[radext] Re: Lack of Channel Bindings in RADIUS/(D)TLS

[Alan DeKok <[e-mail]>]

On Jul 26, 2024, at 6:00 PM, Bernard Aboba <[e-mail]> wrote:
> This deserves some careful consideration.  As Alan has noted, dynamic discovery opens up potential routing attacks that have not triggered much concern in RADIUS/UDP "static routing" systems. 

  I'll add some comments in the "deprecating insecure practices" document about this.  I think that document is the best place to discuss the security of RADIUS systems.

> In 2024, many of the security assumptions that were commonplace in 2017 no longer feel as rock solid.  Overall, the pace of change appears to be accelerating, which implies that we need to look "further down the road" than we have been used to doing. 

  I agree.

> Once NIST issues initial PQC standards, I am expecting there to be considerable demand for support in TLS 1.3 libraries.  So we should not just think of TLS 1.3 deployment as being motivated by issues with TLS 1.2. PQC will also be a deployment motivator. Also, note the addition of "pessimistic migration" in PQUIP "migration use cases": 
> https://datatracker.ietf.org/meeting/120/materials/slides-120-pquip-post-quantum-cryptography-migration-use-cases

  I see many reasons to mandate support for TLS 1.3.

  One additional reason for mandating TLS 1.3 support is that the major RADIUS servers already support it.

  Alan DeKok.