Subject: [radext] New Draft for RADIUS Attribute Security

From: <[email-masked]>
Date: Fri, 17 Feb 2017 18:11:59 +0530

Hi All,

We have proposed a new draft for RADIUS Attribute Security.

Name:                 draft-aravind-radext-attribute-security

Revision:            00

Title:                    RADIUS Attribute Security

Document date:              2017-02-17

Group:                Individual Submission

Pages:                 9

URL:            https://www.ietf.org/internet-drafts/draft-aravind-radext-attribute-security-00.txt

Status:         https://datatracker.ietf.org/doc/draft-aravind-radext-attribute-security/

Htmlized:       https://tools.ietf.org/html/draft-aravind-radext-attribute-security-00

We would love to hear your reviews and comments.

Thanks,
S. Aravind Prasad

---

From: Alan DeKok <[email-masked]>
Date: Sat, 18 Feb 2017 08:22:31 -0500

> We have proposed a new draft for RADIUS Attribute Security.

  My $0.02: use TLS with a pre-shared key.  While this requires a TLS implementation on the client, the administration overhead is exactly the same as for traditional RADIUS shared secrets.

  And TLS isn't much of an overhead any more.  While OpenSSL is huge, there are many other small / embedded SSL libraries.  Any modern RADIUS client should be able to handle TLS without much difficulty.

  Alan DeKok.

---

From: Bernard Aboba <[email-masked]>
Date: Sat, 18 Feb 2017 07:47:49 -0800

+1. 

Using standards-based transport security via (D)TLS is better than continuing with RADIUS application security. It automatically benefits from new (D)TLS versions. It can use any credential (D)TLS supports. And (D)TLS is already present on most devices.

> On Feb 18, 2017, at 5:22 AM, Alan DeKok <[email-masked]> wrote:
> 
> _______________________________________________
> radext mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/radext