Re: [radext] BoF request for IETF 115

[Stefan Winter <[e-mail]>]

Hello!


I believe it is useful to execute the work Alan sketched in his mail.


 From what we see in production use of RADIUS/TLS as specified right now 
in RFC6613/RFC6614: in almost all aspects, it is a good stop-gap measure 
to overcome RADIUS/UDP's privacy and crypto agility limitations. In 
practice, it is much more wide-spread than the current document track 
"EXP" woud suggest. At least two world-wide roaming consortia make ample 
use of it: eduroam and WBA OpenRoaming.

Brushing up the protocols towards newer crypto, FIPS compliance etc. 
makes perfect sense given that RADIUS is here to stay for extended 
amounts of time.


One thing we struggle with: PKI is really hard to do right; but if one 
doesn't need dynamic discovery as per RFC7585, TLS-PSK can be a drop-in 
replacement for RADIUS shared secrets. The work done here should stress 
that PSK ciphersuites are a perfectly viable option for most deployments 
and provide a low barrier of entry for upgrading to the better protocol.


I hope I can attend a possible BoF in person, should it be approved.


Greetings,


Stefan Winter


-- 
This email may contain information for limited distribution only, please treat accordingly.

Fondation Restena, Stefan WINTER
Chief Technology Officer
2, avenue de l'Université
L-4365 Esch-sur-Alzette