Re: [radext] Short draft on using larger packets for TLS fragmentation

[Peter Deacon <[e-mail]>]

On Sun, 7 Jul 2013, Sam Hartman wrote:

> There seems to be consensus on the idea that TCP level fragmentation is 
> the right way to fragment TLS when you can afford to change the proxies. 
> In fact, we may even have consensus that since RADSEC is experimental 
> that it's reasonable to assume that people who need fragmentation and 
> RADSEC can upgrade their proxies.

> I'm tempted to write a short draft that revises RADSEC, permits larger 
> RADIUS messages and introduces a mechanism for saying that you cannot 
> respond to a request without being able to send a larger fragment.

Only concern with this approach UDP compatibility is lost.

> This does not provide negotiation nor does it provide support for the 
> proxy unmodified case.  However at least as I've been reading the WG 
> discussion, we all seem to agree this is the best approach when it is 
> possible.  Also, such a draft would not preclude using a future 
> negotiation mechanism and could work well along-side Alex's draft.

My draft addresses TCP limits (4.2) while concurrently providing for UDP 
interop (4.1) should it be desired.

Those who see no value in UDP interop can elect not to implement Section 
4.1.

Section 4.2 provides for larger messages via TCP and communicating message 
limits.  It's not even necessary to support 4.2 command code and 
attributes to communicate message limits.  Support for large messages is 
allowed to be an administrative option provided it is not enabled by 
default.

regards,
Peter