[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: AW: AW: AW: Digest Authentication: Security issue with https/sips

Bernard Aboba wrote:

Consider the following proposal (section RADIUS client behaviour):
"If the scheme in the digest-uri directive indicates a secure HTTP-style
connection (eg sips, https) and the RADIUS client does not have a secure
connection to its RADIUS server, it MUST act as if it had received an
Access-Reject."

Less comprehensible, but no normative statement for SIP or HTTP.


How can the RADIUS client act like it received an Access-Reject before even sending an Access-Request?

Presumably it refers to the fact that the RADIUS client could take the same local actions that it will take when it receives an Access-Reject... namely, inform the SIP/HTTP server about it.

But I still disagree with the fact under discussion: first, the lack of encryption of the RADIUS interface puts a penalty to the users that are tring just to encrypt the communication. This IMHO deviates from the main point of using a secure URI (sips, https).

/Miguel

--
Miguel A. Garcia           tel:+358-50-4804586
sip:miguel.an.garcia@openlaboratory.net
Nokia Research Center      Helsinki, Finland


--
to unsubscribe send a message to radiusext-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://psg.com/lists/radiusext/>