Re: [radext] New draft: RFC6614bis (RADIUS/TLS)

[Bernard Aboba <[e-mail]>]

Alan said

"  We should probably just mandate TLS 1.3 when TLS-PSK is being used with
RADIUS/TLS."

[BA]  The problem would still raise its head again when TLS 1.4 comes out.

One way to not force operators to configuration multiple PSKs would be to
hash a configured "RADIUS over (D)TLS" PSK with the TLS version number to
produce a PSK unique for each TLS version number.

On Fri, Oct 28, 2022 at 9:25 AM Alan DeKok <[e-mail]>
wrote:

> On Oct 28, 2022, at 12:21 PM, Bernard Aboba <[e-mail]>
> wrote:
> >
> > Alan said:
> >
> > "Due to TLS version issues, a TLS-PSK MUST NOT be used across different
> versions of TLS."
> >
> > [BA] What are the implications of this?  Does an operator need to
> configure distinct TLS-PSKs for TLS 1.2 and TLS 1.3??
>
>   Arguably yes.
>
> https://www.rfc-editor.org/rfc/rfc8446#appendix-E.7
>
> ...
>    The constructions in TLS 1.2 and TLS 1.3 are different, although they
>    are both based on HMAC.  While there is no known way in which the
>    same PSK might produce related output in both versions, only limited
>    analysis has been done.  Implementations can ensure safety from
>    cross-protocol related output by not reusing PSKs between TLS 1.3 and
>    TLS 1.2.
>
>
>   My $0.02 is that TLS 1.3 is widely available, and RADIUS/TLS does not
> widely use TLS-PSK that I'm aware of.
>
>   We should probably just mandate TLS 1.3 when TLS-PSK is being used with
> RADIUS/TLS.
>
>   Alan DeKok.
>
>