Subject: [Fwd: Re: Reminder: automated key management is often required for new protocols]

From: "David B. Nelson" <[email-masked]>
Date: Wed, 14 Nov 2007 15:23:11 -0500

Once again, channeling Sam Hartman's response to the RADEXT list.

>     David> Well, besides that, some folks at Cisco expressed a desire
>     David> to replace the crypto elements of RADIUS (e.g. key wrap,
>     David> MAC, etc.) with algorithms and modes that would allow
>     David> systems including RADIUS to receive FIPS certification, for
>     David> solutions in government and financial services markets.
> 
>     David> Additionally, the folks behind the EduRoam consortium in
>     David> Europe have deployed RADIUS over TLS for inter-university
>     David> roaming authentication.
> 
> I think automated key management is important for both of these use
> cases.

Based on this response from Sam, it seems to me that we need to ask the 
authors of the various RADIUS Crypto-Agility proposals (Key Wrap, RADIUS 
over DTLS, RADIUS over TLS) to submit a write-up of how their proposal 
provides for automated key management, per RFC 4107, or why they think 
RFC 4107 requirements do not apply.  In the latter case, the authors and 
the WG would need to be prepared to address any DISCUSS that might come 
from Sam during IESG review.

Another use case that I've recently become aware of is RADIUS Key Wrap 
for use in the HOKEY WG.  We should address that, as well.

Subject: Re: Reminder: automated key management is often required for new protocols
From: Sam Hartman <[email-masked]>
To: "David B. Nelson" <[email-masked]>
Cc: [email-masked]
Date: Wed, 14 Nov 2007 14:43:03 -0500

>>>>> "David" == David B Nelson <[email-masked]> writes:

    David> Well, besides that, some folks at Cisco expressed a desire
    David> to replace the crypto elements of RADIUS (e.g. key wrap,
    David> MAC, etc.) with algorithms and modes that would allow
    David> systems including RADIUS to receive FIPS certification, for
    David> solutions in government and financial services markets.

    David> Additionally, the folks behind the EduRoam consortium in
    David> Europe have deployed RADIUS over TLS for inter-university
    David> roaming authentication.

I think automated key management is important for both of these use
cases.

---

From: Alan DeKok <[email-masked]>
Date: Thu, 15 Nov 2007 11:43:23 +0100

> from Sam during IESG review.

 From RFC 4107:

   Examples of automated key management systems include IPsec IKE and
   Kerberos.  S/MIME and TLS also include automated key management
   functions.

  Yes: DTLS uses TLS, which passes the RFC 4107 requirements for
automated key management.  Long-term keys (e.g. certificates) can be
distributed manually to each RADIUS device, which is permitted by RFC 4107.

  From Section 2.1, DTLS uses stream ciphers, which means that automated
key management must be used.

  From Section 2.2, RADIUS over DTLS meets none of the criteria for
permitting manual key management.

  Alan DeKok.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://psg.com/lists/radiusext/>