Re: Clearinghouse/Aggregator Support for CUI

["Alan DeKok" <aland@ox.org>]

Avi Lior <avi@bridgewatersystems.com> wrote:
> Operators and SDO that would use the Opaque value would typically have their
> own security review.

  Which is precisely my concern.

  IMHO, for "hidden" data in CUI, inter-operability is less of a
requirement than is "best practices".  The IETF has a history of
accepting both in documents, and sometimes even in the same document.

> Furthermore when thinking about how one might do this, there are many
> factors to consider and these factors are specific to deployments.  So I am
> not sure if we came up with an example it would have general applicability.

  A well-known method which hides the CUI data from all but the users
home system would cover many common cases.

  Since the CUI is encrypted in a TLS tunnel, but is visible to the
end system, then there is value in continuing that practice when the
CUI is carried an attribute.

  Having a CUI which is private, and requires minimal state keeping by
the home server seems to me to be a good solution.

  Alan DeKok.

--
to unsubscribe send a message to radiusext-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://psg.com/lists/radiusext/>