliott suggests the EAP terminology) for the document and then construct use cases/examples linking that terminology to the COaP and IOT terminology.

1. Section 3.2, steps for the operation:  There are overlap in these steps?  Step 0 has part of Step 1 ('the Controller MUST send the first message)?  I would consolidate these steps to remove the overlap.  Step 0 is done by the IOT device, Step 1 is done by the Controller, etc.  

2. Section 3.3:  The IOT device is the EAP authenticator, but it determines when to initiate re-authentication?  This seems awkward.  Is it typical? 

3.  Section 5.1, cipher suite list #0:  I'm unfamiliar with this notation, does it imply that one could choose AES-CCM with 16, 64, or 128?  Does one need to be able to do all of these options?  Note:  this is also in the IANA section.

4.  General:  There are some grammar/English changes required (note:  the authors' English is 1000% better than my Spanish).  I did not have the cycles to make specific comments on this, my apologies.