[radext] #148: Review of dynamic-discovery by Jim Schaad

["radext issue tracker" <[e-mail]>]

#148: Review of dynamic-discovery by Jim Schaad

 1) In section 2.3.3, step 4 - what is to be considered an error at this
 point.  For example, there are a number of odd conditions that can be
 returned from DNSSEC, specifically the "indeterminate" state.

 2) In section 2.3.4 - Given that the above algorithm does not return a TTL
 value in the event of an empty set or define how to know the TTL value -
 what is the TTL value to be used in in paragraph 2 "negative TTL"?

 3) In section 2.3.5 - Does it make sense to return a result, but to
 continue the algorithm and store the result after the timeouts for later
 use?

 4) I find the security considerations to be completely inadequate for this
 document.
 Use of a certificate is only going to be valid if the original realm name
 that is the input the validation routine is what is found and matched in
 the certificate.  In this case I would not know where in the name or alt
 name fields of the certificate it would be found.  You cannot validate to
 the final DNS name as that is now an untrusted value.

 The suggestion of out-of-band validation methods ignores the existence of
 DANE.

 The NAI document suggests that the RADIUS peer is pre-configured with
 information about certificates or TLS validation data.  The suggested text
 works in the case that the table says do dynamic lookup and here is the
 TLS configuration data.  But in other cases it is completely unclear how a
 TLS-PSK would be found for a dynamic lookup.

-- 
-------------------------------------+-------------------------------------
 Reporter:                           |      Owner:  draft-ietf-radext-
  [e-mail]           |  [e-mail]
     Type:  defect                   |     Status:  new
 Priority:  major                    |  Milestone:  milestone1
Component:  dynamic-discovery        |    Version:  1.0
 Severity:  -                        |   Keywords:
-------------------------------------+-------------------------------------

Ticket URL: <http://trac.tools.ietf.org/wg/radext/trac/ticket/148>
radext <http://tools.ietf.org/radext/>