Subject: FW: SecDir review of draft-ietf-radext-tcp-transport

From: "Romascanu, Dan (Dan)" <[email-masked]>
Date: Mon, 10 May 2010 13:51:12 +0200

-----Original Message-----
From: Kurt Zeilenga [mailto:[email-masked]] 
Sent: Friday, May 07, 2010 10:51 PM
To: [email-masked]
Cc: Security Area Directorate; IETF
Subject: SecDir review of draft-ietf-radext-tcp-transport

I have reviewed this document as part of the security directorate's
ongoing effort to review all IETF documents being processed by the IESG.
These comments were written primarily for the benefit of the security
area directors.  Document editors and WG chairs should treat these
comments just like any other last call comments.

This document discussions use of RADIUS over TLS (over TCP).  This
document is being considered for publication as an Experimental RFC.

This document does not discuss the particulars of how TLS is to be used.
It seems left to draft-ietf-radext-radsec, which this document only
informatively references.  It may be appropriate to elevate the
reference to draft-ietf-radext-radsec to normative status.

I suggest inclusion of text in the Security Considerations section that
specifically refer the reader to draft-ietf-radext-radsec for RADIUS
over TLS specific security considerations, as well as RFC 5246 for
general TLS security considerations.

Beyond this, I have no security concerns with transport details this I-D
discusses.

Regards, Kurt

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://psg.com/lists/radiusext/>

---

From: Alan DeKok <[email-masked]>
Date: Tue, 11 May 2010 11:53:04 +0200

> Sent: Friday, May 07, 2010 10:51 PM
...
> document is being considered for publication as an Experimental RFC.

  FYI: It discusses RADIUS over "bare" TCP, without TLS.  It mentions
TLS only to motivate TCP.

> reference to draft-ietf-radext-radsec to normative status.

  That's fine.  It *may* be possible to use this protocol when the
network is secured (e.g. via IPSec).  But the main intent is to use it
with TLS.

> general TLS security considerations.

  OK.  I'll put that in the next rev of the document.

  Alan DeKok.