Re: [radext] I-D Action: draft-ietf-radext-radiusdtls-bis-00.txt

Fabian Mauchle <> Tue, 07 November 2023 08:49 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id BC0F3C1519A2 for <>; Tue, 7 Nov 2023 00:49:26 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -2.807
X-Spam-Status: No, score=-2.807 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (2048-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id 9cfW5yKmh1wr for <>; Tue, 7 Nov 2023 00:49:22 -0800 (PST)
Received: from ( []) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id CFCC7C15107A for <>; Tue, 7 Nov 2023 00:49:20 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple;; l=1608; s=selector1; t=1699346962; h=message-id:date:mime-version:subject:to:references:from: in-reply-to:content-transfer-encoding; bh=DkGWeunBzTabZ2rJZOCyDB8WQa+Yb836hOHcNj+9VN8=; b=FXOvDDPZU9uRC8MFfJLrO3qUbNLtX+odh5nXNxNWoshgqwX9nYmLuwY5 A6Ilu5R1nnz8DTtymSDpZRexsLKNkZtC2qfBGnGGCHhajlTNLltFUV+A8 +6YqVwUeoQj8uVTy4HvgYoNISUya0c3i+jlubOpNaWN2iUnPgDLfd05VM 7380FaI8yxy9l5Eyd8rQ7zdsGEuoys/i6VZzWDjGdCogPm2pc6CZkOlvT dbHEVoGRQclcVP7u686XAQDb7HB1febAXJ4jXI1n3QDpQQvBLcW5Koqrd e2v3uX7fxGgpOfWRDxT86YdqY8onNQurtfC2UzCsJkSPuU5XzoaOkagoQ A==;
X-IronPort-AV: E=Sophos;i="6.03,283,1694728800"; d="scan'208";a="5852071"
Received: from unknown (HELO ([]) by with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 07 Nov 2023 09:49:17 +0100
Received: from [] ( by ( with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1118.37; Tue, 7 Nov 2023 09:49:16 +0100
Message-ID: <>
Date: Tue, 07 Nov 2023 09:49:16 +0100
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Content-Language: en-US, de-CH
References: <>
From: Fabian Mauchle <>
In-Reply-To: <>
Content-Type: text/plain; charset="UTF-8"; format="flowed"
Content-Transfer-Encoding: 7bit
X-Originating-IP: []
X-ClientProxiedBy: ( To (
Archived-At: <>
Subject: Re: [radext] I-D Action: draft-ietf-radext-radiusdtls-bis-00.txt
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: RADIUS EXTensions working group discussion list <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Tue, 07 Nov 2023 08:49:26 -0000

Hi All,

On 15.10.23 19:26, wrote:
> Internet-Draft draft-ietf-radext-radiusdtls-bis-00.txt is now available. It is
> a work item of the RADIUS EXTensions (RADEXT) WG of the IETF.

Couple of notes while reading the draft:

# Section 3.2 Default ports:
Page 5, at the bottom reads:

 > The default ports for RADIUS/UDP (1812/udp, 1813/udp) and RADIUS/TCP
 > (1812/tcp, 1813/tcp) SHOULD NOT be used for RADIUS/(D)TLS.

While at the end of the section it reads:

 > ports for RADIUS/DTLS or RADIUS/TLS.

So we should decide whether its a SHOULD NOT or a MUST NOT.

# Section 4.2.1, last sentence about trust base changes.
First, I agree rechecking exiting connects SHOULD be done.
However, TLS1.3 no longer supports renegotiation (see

I would suggest that
... implementations SHOULD re-verify all certificates of established
connections against the updated trust base and SHOULD close the
connection if it the verification fails.

# Section 7.5.  Migrating from RADIUS/UDP to RADIUS/(D)TLS
Regarding the 'MUST NOT reuse shared secret as TLS-PSK': The 
draft-ietf-radext-tls-psk talks extensively about this, so we should at 
least refer to that (draft or later RFC when published).
I think keeping a short note here is fine to emphasize the point.

Best regards,

Fabian Mauchle, Network

Werdstrasse 2, P.O. Box, 8021 Zurich, Switzerland
Phone +41 44 268 15 30, direct +41 44 268 15 39