Content-Type: multipart/signed;
	boundary="Apple-Mail=_E860F503-BF12-427A-A689-8B391A7B047D";
	protocol="application/pgp-signature";
	micalg=pgp-sha256
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3826.700.81.1.4\))
From: Alan DeKok <alan.dekok@inkbridge.io>
In-Reply-To: 
 <BYAPR11MB3768995A3F905845409EF032CC0B2@BYAPR11MB3768.namprd11.prod.outlook.com>
Date: Tue, 26 May 2026 06:50:44 -0400
Message-Id: <4C8F2356-BE1F-43AC-AC9A-3AAAE136D906@inkbridge.io>
References: 
 <BYAPR11MB37689273BC46B447843F3516CC352@BYAPR11MB3768.namprd11.prod.outlook.com>
 <C035972D-A954-4449-B1AA-194C7954F27B@inkbridge.io>
 <BYAPR11MB3768995A3F905845409EF032CC0B2@BYAPR11MB3768.namprd11.prod.outlook.com>
To: "Premanand Seralathan (pseralat)" <pseralat=40cisco.com@dmarc.ietf.org>
Message-ID-Hash: LZYHQZHD6PLKCBGJVAS3J6IINOYGGUED
CC: "radext@ietf.org" <radext@ietf.org>
Precedence: list
Subject: =?utf-8?q?=5Bradext=5D_Re=3A_New_I-D=3A_draft-seralathan-radext-persistent-d?=
	=?utf-8?q?evid-00?=
Archived-At: 
 <https://mailarchive.ietf.org/arch/msg/radext/dwcHMWBNiKdh7_M_LSwMKllzTss>


--Apple-Mail=_E860F503-BF12-427A-A689-8B391A7B047D
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=utf-8

On May 25, 2026, at 11:42=E2=80=AFPM, Premanand Seralathan (pseralat) =
<pseralat=3D40cisco.com@dmarc.ietf.org> wrote:
> The NAS doesn't need to correlate across connections =E2=80=94 the =
server does. On reconnect with a new MAC, the same certificate yields =
the same UUID server-side. The NAS caches Persistent-Device-Id for the =
current session, echoes it in accounting, and shares it with integrated =
platforms (profiling engines, location services) so they can identify =
the endpoint across MAC changes. Will clarify this in -01.

  Thanks.

  This functionality could be done by a RADIUS proxy, so the NAS doesn't =
have to be modified.  That would make it much easier to deploy.

  Alternately, since this proposal provides for device tracking, it =
could just be done with CUI.  i.e. instead of sending a new attribute, =
just send:

	Chargeable-User-Identity =3D <persistent-device-id>@<realm from =
User-Name>

  Or since most User-Names are "@realm" or "anonymous@realm", the IdP =
can reply with

	User-Name =3D <persistent-device-id>@<realm from User-Name>

  And then the functionality works, without changing anything else in =
RADIUS.  The main downside here is that there's no separate attribute =
for persistent device ID.  But I think the main goals of the document =
are met.

  Alan DeKok.


--Apple-Mail=_E860F503-BF12-427A-A689-8B391A7B047D
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
	filename=signature.asc
Content-Type: application/pgp-signature;
	name=signature.asc
Content-Description: Message signed with OpenPGP

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEIUl02elqcIsf1zM0v3SJ0h7dTTMFAmoVewQACgkQv3SJ0h7d
TTNmvhAAmb1Au1FHDhNgd6ZwbawyNy54LyA2T6MLbZ9ZJ075FqrbKK71rezMPvSg
dS0Laiu16PgUJ6B2yBHLpDNdPfbGwiKPUbo3/YCr44Mox7D8N6lbk/jnygs2vPDq
NKl0SWJ1f2vaxyGvsm8HhcP+JexTkiOcgY6OA0HCa3v4x5uJg+iwPXDpgqRw3OVC
gBacRqm2WRLAi/jL1673X8hwTJgR7XJW1YenXwnEJI6oacG3touRlMxepuGqC5oP
W2beRH9wx8wOWpXzh4UtiN4JkSXkTbmmhsI8U8+w9UYNTVXZsX5zlaWdsqbrA1nA
6jaH/R/ozUxosm/ReUrooH8S+PB7LU9F/GpysaNd+OEHSYPBjd8VQTTakZvzkK3t
LX8lJBFmjed/YdbV7YDRAPFLoXmtwMB6G3k+PD0NQDtgST8gETN/6eb+HWnuvWYY
tUSmINNPi3xAOBpoxSIvLyOqj7epPrO8kcybjZ9ZKgcf3Sp2AAjwFCPdIeWghvvW
H5EI6b26X/tbz2Uw82hc9dQEd3xh+DprP+U6yOdaxTABxJ4z+A3qQ3/Wr6Lvt2p4
1QRgcefSzPRmCvmgGZn8G4/+K8HEjm/pOlUeZjtVWSvDS+ov4IdOsJs7icOhBQoQ
RBejwlheP1l1QxdcBEltaPbmZZviOw5PHe4BG7RLd/u/wK3KSJY=
=ScDp
-----END PGP SIGNATURE-----

--Apple-Mail=_E860F503-BF12-427A-A689-8B391A7B047D--