Re: [radext] New DTLS document

[Jouni Korhonen <[e-mail]>]

Thanks Joe for detailed comments. Just few generic questions to the WG.

1) Do you agree with Joe's suggestion to use the same port as RADSEC:

	radius-dtls 2083/udp RADIUS over DTLS [RFCTBD]

2) Do you think Joe's concern on Section 5.1.2 "disambiguation recommendation"
   is something that need to be reconsidered.. 

- Jouni


On Apr 22, 2013, at 8:32 AM, Joseph Salowey (jsalowey) <[e-mail]> wrote:

> I think there are a few inconsistencies that need cleaning-up:
> 
> - Section 2.2.1
> 
> Section 2.5 of RFC 6614 should apply to RADIUS over DTLS since a single port is used for all types of RADIUS codes.  ( I think the last bullet point in section 2.1 should be removed as well.)
> 
> - Section 5.1.1
> 
> This section references a requirement to receive RADIUS/UDP and RADIUS/DTLS on the same port, this is no longer a requirement.  Suggest cleaning up the text along the lines of:
> 
> " ...  Implementations that accept RADIUS/DTLS on the RADIUS/UDP port may find this recommendation difficult to implement in
>   practice.  ... "
> 
> - Section 5.1.2
> 
> I still have a concern about the disambiguation recommendation since it relies upon a protocol field which is not in control of RADIUS, but it is rather in control of DTLS.  Its possible that int he future DTLS may choose to define a new extended handshake type that would use a different type code of 22.  This would introduce ambiguity and prevent this version of DTLS from being used with this mechanism.  It would be a better, more reliable design to have the disambiguation rely upon something that RADIUS had control over.   For example, define a RADIUS code type that encapsulates a RADIUS DTLS message.  
> 
> Additionally section 5.1.2 should clarify that it only applies to implementations that accept RADIUS/DTLS on the RADIUS/UDP port 
> 
> - Section 5.1.3 
> 
> Most of this section applies to implementations that accept RADIUS/DTLS on the RADIUS/UDP port.  THis section should clarify this.  I think the last 3 paragraphs are generic and can be moved to a a different section, such as 5.1.1.
> 
> 
> - Section 9
> 
> We could request the same port as RADSEC.  Something like:
> 
> IANA is requested to assign a registered UDP  port number for RADIUS over DTLS.  The same values as for RADIUS over TLS (RFC6614) are requested.  That is, update the registry as follows:
> 
>      radius-dtls 2083/udp RADIUS over DTLS [RFCTBD]
> 
> 
> 
> 
> 
> 
> On Apr 18, 2013, at 12:26 AM, Jouni Korhonen <[e-mail]> wrote:
> 
>> 
>> Folks,
>> 
>> <as a co-chair>
>> 
>> Everybody happy with -05 ? If I here no immediate 
>> voices of disagreement, we can conclude the WG
>> has reached consensus and the document can move
>> forward. I'll wait till next Monday.
>> 
>> - Jouni
>> 
>> 
>> 
>> On Apr 17, 2013, at 4:54 PM, Alan DeKok <[e-mail]> wrote:
>> 
>>> http://tools.ietf.org/html/draft-ietf-radext-dtls-05
>>> 
>>> Which addresses all of the open concerns.
>>> 
>>> Alan DeKok.
>>> _______________________________________________
>>> radext mailing list
>>> [e-mail]
>>> https://www.ietf.org/mailman/listinfo/radext
>> 
>> _______________________________________________
>> radext mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/radext
>