Re: [radext] Proposed charter text based on IETF-115 BoF

[Jan-Frederik Rieckers <[e-mail]>]

On 24.11.22 16:14, Bernard Aboba wrote:
> For backwards compatibility, servers probably need to support RADIUS and 
> the existing RADIUS over (D)TLS anyway.  So really we're talking about 
> an "SRADIUS" configuration flag.  If a site requires FIPS, why can't it 
> flip the SRADIUS flag and run its SRADIUS server on port 2083?  If some 
> devices can't connect to an SRADIUS-configured server, then those 
> devices don't support SRADIUS and presumably the site wants to point 
> them at another server (one without the SRADIUS flag set), and 
> eventually replace them with devices that support SRADIUS.
But without negotiation of "RADIUS or SRADIUS" we have a huge 
compatibility issue.
Of course you can do this locally if you have control over all involved 
servers, but if you don't then this is not possible without a flag day 
where everyone switches to SRADIUS or you have to configure each 
possible connection individually (which might not even be possible if 
you have federated services, because you don't have a list of all 
possible peers)

I honestly don't see the harm in finishing rfc6614bis simply as update 
to RFC6614 with the traditional RADIUS with MD5-usage inside (along with 
the static shared secret "radsec") and having a separate work item 
adding SRADIUS with a new TCP and UDP port that reference the RADIUS/TLS 
RFC6614(bis) and RADIUS/DTLS RFC7360(bis) specs for definition on how to 
use the TLS layer.

If people are worried about being FIPS compliant, they can choose to use 
SRADIUS with the new port. The implementation overhead for SRADIUS (if 
you already support RADIUS/TLS or RADIUS/DTLS) should be minimal, so 
vendors should be able to implement it quickly and admins may switch to 
SRADIUS at their discretion once their software supports it.

It is not much different than having a "please use SRADIUS" switch, but 
it keeps backwards compatibility and has a good upgrade path for people 
who want to gradually upgrade their RADIUS connections.

Cheers,

Janfred

-- 
E-Mail: [e-mail] | Fon: [phone] | Fax: [phone]
Pronomen: er/sein | Pronouns: he/him
__________________________________________________________________________________

DFN - Deutsches Forschungsnetz | German National Research and Education 
Network
Verein zur Förderung eines Deutschen Forschungsnetzes e.V.
Alexanderplatz 1 | 10178 Berlin
www.dfn.de

Vorstand: Prof. Dr. Odej Kao (Vorsitzender) | Dr. Rainer Bockholt | 
Christian Zens
Geschäftsführung: Dr. Christian Grimm | Jochem Pattloch
VR AG Charlottenburg 7729B | USt.-ID. DE 1366/23822