[radext] Confirmation of discussions on RADIUS/(D)TLS at IETF117

[Jan-Frederik Rieckers <[e-mail]>]

Hi everyone,

following up on the last IETF meeting I want to go forward with the 
document.

There were some discussion points that were raised during the meeting 
still waiting for confirmation on this list. I don't know if the chairs 
want to issue a "formal consensus call" on the list, but I just want to 
get a feeling of the consensus to start producing text.

Arran was so kind to submit a pull request regarding the specification 
of application layer watchdogs, DTLS heartbeats, Connection closure 
etc., as agreed in the session.
It can be found here:
https://github.com/Janfred/draft-janfred-radext-radiusdtls-bis/pull/1



The other questions were:



**Mandatory-to-implement Protocol**

Should be either RADIUS/TLS or RADIUS/DTLS mandatory to implement or 
should both be mandatory?

The rough consensus in the room was that RADIUS/TLS should be MANDATORY 
and RADIUS/DTLS is RECOMMENDED.
(Side note: I'd really love a "STRONGLY RECOMMENDED" keyword, something 
in the vicinity of  "OUGHT TO" or "WOULD PROBABLY" from RFC6919, 
/sarcasm off)



**Single Port for auth/accounting**

Current implementations use 2023/tcp and 2023/udp for both 
authentication and accounting. For load balancing/traffic engineering 
reasons it may be good to use different ports as it is with RADIUS/UDP.

The rough consensus in the room was that the document should stay with 
the single port.



**Deletion of MIB References**

The new document has currently no text regarding the MIBs. Should there 
be some text about MIBs for RADIUS/(D)TLS.

There were no strong opinions in the room, since it is not sure who 
actually uses these MIBs. So if there are opinions about this on this 
list, please share :)



**Watchdogs**

(See PR from Arran)
The current spec is ambiguous about the usage of watchdog mechanisms.

The rough consensus was to use the same watchdog mechanism for TLS and 
DTLS, namely Status-Server.



**Add ref to RFC9325 (TLS/DTLS BCP)**

The old spec has some text about MTI cipher suites, implementation 
hints, ...

Since there is RFC9325 which gives recommendations about secure use of 
TLS and DTLS, we should just reference this.



Cheers,
Janfred

-- 
Herr Jan-Frederik Rieckers
Security, Trust & Identity Services

E-Mail: [e-mail] | Fon: [phone] | Fax: [phone]
Pronomen: er/sein | Pronouns: he/him
__________________________________________________________________________________

DFN - Deutsches Forschungsnetz | German National Research and Education 
Network
Verein zur Förderung eines Deutschen Forschungsnetzes e.V.
Alexanderplatz 1 | 10178 Berlin
www.dfn.de

Vorstand: Prof. Dr. Odej Kao (Vorsitzender) | Dr. Rainer Bockholt | 
Christian Zens
Geschäftsführung: Dr. Christian Grimm | Jochem Pattloch
VR AG Charlottenburg 7729B | USt.-ID. DE 1366/23822