Re: Continued discussion of RADIUS Crypto-Agility

[Alan DeKok <aland@deployingradius.com>]

Dan Harkins wrote:
>   Each RADIUS client MUST go through the step of obtaining the certificate
> of the certification authority and affirmatively trusting it before it is
> used to authenticate the TLS exchange.

  In the BOF that started RADEXT, I presented a "client kickstart"
draft, co-authored with Robert Moskowitz.  It's functionally equivalent
to (D)TLS + DNS lookups to find the server, along with fingerprint
validation.

>   There is a dangerous attraction to (D)TLS because people can do server-
> side authentication only and base that on a self-signed certificate--
> they typically say something along the lines of "just click <ok> when
> asked if you want to proceed!". They think that since they're using TLS
> then everything is secure when, in fact, their deployment is patently
> insecure.

  <g>  "Just use IPSec!"

  The issue that (D)TLS solves is one of mind-share.  Administrators are
familiar with TLS, and with the tools to deploy a TLS-based infrastructure.

> This sort of provisioning is something that people who manage
> RADIUS servers have done before since it's how the current RADIUS secret
> is provisioned. Asking administrators to install a certificate in a
> trusted store on every RADIUS client, in addition to asking them to install
> a username and password, might be alot to ask. Would demanding that they
> deploy a PKI and assign a certificate and private key to every RADIUS
> client be too much to ask?

  For new deployments, it's possible.  Existing ones are often beyond hope.

  Alan DeKok.

--
to unsubscribe send a message to radiusext-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://psg.com/lists/radiusext/>