[radext] Re: IPR confirmation for draft-ietf-radext-radiusdtls-bis

[Heikki Vatiainen <[e-mail]>]

On Thu, 22 Jan 2026 at 19:48, Valery Smyslov <[e-mail]> wrote:


> As a shepherd I also have a question to the broader RADIUS community:
> are you aware of any existing implementations that follow recommendations
> from this document?
>

We have two different implementations, one using OpenSSL for TLS and the
other that uses Rust's rustls. DTLS 1.3 is not available in neither, but
OpenSSL does support DTLS 1.2 and hopefully soon 1.3. At the moment we
don't support DTLS even with the OpenSSL backed implementation.

TLS session resumption is a bit of a question. RadSec connections tend to
be long-running as opposed to connections with TLS based EAP methods, as an
example. Especially it's usefulness with TLS-PSK is unclear. The TLS
libraries implement resumption, so it's there when it's needed. It could be
helpful when there's a surge of certificate authenticated connections, so
this is subject to be revisited.

Because the draft allows a lot of TLS features, we plan to have some
restrictions. For example, not supporting TLS re-negotiation even for
certificate re-assessment. The draft at the moment allows, as an extreme
example, DTLS 1.2 with PSK where client initiates re-negotiation. It may be
used for rekeying, but a new connection is simpler.

In short: RadSec with TLS and certificates followed by TLS and PSKs look
like the main uses. DTLS is being watched on. DTLS 1.3 is a bit new.

-- 
Heikki Vatiainen
[e-mail]