[radext] Re: Lack of Channel Bindings in RADIUS/(D)TLS

[Q Misell <[e-mail]>]

Agreeing with the general sentiment that mandating TLS1.3 is warranted.
We're defining a whole new transport anyway, let's make it as secure as we
can.
------------------------------

Any statements contained in this email are personal to the author and are
not necessarily the statements of the company unless specifically stated.
AS207960 Cyfyngedig, having a registered office at 13 Pen-y-lan Terrace,
Caerdydd, Cymru, CF23 9EU, trading as Glauca Digital, is a company
registered in Wales under № 12417574
<https://find-and-update.company-information.service.gov.uk/company/12417574>,
LEI 875500FXNCJPAPF3PD10. ICO register №: ZA782876
<https://ico.org.uk/ESDWebPages/Entry/ZA782876>. UK VAT №: GB378323867. EU
VAT №: EU372013983. Turkish VAT №: 0861333524. South Korean VAT №:
522-80-03080. AS207960 Ewrop OÜ, having a registered office at Lääne-Viru
maakond, Tapa vald, Porkuni küla, Lossi tn 1, 46001, trading as Glauca
Digital, is a company registered in Estonia under № 16755226. Estonian VAT
№: EE102625532. Glauca Digital and the Glauca logo are registered
trademarks in the UK, under № UK00003718474 and № UK00003718468,
respectively.


On Wed, 31 Jul 2024 at 02:07, Alan DeKok <[e-mail]> wrote:

> On Jul 30, 2024, at 3:54 PM, Michael Richardson <[e-mail]>
> wrote:
> > For server to server (proxy) situations, that seems quite reasonable to
> > mandate 1.3.
> >
> > Are the access devices up to this?
>
>   For any non-trivial ones, yes.  For trivial ones, they can continue to
> use RADIUS/UDP until such time as the devices reach EOL.
>
>   There's no reason to limit support to an intermediary upgrade path when
> the better solution is already 6 years old.
>
> > To me, even TLS 1.1 seems better than RADIUS/(UDP)-MD5.
> > (What are we calling the legacy insecure method?)
>
>   RADIUS/UDP is simple enough, I think.
>
>   Alan DeKok.
>
> _______________________________________________
> radext mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
>