Subject: [radext] #85: Confidentiality Requirements

From: "radext issue tracker" <[email-masked]>
Date: Sat, 05 Mar 2011 22:15:34 -0000

#85: Confidentiality Requirements

 Section 4.3 states:

    Proposals MUST support the negotiation of cryptographic algorithms
    for per-packet integrity/authentication protection.  Support for
    confidentiality of entire RADIUS packets is OPTIONAL.  However,
    proposals MUST support the negotiation of algorithms for encryption
    (sometimes referred to as "hiding") of RADIUS attributes.  It is
    RECOMMENDED for proposals to provide for the encryption
    of existing attributes.  This includes existing "hidden" attributes
    as well as attributes (such as location attributes) that require
    confidentiality.

 This paragraph is confusing along multiple dimensions.

 Since RADIUS is a transactional protocol, it is not possible to
 "negotiate" algorithms for use in a RADIUS request; algorithm(s) must be
 chosen.  Also, it is not clear whether negotiation as referred to here
 would refer to encryption of entire RADIUS packets or just individual
 attributes.  Also does "encryption of existing attributes" imply that
 attributes can be doubly encrypted?

-- 
---------------------------------------+------------------------------------
 Reporter:  bernard_aboba@…            |       Owner:            
     Type:  defect                     |      Status:  new       
 Priority:  major                      |   Milestone:  milestone1
Component:  Crypto-Agility             |     Version:  1.0       
 Severity:  Active WG Document         |    Keywords:            
---------------------------------------+------------------------------------

Ticket URL: <http://trac.tools.ietf.org/wg/radext/trac/ticket/85>
radext <http://tools.ietf.org/radext/>

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://psg.com/lists/radiusext/>

---

From: "radext issue tracker" <[email-masked]>
Date: Sun, 06 Mar 2011 03:11:52 -0000

Changes (by bernard_aboba@…):

  * status:  new => closed
  * resolution:  => fixed

Comment:

 Proposal is to change the existing text to the following:

 Proposals MUST support the negotiation of cryptographic algorithms
 for per-packet integrity/authentication protection.
 It is RECOMMENDED that solutions provide support for confidentiality,
 either by supporting encryption of entire RADIUS packets or
 by encrypting individual RADIUS attributes.
 This includes providing support for improving the confidentiality of
 existing encrypted (sometimes referred to as "hidden")
 attributes as well as encrypting attributes (such as location attributes)
 that are currently transmitted in cleartext.
 Proposals supporting confidentiality MUST support the negotiation
 of cryptographic algorithms for encryption.

-- 
---------------------------------------+------------------------------------
 Reporter:  bernard_aboba@…            |        Owner:            
     Type:  defect                     |       Status:  closed    
 Priority:  major                      |    Milestone:  milestone1
Component:  Crypto-Agility             |      Version:  1.0       
 Severity:  Active WG Document         |   Resolution:  fixed     
 Keywords:                             |  
---------------------------------------+------------------------------------

Ticket URL: <https://wiki.tools.ietf.org/wg/radext/trac/ticket/85#comment:1>
radext <http://tools.ietf.org/radext/>