Re: [radext] Eric Rescorla's No Objection on draft-ietf-radext-coa-proxy-05: (with COMMENT)

[Alan DeKok <[e-mail]>]

On Aug 15, 2018, at 3:47 PM, Adam Roach <[e-mail]> wrote:
> 
> Alan --
> 
> Thanks for the new text. This is a nice set of improvements overall, but I still
> have concerns relating to the contents of the Operator-NAS-Identifier attribute.
> 
> ---------------------------------------------------------------------------
> 
> §3.4:
> 
> >  Length
> >
> >     4 to 23.
> >
> >     Implementations supporting this attribute MUST be able to handle
> >     between one (1) and thirty-two (32) octets of data.
> 
> It seems to me that "4 to 23" needs updating here.

  Yes.  I'll fix that.

> Alternately, and this is my suggestion, remove "encrypt" entirely from this
> section, replacing it with "obfuscate." Concretely:
> 
>       The second method is to obfuscate the NAS IP address using information
>       known locally by the Visited network; for example, by XORing it with a
>       bitmask.  The output of that obfuscation operation is data that can be
>       used as the value of Operator-NAS-Identifier.  On reception of a CoA
>       packet, the locally-known information can be used to un-obfuscate the
>       value of Operator-NAS-Identifier, in order to determine the actual NAS
>       IP address.
> 
> Given that we've established that actual encryption isn't necessary here, this
> seems easier than expanding the field to be large enough to actually encrypt
> stuff.

  That sounds better.

> ---------------------------------------------------------------------------
> 
> §2.1:
> 
> >  In order to determing the "next hop" for a packet, the proxying
> 
> Nit: "...determine..."

  Fixed.

  Alan DeKok.