Re: [radext] Liaison to government agencies

[Bernard Aboba <[e-mail]>]

This is how we got 802.11i deployed in FIPS environments so it’s a good description of how things might be done. In particular, consulting with customers is critical to unblocking deployment.  

On Dec 1, 2022, at 12:00, Margaret Cullen <[e-mail]> wrote:



On Dec 1, 2022, at 2:58 PM, Margaret Cullen <[e-mail]> wrote:

On Nov 23, 2022, at 6:26 PM, Stephen Farrell <[e-mail]> wrote:

On 23/11/2022 23:06, Bernard Aboba wrote:

Stephen said:
"Perhaps the charter text you'd like added would say that the WG needs to
establish what protocol requirements need to be met for FIPS-140 compliance
before defining anything?"
[BA] That seems like a good way to go about it. 

Cool. Next step there would be for someone to propose
concrete wording for that, then our AD can decide to
update the draft charter or not. I can give it a shot
tomorrow if that's useful, and if nobody else does it
first:-)

How about replacing this bullet:

- Defining a secure variant of RADIUS which can be used in a FIPS-140

  compliant environment.

With this:

- Determine what protocol requirements need to be met for FIPS-140 compliance and deployment, consulting with NIST staff and/or operators of FIPS-140 evironments, as needed.  If those protocol requirements are not met by the current RADIUS specifications, define a secure variant of FADIUS which can be used in a FIPS-140 compliant environment.

And., no, I am not suggesting we call anything “FADIUS”.  :-)

s/FADIUS/RADIUS

Margaret

Thoughts?

Margaret