Re: [HOKEY] draft-gaonkar-radext-erp-attrs-03

David B. Nelson <mailto:dnelson@elbrysnetworks.com> scribbled on
Wednesday, March 12, 2008 5:26 PM:

> Hi Lakshminath,
> 
>> Thanks.  I can followup with a presentation to the RADEXT WG.
>> 
>> The plan was to present a variation of that work, based on Glen's
>> long standing work in the area at the HOKEY meeting.  Charles wants
>> to consider the item as a HOKEY WG item.  I am cc'ing him so he can
>> clarify any misunderstanding on my part.
>> 
>> I can come by the RADEXT meeting and try and address the issues
>> raised. Please let me know how much time I will have.
> 
> 9:50 - 10:00 AM  RADIUS support for EAP Re-authentication
> (Lakshminath Dondeti)
> http://www.ietf.org/internet-drafts/draft-gaonkar-radext-erp-at
> trs-03.txt  
> 
> Based on the decisions in HOKEY this morning, do you want to
> change the focus of the presentation?
> 
> If I understand the direction in HOKEY, there will be an
> un-encrypted RADIUS Key Container Attribute defined for use in
> HOKEY, within a HOKEY draft.

I'm not at all sure that that is a good idea -- it seems to assume the
usage of an external-to-RADIUS protection method (DTLS, IPsec, etc.) &
preclude the usage of RADIUS-based protection (e.g., key wrap).  Surely
you don't imagine that we will revisit this issue once radext makes up
its collective mind?

> RADEXT will continue to pursue Crypto-Agility for
> cryptographic protection on *any* attribute through a merger
> of two of Glen's drafts (Key Wrap and Encrypted Attributes).
> Other RADIUS protection options are RADIUS over DTLS, RADSEC
> and RADIUS over IPsec.

Actually, only RADIUS over DTLS really qualifies, I think: IPsec is
inappropriate for a couple of reasons & RADSEC isn't RADIUS (though it
does qualify as AAA).

> 
> Regards,
> 
> Dave

_______________________________________________
HOKEY mailing list
HOKEY@ietf.org
https://www.ietf.org/mailman/listinfo/hokey