Subject: [AAA-WG]: Re: IPSEC/SSL vs. RADIUS simplicity

From: "Bernard Aboba" <[email-masked]>
Date: Wed, 14 Feb 2001 08:56:52 -0800

>I have to say I disagree with the new approach to security.  I don't mind
the
>ipsec/SSL between proxies, but the "beauty" of RADIUS was that it was very
>simple to implement, and did not add much network traffic.  Also, RADIUS
>take many resources to run, which was good since NASs had low memory and
>slow CPUs.

SSL has now been implemented on  PDAs with 16 MB of memory. Similarly, I've
seen ISPEC implementations (without IKE) on embedded systems.
So I don't think I'd conclude that SSL/IPSEC is beyond the capability of
modern NASen, though it does certainly add work.

>I think that if we require IKE/IPSEC and/or SSL at the NAS level, then we
are
>losing all of the benefit that RADIUS had.

Mandating IPSEC isn't the same as mandating IKE. I'd just refer to the IPSEC
RFCs on that issue. For example, here's the language we put into the L2TP
security spec:

"L2TP security MUST meet the key management requirements of the IPSEC
protocol suite. IKE SHOULD be supported for authentication, security
association negotiation, and key management using the IPSEC DOI [5]."