Subject: [radext] the future of RADEXT

From: Benjamin Kaduk <[email-masked]>
Date: Tue, 8 Feb 2022 10:59:20 -0800

Dear all,

The RADEXT list has seen only minimal activity since the publication of RFC
8559 in 2019, with those few topics that do come in mostly getting
redirected to OPSAWG as a more useful venue for making progress.

I confess I have been a bit negligent in letting the group linger in this
state for so long and not putting more energy into it.  That said, the
facts on the ground remain that we don't have any active drafts and there
does not seem to be much energy remaining to discuss the proposals for how
to resolve the limited 8-bit size of the RADIUS datagram's Identifier
field.

As such, I believe that we should close the RADEXT WG and continue to
redirect further RADIUS work to OPSAWG, including solutions for the
Identifier problem if energy appears to work on them.

Please let me know (on list is fine) if you have concerns about this plan
by 22 February 2022, along with any alternative proposals that might
address those concerns.  However, in order to demonstrate that there is
energy to keep the WG open and make progress on our remaining chartered
item, I would need to see interest from multiple individuals in pursuing
such a course of action, along with an estimate for when such work would
ultimately be completed (that would function as a deadline for re-assessing
the WG's progress and possibly closing the WG if insufficient progress is
being made).

This is by no means a failure outcome; the WG has produced a lot of good
work and we should be proud of what we have accomplished even as we look
forward to what might be done in OPSAWG in the future.

Thanks,

Ben

---

From: Alan DeKok <[email-masked]>
Date: Tue, 8 Feb 2022 14:25:51 -0500

> Identifier problem if energy appears to work on them.

  I think that's reasonable.

> the WG's progress and possibly closing the WG if insufficient progress is

  I'm happy to work on RADIUS things.  It would be useful to standardize RFC 6613, 6614, and 7360.  Along with updating them for TLS 1.3, and adding things like Server Name Indicator.

  I suspect, however, that there is limited interest, even though such work would be useful.

> forward to what might be done in OPSAWG in the future.

  I agree.

  Alan DeKok.

---

From: Bernard Aboba <[email-masked]>
Date: Tue, 8 Feb 2022 12:18:01 -0800

Alan said:

"It would be useful to standardize RFC 6613, 6614, and 7360.  Along with
updating them for TLS 1.3, and adding things like Server Name Indicator."

[BA] RFC 6421 laid out the process for developing a crypto-agile version of
RADIUS.  The last phase of that roadmap (selection of standardization
candidates) remains outstanding, and needs to be completed.

"I suspect, however, that there is limited interest, even though such work
would be useful."

[BA] A secure version of RADIUS will not be easy to deploy, but it's an
important task nevertheless. The information that flows unprotected over
networks via RADIUS includes information on the control and management of
network devices as well as information that can be used to determine the
location of users.  From a cryptographic standpoint, the RADIUS protocol
was substandard in the 1990s, and now, 30 years later it represents a major
weakness in critical infrastructure.  That's the kind of problem that
governments may want to take an interest in fixing.

On Tue, Feb 8, 2022 at 11:26 AM Alan DeKok <[email-masked]>
wrote:

>   I'm happy to work on RADIUS things.  It would be useful to standardize
> RFC 6613, 6614, and 7360.  Along with updating them for TLS 1.3, and adding
> things like Server Name Indicator.
>
> _______________________________________________
> radext mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/radext
>

---

From: <[email-masked]>
Date: Wed, 9 Feb 2022 09:52:52 +0000

I would be happy to contribute.

Lionel

Orange Restricted
De : radext <[email-masked]> De la part de Bernard Aboba
Envoyé : mardi 8 février 2022 21:18
À : Alan DeKok <[email-masked]>
Cc : [email-masked]; Benjamin Kaduk <[email-masked]>
Objet : Re: [radext] the future of RADEXT

Alan said:

"It would be useful to standardize RFC 6613, 6614, and 7360.  Along with updating them for TLS 1.3, and adding things like Server Name Indicator."

[BA] RFC 6421 laid out the process for developing a crypto-agile version of RADIUS.  The last phase of that roadmap (selection of standardization candidates) remains outstanding, and needs to be completed.

"I suspect, however, that there is limited interest, even though such work would be useful."

[BA] A secure version of RADIUS will not be easy to deploy, but it's an important task nevertheless. The information that flows unprotected over networks via RADIUS includes information on the control and management of network devices as well as information that can be used to determine the location of users.  From a cryptographic standpoint, the RADIUS protocol was substandard in the 1990s, and now, 30 years later it represents a major weakness in critical infrastructure.  That's the kind of problem that governments may want to take an interest in fixing.

On Tue, Feb 8, 2022 at 11:26 AM Alan DeKok <[email-masked]<mailto:[email-masked]>> wrote:

  I agree.

  Alan DeKok.

_______________________________________________
radext mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/radext

_________________________________________________________________________________________________________________________

Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,
Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.

This message and its attachments may contain confidential or privileged information that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and delete this message and its attachments.
As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.
Thank you.

---

From: <[email-masked]>
Date: Wed, 9 Feb 2022 10:30:39 +0000

Hi Ben, all,

> Identifier problem if energy appears to work on them.

OPSAWG is a special WG in the sense that it has different interest communities that rarely cross-review work. I'm not sure if RADIUS community is represented there. 

The experience I had when trying to progress some RADIUS extensions in opsawg is that, except Alan, we got no other feedback. My feeling is that will be difficult to "maintain" the protocol in OPSAWG. 

Cheers,
Med

> -----Message d'origine-----
> De : radext <[email-masked]> De la part de Benjamin Kaduk
> Envoyé : mardi 8 février 2022 19:59
> À : [email-masked]
> Objet : [radext] the future of RADEXT
> 
> Dear all,
> 
> I confess I have been a bit negligent in letting the group linger in
> this state for so long and not putting more energy into it.  That said,
> the facts on the ground remain that we don't have any active drafts and
> there does not seem to be much energy remaining to discuss the proposals
> for how to resolve the limited 8-bit size of the RADIUS datagram's
> Identifier field.
> 
> Please let me know (on list is fine) if you have concerns about this
> plan by 22 February 2022, along with any alternative proposals that
> might address those concerns.  However, in order to demonstrate that
> there is energy to keep the WG open and make progress on our remaining
> chartered item, I would need to see interest from multiple individuals
> in pursuing such a course of action, along with an estimate for when
> such work would ultimately be completed (that would function as a
> deadline for re-assessing the WG's progress and possibly closing the WG
> if insufficient progress is being made).
>

---

From: "Diego R. Lopez" <[email-masked]>
Date: Wed, 9 Feb 2022 10:56:56 +0000

Hi,

As far as I can tell, the aspects that Alan was mentioning with regards to making RADIUS more robust in security terms have a strong operational interest. I think I could find some time (mine and some colleagues') to review documents, even if Alan is the only one actually proposing text. FWIW, that goes with my support for keeping RADEXT alive if those are going to be its coming focuses.

Be goode,

--
"Esta vez no fallaremos, Doctor Infierno"

Dr Diego R. Lopez
Telefonica I+D
https://www.linkedin.com/in/dr2lopez/

e-mail: [email-masked]
Mobile:  +34 682 051 091
----------------------------------

On 09/02/2022, 11:30, "radext on behalf of [email-masked]" <[email-masked] on behalf of [email-masked]> wrote:

    Hi Ben, all,

    Cheers,
    Med

________________________________

Este mensaje y sus adjuntos se dirigen exclusivamente a su destinatario, puede contener información privilegiada o confidencial y es para uso exclusivo de la persona o entidad de destino. Si no es usted. el destinatario indicado, queda notificado de que la lectura, utilización, divulgación y/o copia sin autorización puede estar prohibida en virtud de la legislación vigente. Si ha recibido este mensaje por error, le rogamos que nos lo comunique inmediatamente por esta misma vía y proceda a su destrucción.

The information contained in this transmission is privileged and confidential information intended only for the use of the individual or entity named above. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this transmission in error, do not read it. Please immediately reply to the sender that you have received this communication in error and then delete it.

Esta mensagem e seus anexos se dirigem exclusivamente ao seu destinatário, pode conter informação privilegiada ou confidencial e é para uso exclusivo da pessoa ou entidade de destino. Se não é vossa senhoria o destinatário indicado, fica notificado de que a leitura, utilização, divulgação e/ou cópia sem autorização pode estar proibida em virtude da legislação vigente. Se recebeu esta mensagem por erro, rogamos-lhe que nos o comunique imediatamente por esta mesma via e proceda a sua destruição

---

From: Behcet Sarikaya <[email-masked]>
Date: Wed, 9 Feb 2022 09:30:26 -0600

On Wed, Feb 9, 2022 at 4:57 AM Diego R. Lopez <[email-masked]>
wrote:

> Hi,
>
> As far as I can tell, the aspects that Alan was mentioning with regards to
> making RADIUS more robust in security terms have a strong operational
> interest. I think I could find some time (mine and some colleagues') to
> review documents, even if Alan is the only one actually proposing text.
> FWIW, that goes with my support for keeping RADEXT alive if those are going
> to be its coming focuses.
>
>
+1

Behcet

> On 09/02/2022, 11:30, "radext on behalf of [email-masked]"
> <[email-masked] on behalf of [email-masked]> wrote:
>
>     Hi Ben, all,
>
>     OPSAWG is a special WG in the sense that it has different interest
> communities that rarely cross-review work. I'm not sure if RADIUS community
> is represented there.
>
>     The experience I had when trying to progress some RADIUS extensions in
> opsawg is that, except Alan, we got no other feedback. My feeling is that
> will be difficult to "maintain" the protocol in OPSAWG.
>
>     Cheers,
>     Med
>
>     > The RADEXT list has seen only minimal activity since the publication
> of
>     > RFC
>     Ce message et ses pieces jointes peuvent contenir des informations
> confidentielles ou privilegiees et ne doivent donc
>     pas etre diffuses, exploites ou copies sans autorisation. Si vous avez
> recu ce message par erreur, veuillez le signaler
>     a l'expediteur et le detruire ainsi que les pieces jointes. Les
> messages electroniques etant susceptibles d'alteration,
>     This message and its attachments may contain confidential or
> privileged information that may be protected by law;
> Este mensaje y sus adjuntos se dirigen exclusivamente a su destinatario,
> puede contener información privilegiada o confidencial y es para uso
> exclusivo de la persona o entidad de destino. Si no es usted. el
> destinatario indicado, queda notificado de que la lectura, utilización,
> divulgación y/o copia sin autorización puede estar prohibida en virtud de
> la legislación vigente. Si ha recibido este mensaje por error, le rogamos
> que nos lo comunique inmediatamente por esta misma vía y proceda a su
> destrucción.
>
> The information contained in this transmission is privileged and
> confidential information intended only for the use of the individual or
> entity named above. If the reader of this message is not the intended
> recipient, you are hereby notified that any dissemination, distribution or
> copying of this communication is strictly prohibited. If you have received
> this transmission in error, do not read it. Please immediately reply to the
> sender that you have received this communication in error and then delete
> it.
>
> Esta mensagem e seus anexos se dirigem exclusivamente ao seu destinatário,
> pode conter informação privilegiada ou confidencial e é para uso exclusivo
> da pessoa ou entidade de destino. Se não é vossa senhoria o destinatário
> indicado, fica notificado de que a leitura, utilização, divulgação e/ou
> cópia sem autorização pode estar proibida em virtude da legislação vigente.
> Se recebeu esta mensagem por erro, rogamos-lhe que nos o comunique
> imediatamente por esta mesma via e proceda a sua destruição

---

From: Oleg Pekar <[email-masked]>
Date: Wed, 9 Feb 2022 19:49:46 +0200

I would be happy to see this WG alive.

On Wed, Feb 9, 2022 at 11:53 AM <[email-masked]> wrote:

> *De :* radext <[email-masked]> *De la part de* Bernard Aboba
> *Envoyé :* mardi 8 février 2022 21:18
> *À :* Alan DeKok <[email-masked]>
> *Cc :* [email-masked]; Benjamin Kaduk <[email-masked]>
> *Objet :* Re: [radext] the future of RADEXT
>
>
>
> Alan said:
>
>
>
> [BA] RFC 6421 laid out the process for developing a crypto-agile version
> of RADIUS.  The last phase of that roadmap (selection of standardization