Re: [radext] WGLC #2 for draft-ietf-radext-dtls-04

[Alan DeKok <[e-mail]>]

Peter Deacon wrote:
> Requests from unknown IPs by itself is not useful.  Normally access to
> the RADIUS request (NAS-ID) often provides relevant clue.

  That's not part of standard RADIUS.  If you have a proprietary
extension, you're responsible for ensuring it works.  The IETF isn't.

> I apologize for any misunderstanding.  The migration would be in the
> client rather than server.  They would both have flags but the automatic
> upgrade with memory to prevent downgrade would be handled at the client.

  That won't pass security review.  Having the server *also* handle
client upgrade is a hard requirement.

>>> Servers would still maintain flag but it would only be a manually
>>> turned knob to indicate security level it is willing to accept.
> 
>>  The draft allows it to me administratively configured.
> 
> This appears to be restricted by the current text of the draft.  See the
> following from section 3.1.  The server MUST maintain the flag and
> description of "false" value mandates migration using MUST keyword.

  Quoting the text isn't helpful.  I'm sure I've read it.

  The rest of the draft says:

   The "DTLS Required" flag MUST be exposed to administrators of the
   server.  As clients are upgraded, administrators can then manually
   mark them as using RADIUS/DTLS.

  The "automatic" upgrade path is one which doesn't require
administrator intervention.  However, it doesn't *prevent* admins from
manually forcing a client to do DTLS.

  Alan DeKok.