Re: [radext] I-D Action: draft-ietf-radext-radiusdtls-bis-00.txt

[Fabian Mauchle <[e-mail]>]

Hi All,

On 15.10.23 19:26, [e-mail] wrote:
> Internet-Draft draft-ietf-radext-radiusdtls-bis-00.txt is now available. It is
> a work item of the RADIUS EXTensions (RADEXT) WG of the IETF.

Couple of notes while reading the draft:

# Section 3.2 Default ports:
Page 5, at the bottom reads:

 > The default ports for RADIUS/UDP (1812/udp, 1813/udp) and RADIUS/TCP
 > (1812/tcp, 1813/tcp) SHOULD NOT be used for RADIUS/(D)TLS.

While at the end of the section it reads:

 > RADIUS/(D)TLS peers MUST NOT use the old RADIUS/UDP or RADIUS/TCP
 > ports for RADIUS/DTLS or RADIUS/TLS.

So we should decide whether its a SHOULD NOT or a MUST NOT.


# Section 4.2.1, last sentence about trust base changes.
First, I agree rechecking exiting connects SHOULD be done.
However, TLS1.3 no longer supports renegotiation (see 
https://wiki.openssl.org/index.php/TLS1.3#Renegotiation).

I would suggest that
... implementations SHOULD re-verify all certificates of established
connections against the updated trust base and SHOULD close the
connection if it the verification fails.


# Section 7.5.  Migrating from RADIUS/UDP to RADIUS/(D)TLS
Regarding the 'MUST NOT reuse shared secret as TLS-PSK': The 
draft-ietf-radext-tls-psk talks extensively about this, so we should at 
least refer to that (draft or later RFC when published).
I think keeping a short note here is fine to emphasize the point.


Best regards,
Fabian

-- 
Fabian Mauchle, Network

SWITCH
Werdstrasse 2, P.O. Box, 8021 Zurich, Switzerland
Phone [phone], direct [phone]