Re: [OPSAWG] Paul Wouters' Yes on draft-ietf-opsawg-add-encrypted-dns-11: (with COMMENT)

[Paul Wouters <[e-mail]>]

On Mar 15, 2023, at 14:50, [e-mail] wrote:
> 
> Hi Paul, 
> 
> Please see inline.
> 
> Cheers,
> Med
> 
>> -----Message d'origine-----
>> De : Paul Wouters <[e-mail]>
>> Envoyé : mercredi 15 mars 2023 18:00
>> À : BOUCADAIR Mohamed INNOV/NET <[e-mail]>
>> Cc : The IESG <[e-mail]>; draft-ietf-opsawg-add-encrypted-
>> [e-mail]; [e-mail]; [e-mail];
>> [e-mail]; [e-mail]
>> Objet : Re: Paul Wouters' Yes on draft-ietf-opsawg-add-encrypted-
>> dns-11: (with COMMENT)
>> 
>>> On Mar 15, 2023, at 02:35, [e-mail] wrote:
>>> 
>>> 
>>>> 
>>>>      This document targets deployments where a trusted
>> relationship
>>>> is in
>>>>      place between the RADIUS client and server with
>> communication
>>>> optionally
>>>>      secured by IPsec or Transport Layer Security (TLS)
>> [RFC6614].
>>>> 
>>>> I don't understand what this sentence is trying to say.
>>>> 
>>> 
>>> [Med] As per today, the use of ipsec/TLs are optional in RADIUS
>> in trusted networks. As you know there is an effort to make
>> ipsec/TLs mandatory even for trusted networks (and deprecate the
>> use of plain UDP/TCP transport) and also move 6614 to standard
>> track, but all of these are still individual drafts.
>> 
>> But it is still always trusted for authentication. And sending ADD
>> information is still possible and desirable even if radius wasn’t
>> using IPsec or TLS. So I still think the sentence should just be
>> removed.
>> 
> 
> [Med] The use of ipsec/tls between radius client/server is superior even in trusted environments because, otherwise, many attacks would be possible from within the network (gleaning private information, etc.). I prefer to leave the mention of ipsec/TLS. Thank you.  

Yes it is superior but because you say you are targeting that, it makes the radius setups without TLS or IPsec out of scope and I think that’s wrong.

Paul




> 
> 
> _________________________________________________________________________________________________________________________
> 
> Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc
> pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler
> a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,
> Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.
> 
> This message and its attachments may contain confidential or privileged information that may be protected by law;
> they should not be distributed, used or copied without authorisation.
> If you have received this email in error, please notify the sender and delete this message and its attachments.
> As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.
> Thank you.
>