[radext] Re: I-D Action: draft-ietf-radext-deprecating-radius-03.txt

Alan DeKok <aland@deployingradius.com> Wed, 07 August 2024 23:07 UTC

From: Alan DeKok <aland@deployingradius.com>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3696.120.41.1.1\))
Date: Wed, 07 Aug 2024 19:07:43 -0400
References: <172307146488.195.5232088029921985934@dt-datatracker-6df4c9dcf5-t2x2k>
To: radext@ietf.org
In-Reply-To: <172307146488.195.5232088029921985934@dt-datatracker-6df4c9dcf5-t2x2k>
Message-Id: <4C33C0CF-92F1-449A-9B8D-F7028DA03E6F@deployingradius.com>
Message-ID-Hash: P7XRMFU4WFLYG4E6NY5GQQSTBCCMZUM5
Precedence: list
Subject: [radext] Re: I-D Action: draft-ietf-radext-deprecating-radius-03.txt
Archived-At: <https://mailarchive.ietf.org/arch/msg/radext/tUBOtzZdhL0iJFBJg_ZyBgIVkDI>

  This version adds substantially more text, based on feedback from IETF 120:

* add delayed Access-Reject

* constant-time comparison,

* comments on there is no RADIUS routing protocol.

* Updated the text significantly

* made text consistent with the BlastRADIUS recommendations. 

* Add "updates" other RFCs.

> On Aug 7, 2024, at 6:57 PM, internet-drafts@ietf.org wrote:
> 
> Internet-Draft draft-ietf-radext-deprecating-radius-03.txt is now available.
> It is a work item of the RADIUS EXTensions (RADEXT) WG of the IETF.
> 
>   Title:   Deprecating Insecure Practices in RADIUS
>   Author:  Alan DeKok
>   Name:    draft-ietf-radext-deprecating-radius-03.txt
>   Pages:   77
>   Dates:   2024-08-07
> 
> Abstract:
> 
>   RADIUS crypto-agility was first mandated as future work by RFC 6421.
>   The outcome of that work was the publication of RADIUS over TLS (RFC
>   6614) and RADIUS over DTLS (RFC 7360) as experimental documents.
>   Those transport protocols have been in wide-spread use for many years
>   in a wide range of networks.  They have proven their utility as
>   replacements for the previous UDP (RFC 2865) and TCP (RFC 6613)
>   transports.  With that knowledge, the continued use of insecure
>   transports for RADIUS has serious and negative implications for
>   privacy and security.
> 
>   The recent publication of the "BlastRADIUS" exploit has also shown
>   that RADIUS security needs to be updated.  It is no longer acceptable
>   for RADIUS to rely on MD5 for security.  It is no longer acceptable
>   to send device or location information in clear text across the wider
>   Internet.  This document therefore deprecates many insecure practices
>   in RADIUS, and mandates support for secure TLS-based transport
>   layers.  We also discuss related security issues with RADIUS, and
>   give recommendations for practices which increase both security and
>   privacy.
> 
> The IETF datatracker status page for this Internet-Draft is:
> https://datatracker.ietf.org/doc/draft-ietf-radext-deprecating-radius/
> 
> There is also an HTML version available at:
> https://www.ietf.org/archive/id/draft-ietf-radext-deprecating-radius-03.html
> 
> A diff from the previous version is available at:
> https://author-tools.ietf.org/iddiff?url2=draft-ietf-radext-deprecating-radius-03
> 
> Internet-Drafts are also available by rsync at:
> rsync.ietf.org::internet-drafts
> 
> 
> _______________________________________________
> radext mailing list -- radext@ietf.org
> To unsubscribe send an email to radext-leave@ietf.org

[radext] I-D Action: draft-ietf-radext-deprecatin… internet-drafts
[radext] Re: I-D Action: draft-ietf-radext-deprec… Alan DeKok