Subject: Issue: RADSEC and DTLS docs

From: "Joseph Salowey (jsalowey)" <[email-masked]>
Date: Thu, 26 Mar 2009 11:33:45 -0700

Submitter name: Joe Salowey
Submitter email address: [email-masked]
Date first submitted: 3/26/2009
Document: draft-ietf-radext-radsec-04.txt
Comment type: T
Priority: 1
Section: 
Rationale/Explanation of issue:
Many of the details between RADSEC and DTLS should be the same.  I'm
worried that the two specs may diverge if the progress differently
through the IETF.  Is there any reason why we cannot cover DTLS in this
draft as well?  

Requested change:
Have the document cover DTLS.  

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://psg.com/lists/radiusext/>

---

From: Stefan Winter <[email-masked]>
Date: Thu, 26 Mar 2009 20:38:20 +0100

Hi,

> Have the document cover DTLS.  

I suggest we discuss this in the radext meeting and see how we go from 
there.

Greetings,

Stefan Winter

---

From: Alan DeKok <[email-masked]>
Date: Sat, 28 Mar 2009 08:34:42 -0700

> Have the document cover DTLS.  

  I'll rev the DTLS document soon.  We can then see how much of it
simply references radsec.  If the DTLS-specific portions are small, it
may be good to add them to the radsec document.

  Alan DeKok.

---

From: Bernard Aboba <[email-masked]>
Date: Sun, 29 Mar 2009 08:10:59 -0700

> may be good to add them to the radsec document.

Even if the DTLS-specific portions are small, there is still a "compliance" issue. 

That is, if two vendors say "I implement RADSEC" -- what would it mean, if one could be doing RADIUS over TLS/TCP and another, RADIUS over DTLS/UDP?  

Whereas if there are two separate documents, and someone says "I implement RADIUS over DTLS",  now we know what transport they are using. 

There are similar concerns about RADIUS over TCP, but we discussed indicating in the document that this is only intended for use with RADSEC.

---

From: Klaas Wierenga <[email-masked]>
Date: Sun, 29 Mar 2009 17:45:20 +0200

On Mar 29, 2009, at 5:10 PM, Bernard Aboba wrote:

> That is, if two vendors say "I implement RADSEC" -- what would it  
> mean, if one could be doing RADIUS over TLS/TCP and another, RADIUS  
> over DTLS/UDP?

ehm.. so they should say "I implement RadSec over TCP" or "I  
implement  RadSec over UDP" ;-)

>
> Whereas if there are two separate documents, and someone says "I  
> implement RADIUS over DTLS",  now we know what transport they are  
> using.
>
> There are similar concerns about RADIUS over TCP, but we discussed  
> indicating in the document that this is only intended for use with  
> RADSEC.