Subject: RE: [eap] RE: [Isms] RADIUS is not a trusted third party

From: Bernard Aboba <[email-masked]>
Date: Mon, 25 Apr 2005 09:00:18 -0700 (PDT)

> The use of RADIUS itself without a defined extension such as EAP-TLS or
> EAP-PEAP over RADIUS cannot securely pass attributes between entities. Note
> that the defined EAP-TLS (or other EAP mechanisms) over RADIUS provides for
> secure attribute passing between entities even through proxies.

EAP does not affect how RADIUS attributes are passed, nor does it enable
the passing of RADIUS attributes between the EAP peer and server.  So as
far as RADIUS attributes are concerned, what EAP method is used, or
whether EAP is used does not affect RADIUS security, except that an
EAP-Message attribute is included in the messages.

Also, EAP-TLS does not permit passing of TLVs between the peer and server;
this is only allowed in tunneled mechanisms such as EAP-TTLS and PEAP.
_______________________________________________
eap mailing list
[email-masked]
http://mail.frascone.com/mailman/listinfo/eap

---

From: "Glen Zorn (gwz)" <[email-masked]>
Date: Mon, 25 Apr 2005 10:28:56 -0700

The use of RADIUS itself without a defined extension such as EAP-TLS
or EAP-PEAP over RADIUS cannot securely pass attributes between
entities. Note that the defined EAP-TLS (or other EAP mechanisms)
over RADIUS provides for secure attribute passing between entities
even through proxies. 
 
I thought that I was passing familiar w/EAP-TLS (and even more so
w/PEAP), but I am completely unaware of such capabilities.  Would
you mind explaining how this is achieved, given that RADIUS & EAP
are completely different protocols?

Martin. 

> -----Original Message----- 
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Thierry Moreau 
> Sent: April 22, 2005 1:56 PM 
> To: Bernard Aboba 
> Cc: [email-masked]; [email-masked]; [email-masked] 
> Subject: Re: [eap] RE: [Isms] RADIUS is not a trusted third party 
> 
> 
> Thanks for these explanations. 
> 
> See comments in-line below. 
> 
> 
> 
> Bernard Aboba wrote: 
> 
> [... explanations about end-to-end (NAS to server) and current
RADIUS 
> protocols ...] 
> 
> > 
> > Are you proposing creating a new RADIUS security model that 
> would only 
> > be used by ISMS?  That seems like a lot of work for little
overall 
> > benefit to the RADIUS community. 
> > 
> 
> I did assume that an implementation-specific attribute to the
RADIUS 
> Access-Accept packet would pass unmodified through a RADIUS 
> proxy, which 
> in fact is a matter of proxy policy (RFC2865 , section 2.3). 
> With this 
> erroneous assumption, I thought I was proposing an 
> implementation-specific use of existing RADIUS protocol 
> facility. I did 
> not expect any "benefit to the RADIUS community". 
> 
> > 
> > 
> > Rather than designing a new version of RADIUS to meet its needs,
it 
> > seems more profitable for ISMS to either figure out how to use
the 
> > protocol as it exists today, or to summarize its 
> requirements for new 
> > work and ask that it be chartered outside of ISMS. 
> > 
> 
> Point well taken. I just looked at RFC3576, abstract reproduced
below 
> 
>     "This document describes a currently deployed extension 
> to the Remote 
>     Authentication Dial In User Service (RADIUS) protocol,
allowing 
>     dynamic changes to a user session, as implemented by 
> network access 
>     server products.  This includes support for disconnecting 
> users and 
>     changing authorizations applicable to a user session." 
> 
> Unfortunately, the security section of RFC3576 raises a number of 
> concerns. E.g. the following sentence: "It is RECOMMENDED 
> that IPsec be 
> employed to afford better security." 
> 
> Again, thanks for your comments. 
> 
> -- 
> 
> - Thierry Moreau 
> 
> CONNOTECH Experts-conseils inc. 
> 9130 Place de Montgolfier 
> Montreal, Qc 
> Canada   H2M 2A1 
> 
> Tel.: (514)385-5691 
> Fax:  (514)385-5900 
> 
> web site: http://www.connotech.com 
> e-mail: [email-masked] 
> 
> 
> Isms mailing list 
> [email-masked] 
> https://www1.ietf.org/mailman/listinfo/isms 
> 
>

---

From: Bernard Aboba <[email-masked]>
Date: Mon, 25 Apr 2005 19:01:31 -0700 (PDT)

> are completely different protocols?

I also was unaware of the ability of EAP-TLS to transmit RADIUS attributes
between the EAP peer and server.  I had always thought RADIUS was a
protocol only spoken between a NAS and a RADIUS server, and that EAP-TLS
didn't support transmission of TLVs.  But I guess this is a somewhat old
fashioned point of view.

Perhaps this is referring to EAP-TLS "extended" via the following?
http://www.ietf.org/internet-drafts/draft-funk-tls-inner-application-extension-01.txt