Re: [radext] WGLC for draft-ietf-radext-radiusv11-02

[Peter Deacon <[e-mail]>]

On Thu, 26 Oct 2023, Valery Smyslov wrote:

> this message starts an official Working Group Last Call for 
> draft-ietf-radext-radiusv11-02 (RADIUS Version 1.1). The call will last 
> for three weeks and will end 17 November 2023. Please send messages to 
> the list with clear indication whether you support publication of this 
> document or not (in the latter case it's good if the reasons are 
> provided).

I don't think this document should move forward unless security standards 
related claims are either withdrawn or objectively substantiated.

As I provided reference for earlier and has been conveyed by others use of 
unapproved algorithms for non-security reasons is NOT disallowed by 
FIPS-140.

Further unless there has been a credible review of these systems WRT 
relevant standards text implying compliance is inappropriate.

" Systems which implement this transport profile are therefore capable of 
being FIPS-140 compliant. "

" A major benefit of this extensions is that a home server which
    implements it can also choose to also be fully FIPS-140 compliant."

"In addition, the dependency on
    MD5 makes it impossible to use RADIUS in a FIPS-140 compliant system,
    as FIPS-140 forbids systems from relying on insecure cryptographic
    methods for security."

regards,
Peter