Re: [radext] TLS-PSK and RADIUS/(D)TLS - MTI trust models

[[e-mail]]

Hi Jan-Fred,

I support this.

Josh

> -----Original Message-----
> From: radext <[e-mail]> On Behalf Of Jan-Frederik Rieckers
> Sent: Friday, August 11, 2023 11:03 AM
> To: [e-mail]
> Subject: [radext] TLS-PSK and RADIUS/(D)TLS - MTI trust models
> 
> Hi to all,
> 
> after reading the TLS-PSK draft and following some of the discussion about this
> and the deprecation of RADIUS/UDP RADIUS/TCP, a new question came up for
> me regarding the RADIUS/(D)TLS-bis draft:
> 
> We want to help move people towards secure transports, and TLS-PSK is a
> good way to do that, especially if people already have a process for sharing the
> RADIUS shared secret, and this process could be easily adapted to sharing the
> PSK ID and the PSK.
> 
> RADIUS/(D)TLS currently mandates that both server and client implement
> certificates with the PKIX trust model.
> 
> My idea from the top of my head:
> 
> We have had discussion about the Requirement for TLS/DTLS on the client side
> an have reached a consensus, as far as I read the list, that the server should
> support both, but the clients can choose to implement only one.
> Would it be a good idea to continue this with the mutual authentication as
> well?
> 
> The idea would be: RADIUS/(D)TLS servers MUST implement certificates with
> PKIX trust model and TLS-PSK, RADIUS/(D)TLS clients MUST implement at
> least one of those two.
> 
> This way we still ensure complete compatibility, but RADIUS clients that
> currently only support RADIUS/UDP with shared secrets can upgrade to
> RADIUS/(D)TLS easily without the need to implement a whole PKIX certificate
> validation stack.
> 
> However, this is a significant change in the spec, since RFC 6614 did not
> mandate TLS-PSK.
> 
> Implementation status, as far as I know:
> 
> * FreeRADIUS implements TLS-PSK for RadSec
> * Radsecproxy just became capable in the current master, will probably be
> released in the 1.11 version.
> 
> I have not checked RADIATOR and I'm not sure if there are more RADIUS/TLS
> implementations out there.
> 
> 
> Cheers,
> Janfred
> 
> --
> Herr Jan-Frederik Rieckers
> Security, Trust & Identity Services
> 
> E-Mail: [e-mail] | Fon: [phone] | Fax: [phone]
> Pronomen: er/sein | Pronouns: he/him
> ___________________________________________________________________
> _______________
> 
> DFN - Deutsches Forschungsnetz | German National Research and Education
> Network
> Verein zur Förderung eines Deutschen Forschungsnetzes e.V.
> Alexanderplatz 1 | 10178 Berlin
> www.dfn.de
> 
> Vorstand: Prof. Dr. Odej Kao (Vorsitzender) | Dr. Rainer Bockholt |
> Christian Zens
> Geschäftsführung: Dr. Christian Grimm | Jochem Pattloch
> VR AG Charlottenburg 7729B | USt.-ID. DE 1366/23822