[radext] Re: Deb Cooley's No Objection on draft-ietf-radext-radiusdtls-bis-15: (with COMMENT)

[Michael Richardson <[e-mail]>]

<#secure method=pgpmime mode=sign>

Deb Cooley via Datatracker <[e-mail]> wrote:
    > General:  TLS 1.2, is there a reason to allow this?  While RFC9325 mandates
    > TLS1.2, draft-ietf-uta-require-tls13 (in AUTH48-done state, also will be under
    > BCP 195) updates this to deprecate TLS 1.2.   Perhaps one could ref BCP195 and
    > remove the references to TLS 1.2 (or at least reference both 9325 and the uta
    > draft)?

Yeah, so the choice for many deployed systems, which could get minor bits of
new functionality, like replacing their radius client library with one that
does DTLS, is that they won't get a new core system library before they are
EOL.  Some might be EOL already.  So the choice really is:

1) cleartext radius with MD5
2) (D)TLS 1.2, (probably via openssl 1.1.x, could be older!)

(DTLS *APIS* are a disaster for any version.  I tried to get them fixed
starting in 2018, but I have gotten nowhere.  DTLS 1.3 libraries are not yet
common.  For many, they will go to TLS/TCP rather than to DTLS)

The text has recommended 1.3. We all want to go there.
But, implementations have to be ready to support 1.2.

Can we stop this witch hunt?  The world is not all browsers.

--
Michael Richardson <[e-mail]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide