Re: [radext] Discussions about RFC6614bis

[Alexander Clouter <[e-mail]>]

On Mon, 5 Dec 2022, at 15:48, Jan-Frederik Rieckers wrote:
>
> we have started some discussions on the RFC6614bis draft on Github:
> https://github.com/Janfred/draft-rieckers-radext-rfc6614bis

Section 1.2:

"TLS 1.2 is now the minimum TLS version, TLS 1.3 is included as *recommended*.", should 'recommended' be 'RECOMMENDED' (caps and bold)?

On the MTI front here, RC4 is prohibited since RFC7465, not sure if that means a reference to it needs to be included to say "please do not use it"?

Section 2.2:

"The RADIUS/TLS nodes MUST NOT offer or negotiate cipher suites which do not provide confidentiality and integrity protection.", did we want to include PFS as a RECOMMENDED too as credentials are flying around on the wire?

Section 2.3.2:

"and support for the more contemporary *has* function SHA-256 is RECOMMENDED.", typo should be 'hash'.

Do we want to label the SHA-1 fingerprint as a SHOULD NOT to deprecate it and highlight that people really should not be using this for certificates (as per RFC9155)? Section 5 looks mostly retained from RFC6614 section 6 which includes  a note stating SHA-1 probably will be removed at some point. Maybe that moment is now?

Thanks