Re: [radext] WGLC #2 for draft-ietf-radext-dtls-04

[Alan DeKok <[e-mail]>]

Peter Deacon wrote:
> On Sat, 6 Apr 2013, Alan DeKok wrote:
> 
>> Peter Deacon wrote:
>>> Requests from unknown IPs by itself is not useful.  Normally access to
>>> the RADIUS request (NAS-ID) often provides relevant clue.
> 
>>  That's not part of standard RADIUS.  If you have a proprietary
>> extension, you're responsible for ensuring it works.  The IETF isn't.
> 
> What "proprietary extension" is required to log incoming requests?

  So... your best option is to lie about what I said?

> Lets examine the complete matrix of options for RADIUS/UDP vs
> RADIUS/DTLS clients and servers.

  Let's not.  Conversations presume that both parties operate in good faith.

> With regards to the security review claim the migration concept is
> susceptible to trivial MITM in the network path simply by filtering out
> the more secure (DTLS) messages.  Whether it is the client that does it
> or the server makes no difference.  This scheme is insecure either way.

  Nonsense.

> The problem is servers would not have the option of turning off the
> automatic migration behavior.

  You've understood that, at least.

>  Side effect of this is that multiple clients behind a single IP 

  ... is not part of RADIUS.

  Once again, you're ignoring my messages about that topic.  You seem to
think that by simply repeating yourself ad nauseum, you can win a
logical argument.  Logic doesn't work that way.

  IMHO, hell will freeze over before RADIUS/UDP standardizes multiple
clients behind one IP.

  Alan DeKok.