Subject: Re: [radext] RADEXT WG Last Call: NAI-based Dynamic Peer Discovery for RADIUS/TLS and RADIUS/DTLS

From: Stefan Winter <[email-masked]>
Date: Wed, 05 Dec 2012 14:52:10 +0100

Hi Lionel, all,

> Please consider these comments that are more for clarifications than
> highlighting new blocking issues.

Thanks a lot for the review of the document! Responses inline:

> 1/ It is maybe obvious or defined in another document but the
> descriptions of Service tags “aaa+auth”, “aaa+acct” and “aaa+Dynauth”
> are missing.

I've added definitions and also changes the protocol tag and SRV records
definition from flow text into a (short) table each. They look like this
in my current working copy:

   +-----------------+-----------------------------------------+
   | Service Tag     | Use                                     |
   +-----------------+-----------------------------------------+
   | aaa+auth        | RADIUS Authentication, i.e. traffic     |
   |                 | destined to port UDP/1812 in [RFC2865]  |
   | - - - - - - - - | - - - - - - - - - - - - - - - - - - - - |
   | aaa+acct        | RADIUS Accounting, i.e. traffic         |
   |                 | destined to port UDP/1813 in [RFC2865]  |
   | - - - - - - - - | - - - - - - - - - - - - - - - - - - - - |
   | aaa+dynauth     | RADIUS Dynamic Authorisation, i.e.      |
   |                 | traffic as defined in [RFC5176]         |
   +--------------- --+-----------------------------------------+

                      Figure 1: List of Service Tags

   +-----------------+-----------------------------------------+
   | Protocol Tag    | Use                                     |
   +-----------------+-----------------------------------------+
   | radius.tls      | RADIUS transported over TLS as defined  |
   |                 | in [RFC6614]                            |
   | - - - - - - - - | - - - - - - - - - - - - - - - - - - - - |
   | radius.dtls     | RADIUS transported over DTLS as defined |
   |                 | in [I-D.ietf-radext-dtls]               |
   +-----------------+-----------------------------------------+

                      Figure 2: List of Protocol Tags

   +-----------------+-----------------------------------------+
   | SRV Label       | Use                                     |
   +-----------------+-----------------------------------------+
   | _radiustls._tcp | RADIUS transported over TLS as defined  |
   |                 | in [RFC6614]                            |
   | - - - - - - - - | - - - - - - - - - - - - - - - - - - - - |
   | _radiustls._udp | RADIUS transported over DTLS as defined |
   |                 | in [I-D.ietf-radext-dtls]               |
   +-----------------+-----------------------------------------+

                      Figure 3: List of Protocol Tags

With supporting requests in IANA Considerations to register/reserve all
those labels.

> 2/ Maybe obvious too but it could be clarified that the SRV prefix
> defined in this document corresponds to the “_Service._Proto” part of an
> SRV RR.  SRV prefix may have different meanings depending on the reader.  

I've expanded the sentence in question in my working copy to:

This specification defines two SRV prefixes (i.e. two values for the
   "_service._proto" part of an SRV RR):

I hope this clarifies the meaning sufficiently.

> 3/ We can find several instances of “AAA server” in the draft. It could
> be replaced by RADIUS server that is more accurate, as only RADIUS is
> considered.

I've replaced all instances I could find with RADIUS server in my
working copy.

Does this sufficiently address your concerns? If so, I'd like to submit
-05 in the coming days; and since these were the only comments in the
WGLC I'd then like to get the document to the IESG as soon as possible.
After all the new charter states that this should be done by December(!).

Greetings,

Stefan Winter

-- 
Stefan WINTER
Ingenieur de Recherche
Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et
de la Recherche
6, rue Richard Coudenhove-Kalergi
L-1359 Luxembourg

Tel: +352 424409 1
Fax: +352 422473

---

From: Stefan Winter <[email-masked]>
Date: Wed, 05 Dec 2012 14:58:20 +0100

Hi again,

Please forgive this obvious nonsense. It should of course read:

   | aaa+auth        | RADIUS Authentication, i.e. traffic as  |
   |                 | defined in [RFC2865]                    |
   | - - - - - - - - | - - - - - - - - - - - - - - - - - - - - |
   | aaa+acct        | RADIUS Accounting, i.e. traffic as      |
   |                 | defined in [RFC2866]                    |
   | - - - - - - - - | - - - - - - - - - - - - - - - - - - - - |

Need. More. Coffee.

Stefan

Tel: +352 424409 1
Fax: +352 422473