IETF Logo Mail Archive

Re: [radext] BoF request for IETF 115

josh.howlett@gmail.com Fri, 30 September 2022 12:08 UTC

Return-Path: <josh.howlett@gmail.com>
X-Original-To: radext@ietfa.amsl.com
Delivered-To: radext@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 10B7EC159A25 for <radext@ietfa.amsl.com>; Fri, 30 Sep 2022 05:08:52 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.109
X-Spam-Level:
X-Spam-Status: No, score=-2.109 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id crV99DHg5tbU for <radext@ietfa.amsl.com>; Fri, 30 Sep 2022 05:08:49 -0700 (PDT)
Received: from mail-wr1-x434.google.com (mail-wr1-x434.google.com [IPv6:2a00:1450:4864:20::434]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CA59AC159A2F for <radext@ietf.org>; Fri, 30 Sep 2022 05:08:49 -0700 (PDT)
Received: by mail-wr1-x434.google.com with SMTP id bq9so6542168wrb.4 for <radext@ietf.org>; Fri, 30 Sep 2022 05:08:49 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=content-language:thread-index:content-transfer-encoding :mime-version:message-id:date:subject:in-reply-to:references:cc:to :from:from:to:cc:subject:date; bh=F3jqRId19BiFerQlXmWlY9kAGA/p2psVh3yKoq9emLE=; b=SrBJoWd/8Bie/UG32dmmqHtpYD96prQof9OrYl4z3M3P8yTVw7nZ+nnN7GcAvqeE3z Rc3rqCmXLo5ezfloFx+K2N7aJLnN+0Klak2Ja1tk935OdDpZ/lPwolNPIc0OFi5npSMR ehhkotUV1VBZ4TUiK05FsHCyrqhdXDiGz1u365L3tCXsdhiB8xbYKTWlZBwp9lPI3MIY QKRCAEpME3GqrsXmBu/ZvDxYbGKRmIcOq5CZrv0IMg4tyeHSzPpTem9Ch/rhV9J9T1Z2 STQSQB5l6kKmdXxgdjwU7UrDXOhaisJCijsTuJzk563tn1pMERpNDkpypq7OF+kyjIlo Gd4A==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-language:thread-index:content-transfer-encoding :mime-version:message-id:date:subject:in-reply-to:references:cc:to :from:x-gm-message-state:from:to:cc:subject:date; bh=F3jqRId19BiFerQlXmWlY9kAGA/p2psVh3yKoq9emLE=; b=1FB5IND/u9P+oSYJQXPjr2KR1g+2VZt5I8qAlXEfKmpezOh2hgA9Qhf1mddbuXBQPD 98joYLeqQ1vIKEFpcK+gVGDV4oL9+MjInZo1aW/NJYN96S2K+9sRYFvQhGiBRE7A4ew2 C/sHBEePXHKXK/OLj6CaFPN/Z0NIk/YQ61A/LEW5mJTh9nkdl1mQZMGq9l+YA2zD2xZS IQVOaZpM4cKMW3Nv+RdjYYD4kj9J5W/3CXLyal1ErbFrVLOhvBEvlJ+k9Y9i96tlrRVB ny6thgx3GFqRf2nUsN1EpGEaWpCjEU+52mcNX+aAuqqFgbZ81Cf8Av/dnnanfrkY2T4/ zAFA==
X-Gm-Message-State: ACrzQf1BQ0K9wd8VX+NLOtxn8uaaITOt3ufQbd7i07xItqp7FVIg1wV8 zYfRUkPUHs8ozZcIkzgzzJtLknmgC54=
X-Google-Smtp-Source: AMsMyM7Daim5ciYYYz9qEWA3SBCfAB7D79/HRXcn76BqdpSbxowg03S9zYApeqGykqinMndtjQr/tQ==
X-Received: by 2002:adf:fb10:0:b0:22c:caa4:da2d with SMTP id c16-20020adffb10000000b0022ccaa4da2dmr5696172wrr.139.1664539727590; Fri, 30 Sep 2022 05:08:47 -0700 (PDT)
Received: from TABLET7VKS5QAO ([2a00:23c6:fa18:ec01:0:34ec:d881:5eac]) by smtp.gmail.com with ESMTPSA id n2-20020a05600c3b8200b003a540fef440sm6776445wms.1.2022.09.30.05.08.44 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Fri, 30 Sep 2022 05:08:45 -0700 (PDT)
From: josh.howlett@gmail.com
To: 'Alan DeKok' <aland@deployingradius.com>, 'Stefan Winter' <stefan.winter@restena.lu>
Cc: radext@ietf.org
References: <CAOW+2ds134ZJ+somFXsL=27=pvtUT2hNU6G9_8cpM3VoWEcN9Q@mail.gmail.com> <ab874879-3cdd-6cdb-e9a0-07a405272088@iea-software.com> <788eea99-21ab-4cc7-8e3e-67a2f8f480d6@www.fastmail.com> <F773A4A3-99C3-4216-8813-45DA5606B8C9@deployingradius.com> <41dc9d36-7601-8628-851c-7e171cbd6125@restena.lu> <58052FF8-AE6D-47C4-B8D4-549F7DAAD5FD@deployingradius.com>
In-Reply-To: <58052FF8-AE6D-47C4-B8D4-549F7DAAD5FD@deployingradius.com>
Date: Fri, 30 Sep 2022 13:08:44 +0100
Message-ID: <092e01d8d4c5$63de52b0$2b9af810$@gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
X-Mailer: Microsoft Outlook 16.0
Thread-Index: AQE6RTPydjB2yi3cWS5KG49bAnRXDwImznqrAU0YUWsCBUO5NAIqjSDNAU54tWuu7Wfp8A==
Content-Language: en-gb
Archived-At: <https://mailarchive.ietf.org/arch/msg/radext/oeGD9C8DUCX6YqTx_04TyZ2vNUM>
Subject: Re: [radext] BoF request for IETF 115
X-BeenThere: radext@ietf.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: RADIUS EXTensions working group discussion list <radext.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/radext>, <mailto:radext-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/radext/>
List-Post: <mailto:radext@ietf.org>
List-Help: <mailto:radext-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/radext>, <mailto:radext-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 30 Sep 2022 12:08:52 -0000

> > From what I see in operations, the biggest problem people have with
> > certificates seems to be that they have an expiry date you need to
attend to.
> 
>   I agree 110%.  It's the biggest issue with certificates.
> 
>   Using a private CA is awkward, but isn't too bad.  Using public CAs is
much
> more difficult.

And operating a private CA is much more difficult than PSKs. Moreover,
credentialing a large NAS estate with client certs could be a lot of effort.
And, from operator experience, many folks simply don't understand client
certificates and key management. Conversely, PSKs are intuitive.

> > If PSKs are too low-entropy then one of the more recent public/private
> keypair constructs could be an alternative: RFC7250, "Using Raw Public
Keys
> in TLS and DTLS".

RFC7250 assumes out of band key provisioning. Again, I think provisioning
keypairs on a server and client would stretch most users. With PSK, it is
the same key on both entities. It is hard to get this wrong.

I have no objection to some form of public key based authentication; but we
need support for PSKs or this will be too hard for most users.

v2.23.0 | Report a Bug | By Email