Re: [radext] Adam Roach's Discuss on draft-ietf-radext-coa-proxy-05: (with DISCUSS and COMMENT)

[Benjamin Kaduk <[e-mail]>]

On Tue, Aug 14, 2018 at 12:43:49PM -0500, Adam Roach wrote:
> On 8/14/18 12:31, Alan DeKok wrote:
> >    Any security issues with the contents of Operator-NAS-Identifier are largely mitigated by the utter crap-fest that's the rest of RADIUS.  Which means that it doesn't really matter how the values of Operator-NAS-Identifier are created, stored, or used.
> 
> 
> Perfect! That's what the document should say.
> 
> Mostly, I was taking issue with language that implies that there is some 
> level of security being applied to this token, and that the guidance and 
> mechanisms in this draft were sufficient to even allow doing so (see, 
> e.g., my comment on field sizes). Securing this field would be fine, if 
> done correctly. Leaving it unsecured -- as is done with similar 
> information in Radius -- is fine also. It's the middle-ground of 
> security theater -- and, in this case, RFC-2119-language normative 
> security theater --  that I think is dangerous.

Hi Adam,

Could you take a look at the text in the -07 and clear your Discuss if you
are satisfied?

Thanks,

Benjamin