Subject: FW: DISCUSS: draft-ietf-radext-tcp-transport

From: "Romascanu, Dan (Dan)" <[email-masked]>
Date: Thu, 20 May 2010 09:58:49 +0200

I-D Editors,

Please address the issues raised by Tim in his DISCUSS. 

Thanks and Regards,

Dan

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of
Tim Polk
Sent: Wednesday, May 19, 2010 9:55 PM
To: [email-masked]
Cc: [email-masked];
[email-masked]
Subject: DISCUSS: draft-ietf-radext-tcp-transport 

Discuss:
This is a good document, but there are a few issues that should be
addressed before publication.

(1) The document is inconsistent regarding the applicability of this
protocol.

>From the Abstract, where "It" refers to this document:

It is not intended
   to define TCP as a transport protocol for RADIUS in the absence of
   TLS.

but the last paragraph in the Introduction states:

   "Bare" TCP transport MAY, however, be used when another method such
   as IPSec [RFC4301] is used to provide additional confidentiality and
   security.  Should experience show that such deployments are useful,
   this specification could be moved to standards track.

(2) In a related point, the next to last paragraph in the Introduction
states:

   Since "bare" TCP does not provide for confidentiality or enable
   negotiation of credible ciphersuites, its use is not appropriate for
   inter-server communications where strong security is required.  As a
   result the use of "bare" TCP transport (i.e., without additional
   confidentiality and security) is NOT RECOMMENDED, as there has been
   little or no operational experience with it.

Why isn't this a "MUST NOT be used without TLS, IPsec, or other secure
upper layer"?

(3) The security considerations should include a statement along the
same lines as discussed in (2) - e.g., MUST NOT be used unless TLS or
IPsec is used in conjunction.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://psg.com/lists/radiusext/>

---

From: "Romascanu, Dan (Dan)" <[email-masked]>
Date: Thu, 20 May 2010 12:31:46 +0200

Editors,

Please address this DISCUSS. 

Thanks and Regards,

Dan

-----Original Message-----
Ralph Droms
Sent: Thursday, May 20, 2010 1:18 PM

Discuss:
This Discuss is related to Tim's Discuss.  This text:

is confusing.  Why would experience with "bare" TCP or IPSec TCP cause
draft-ietf-radext-tcp-transport to progress to Standards Track?

Similarly, from the Abstract:

   It [draft-ietf-radext-tcp-transport-06.txt] is not intended
   to define TCP as a transport protocol for RADIUS in the absence of
   TLS.

while several of the motivations for RADIUS over TCP in section 1.1 are
not specific to RADIUS with TLS.