[radext] I-D Action: draft-ietf-radext-deprecating-radius-03.txt

[[e-mail]]

Internet-Draft draft-ietf-radext-deprecating-radius-03.txt is now available.
It is a work item of the RADIUS EXTensions (RADEXT) WG of the IETF.

   Title:   Deprecating Insecure Practices in RADIUS
   Author:  Alan DeKok
   Name:    draft-ietf-radext-deprecating-radius-03.txt
   Pages:   77
   Dates:   2024-08-07

Abstract:

   RADIUS crypto-agility was first mandated as future work by RFC 6421.
   The outcome of that work was the publication of RADIUS over TLS (RFC
   6614) and RADIUS over DTLS (RFC 7360) as experimental documents.
   Those transport protocols have been in wide-spread use for many years
   in a wide range of networks.  They have proven their utility as
   replacements for the previous UDP (RFC 2865) and TCP (RFC 6613)
   transports.  With that knowledge, the continued use of insecure
   transports for RADIUS has serious and negative implications for
   privacy and security.

   The recent publication of the "BlastRADIUS" exploit has also shown
   that RADIUS security needs to be updated.  It is no longer acceptable
   for RADIUS to rely on MD5 for security.  It is no longer acceptable
   to send device or location information in clear text across the wider
   Internet.  This document therefore deprecates many insecure practices
   in RADIUS, and mandates support for secure TLS-based transport
   layers.  We also discuss related security issues with RADIUS, and
   give recommendations for practices which increase both security and
   privacy.

The IETF datatracker status page for this Internet-Draft is:
https://datatracker.ietf.org/doc/draft-ietf-radext-deprecating-radius/

There is also an HTML version available at:
https://www.ietf.org/archive/id/draft-ietf-radext-deprecating-radius-03.html

A diff from the previous version is available at:
https://author-tools.ietf.org/iddiff?url2=draft-ietf-radext-deprecating-radius-03

Internet-Drafts are also available by rsync at:
rsync.ietf.org::internet-drafts