Subject: Re: [HOKEY] draft-gaonkar-radext-erp-attrs-03

From: "David B. Nelson" <[email-masked]>
Date: Wed, 12 Mar 2008 19:12:49 -0400

Glen writes...

> > If I understand the direction in HOKEY, there will be an
> > un-encrypted RADIUS Key Container Attribute defined for use in
> > HOKEY, within a HOKEY draft.
> 
> I'm not at all sure that that is a good idea -- it seems to assume the
> usage of an external-to-RADIUS protection method (DTLS, IPsec, etc.) &
> preclude the usage of RADIUS-based protection (e.g., key wrap).

Why do you say that?  If we have Encrypted Attributes in RADIUS, surely that
specifies an internal-to-RADIUS cryptographic protection mechanism.  Cannot
the HOKEY Key Container attribute use the Encrypted Attribute format?

> > RADEXT will continue to pursue Crypto-Agility for
> > cryptographic protection on *any* attribute through a merger
> > of two of Glen's drafts (Key Wrap and Encrypted Attributes).
> > Other RADIUS protection options are RADIUS over DTLS, RADSEC
> > and RADIUS over IPsec.
> 
> Actually, only RADIUS over DTLS really qualifies, I think: IPsec is
> inappropriate for a couple of reasons...

But it is apparently is use as would work in those deployments.

_______________________________________________
HOKEY mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/hokey

---

From: "Glen Zorn" <[email-masked]>
Date: Wed, 12 Mar 2008 18:53:04 -0700

David B. Nelson <mailto:[email-masked]> scribbled on
Wednesday, March 12, 2008 7:13 PM:

>> I'm not at all sure that that is a good idea -- it seems to assume
>> the usage of an external-to-RADIUS protection method (DTLS, IPsec,
>> etc.) & preclude the usage of RADIUS-based protection (e.g., key
>> wrap). 
> 
> Why do you say that?  If we have Encrypted Attributes in
> RADIUS, surely that specifies an internal-to-RADIUS
> cryptographic protection mechanism.  Cannot the HOKEY Key
> Container attribute use the Encrypted Attribute format?

Maybe; nobody knows for sure, yet...
_______________________________________________
HOKEY mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/hokey

---

From: "David B. Nelson" <[email-masked]>
Date: Wed, 12 Mar 2008 22:07:23 -0400

Glen Zorn writes...

> > Cannot the HOKEY Key Container attribute use the Encrypted
> > Attribute format?
> 

Hmmm.  OK.  As an author of both the RADIUS Encrypted Attributes draft and
the RADIUS Key Wrap draft, I would hope you would be in a particularly good
position to offer practical advice on that point.  No?

---

From: Bernard Aboba <[email-masked]>
Date: Thu, 13 Mar 2008 07:05:10 -0700

> the HOKEY Key Container attribute use the Encrypted Attribute format?

I don't see why this wouldn't work.  There might be some algorithm
considerations (for example, use of AES Keywrap with appropriate padding).  
_______________________________________________
HOKEY mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/hokey

---

From: "Glen Zorn" <[email-masked]>
Date: Wed, 12 Mar 2008 18:11:51 -0400

David B. Nelson <mailto:[email-masked]> scribbled on
Wednesday, March 12, 2008 5:26 PM:

> Hi Lakshminath,
> 
>> Thanks.  I can followup with a presentation to the RADEXT WG.
>> 
>> The plan was to present a variation of that work, based on Glen's
>> long standing work in the area at the HOKEY meeting.  Charles wants
>> to consider the item as a HOKEY WG item.  I am cc'ing him so he can
>> clarify any misunderstanding on my part.
>> 
>> I can come by the RADEXT meeting and try and address the issues
>> raised. Please let me know how much time I will have.
> 
> 9:50 - 10:00 AM  RADIUS support for EAP Re-authentication
> (Lakshminath Dondeti)
> http://www.ietf.org/internet-drafts/draft-gaonkar-radext-erp-at
> trs-03.txt  
> 
> Based on the decisions in HOKEY this morning, do you want to
> change the focus of the presentation?
> 

I'm not at all sure that that is a good idea -- it seems to assume the
usage of an external-to-RADIUS protection method (DTLS, IPsec, etc.) &
preclude the usage of RADIUS-based protection (e.g., key wrap).  Surely
you don't imagine that we will revisit this issue once radext makes up
its collective mind?

Actually, only RADIUS over DTLS really qualifies, I think: IPsec is
inappropriate for a couple of reasons & RADSEC isn't RADIUS (though it
does qualify as AAA).

> Regards,
> Dave