Re: Thoughts on Requirements for RADIUS crypto-agility

[Alan DeKok <aland@nitros9.org>]

Glen Zorn (gwz) wrote:
> Initially, I agreed with you on this, bur re-reading David's message I
> wonder if the replay protection stuff just applies to the crypto
> algorithm negotiation mechanism?

  Perhaps.  I think there's also a need for replay protection in RADIUS.
 The suggested use of Event-Timestamp in Section 5.4 of RFC 3576 is
better than nothing.  But it doesn't protect the server from replay
attacks within a large window, so it's usefulness is limited.

>  If not, the straw-man requirements
> would appear to be self-contradictory since requirement 11 states
> "Similarly, the addition of new capabilities to the RADIUS protocol is
> out of scope; a proposal should focus on the crypto-agility problem and
> nothing else." yet (IMHO) strong replay protection is certainly a new
> capability for RADIUS & it is a crypto application, rather than an
> agility thing.

  I am sure we will get clarification on the issues. :)

  Alan DeKok.

--
to unsubscribe send a message to radiusext-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://psg.com/lists/radiusext/>