[radext] Re: Lack of Channel Bindings in RADIUS/(D)TLS

[Peter Deacon <[e-mail]>]

On Wed, 24 Jul 2024, Margaret Cullen wrote:

> While working through the RADIUS (D)TLS document last night, I realized 
> that RADIUS/(D)TLS does not include support for TLS channel binding. 
> In other words, there is nothing in the RADIUS/(D)TLS layer that ensures 
> that both ends of a single RADIUS hop are using the same unique (D)TLS 
> session.  Without channel binding, RADIUS running over (D)TLS may be 
> open to MITM attacks including:  blocking valid traffic, spoofing 
> Access-Accepts or Rejects, viewing sensitive data, replay attacks, 
> redirection, DoS, etc.

Since channel for per-hop RADIUS data is always mutually authenticated via 
client cert or shared key I don't see a need for additional per-hop 
security.

regards,
Peter