Re: [radext] I-D Action: draft-ietf-radext-tls-psk-01.txt

[Alexander Clouter <[e-mail]>]

On Tue, 8 Aug 2023, at 18:41, [e-mail] wrote:
>
>    Title           : RADIUS and TLS-PSK
>    Author          : Alan DeKok
>    Filename        : draft-ietf-radext-tls-psk-01.txt
>    Pages           : 12
>    Date            : 2023-08-08
>
> Abstract:
>    This document gives implementation and operational considerations for
>    using TLS-PSK with RADIUS/TLS (RFC6614) and RADIUS/DTLS (RFC7360).

Section 4.1:

I keep re-reading the following and I just don't "get it":

"If an implementation supports both TLS 1.2 and TLS 1.3, it MUST require that TLS 1.3 be negotiated in RADIUS/TLS and RADIUS/DTLS. This requirement prevents reuse of a PSK with multiple TLS versions, which prevents the attacks discussed in [RFC8446] Section E.7."

I understand we need to avoid reusing the same PSK across versions but my brain parses this paragraph as "if your implementation supports both 1.2 and 1.3...just delete the code supporting 1.2 immediately".

I remember, but cannot find, some discussion about this being maybe tied back to avoiding a client being upgraded that was 1.2 only, to support 1.2 and 1.3 but still retaining the same secret and the proceeding to try using it for 1.3.

So I am confused about what the action is here for an implementor if I want to support TLS-PSK on 1.2?

Section 5:

"Implementations MUST use ECDH cipher suites", any reason why I cannot use anything else now or in the future? Should this be "MUST support" instead?

Misc:

s/identies/identities/gi
s/docoument/document/g
s/deriviation/derivation/g
s/administators/administrators/g
s/Implementaions/Implementations/
s/tempation/temptation/g
s/constrast/contrast/g
s/yserver/server/g
s/signicantly/significantly/g
s/supprted/supported/g

Cheers

[1] https://mailarchive.ietf.org/arch/msg/radext/WqO-u5pCZxpIVocm8O7svNd6qhM/