[radext] Re: Deb Cooley's No Objection on draft-ietf-radext-radiusdtls-bis-15: (with COMMENT)

[Deb Cooley <[e-mail]>]

'Can we stop this witch hunt?  The world is not all browsers.'

Pardon?  Did I say anything about browsers?  Is it not ok to ask a simple
question?  I find your response offensive.

Also note, my question was about TLS specifically.  I'm well aware that
DTLS 1.3 lags implementations.

Deb

On Sat, Feb 28, 2026 at 2:04 PM Michael Richardson <[e-mail]>
wrote:

>
> <#secure method=pgpmime mode=sign>
>
> Deb Cooley via Datatracker <[e-mail]> wrote:
>     > General:  TLS 1.2, is there a reason to allow this?  While RFC9325
> mandates
>     > TLS1.2, draft-ietf-uta-require-tls13 (in AUTH48-done state, also
> will be under
>     > BCP 195) updates this to deprecate TLS 1.2.   Perhaps one could ref
> BCP195 and
>     > remove the references to TLS 1.2 (or at least reference both 9325
> and the uta
>     > draft)?
>
> Yeah, so the choice for many deployed systems, which could get minor bits
> of
> new functionality, like replacing their radius client library with one that
> does DTLS, is that they won't get a new core system library before they are
> EOL.  Some might be EOL already.  So the choice really is:
>
> 1) cleartext radius with MD5
> 2) (D)TLS 1.2, (probably via openssl 1.1.x, could be older!)
>
> (DTLS *APIS* are a disaster for any version.  I tried to get them fixed
> starting in 2018, but I have gotten nowhere.  DTLS 1.3 libraries are not
> yet
> common.  For many, they will go to TLS/TCP rather than to DTLS)
>
> The text has recommended 1.3. We all want to go there.
> But, implementations have to be ready to support 1.2.
>
> Can we stop this witch hunt?  The world is not all browsers.
>
> --
> Michael Richardson <[e-mail]>   . o O ( IPv6 IøT consulting )
>            Sandelman Software Works Inc, Ottawa and Worldwide
>
>
>
>