Re: [radext] BoF request for IETF 115

[Alan DeKok <[e-mail]>]

On Sep 22, 2022, at 5:50 PM, Bernard Aboba <[e-mail]> wrote:
> Just today, the CyberSecurity & Infrastructure Security Agency (CISA) issued an Alert relating to threats to operational technology: 
> https://www.cisa.gov/uscert/ncas/alerts/aa22-265a
> 
> A question: Will the revision to RFC 6421 cover post-quantum considerations?  

  My preference would be to just punt the problem to TLS.  That is also the historical approach (chosen implicitly) by prior discussions in RADEXT.

  i.e. If TLS transport is required, then any issues related to MD4 / MD5 are "papered over" by the TLS encapsulation.  If the TLS layer is resistant to post-quantum considerations, then the application data encapsulated inside of TLS is safe, too.

  The driver for crypto agility was a post by the AD (Russ Housely) to RADEXT in 2006.  It's quoted in RFC 6421:

      The RADEXT WG will review the security requirements for crypto-
      agility in IETF protocols, and identify the deficiencies of the
      existing RADIUS protocol specifications against these
      requirements.  Specific attention will be paid to RFC 4962 [RFC4962].

      The RADEXT WG will propose one or more specifications to remediate
      any identified deficiencies in the crypto-agility properties of
      the RADIUS protocol.  The known deficiencies include the issue of
      negotiation of substitute algorithms for the message digest
      functions, the key-wrap functions, and the password-hiding
      function.  Additionally, at least one mandatory to implement
      cryptographic algorithm will be defined in each of these areas, as
      required.

  To  my recollection, the RADEXT WG never seriously discussed any of those points.  Instead, once the RADIUS / TLS work was started, all of the crypto agility requirements were silently dropped.  The preference was to not design any new cryptographic primitives in RADEXT.

  That is, RFC 6421 was published, and was resoundingly ignored.  It would be worth perhaps explaining why in a new document.  Perhaps the one which deprecates RADIUS / UDP.

  Alan DeKok.