Re: RADEXT WG re-charter

[Alan DeKok <aland@nitros9.org>]

Joseph Salowey (jsalowey) wrote:
> There are a few reasons why you would want to wrap keys separately from
> other data.  As you mentioned, the recommended algorithms for key wrap
> may not be suitable for encrypting bulk data without special
> consideration and some bulk data encryption algorithms may not be
> recommended for key wrap without special consideration.  Another reason
> is that you may want the entity that handles the keys and their context
> to be different from the entity that handles the rest of the attributes.

  i.e. distributing wireless keys to a NAS.  For reasons outlined in RFC
3538, RadSec is likely not a good idea for NAS -> local AAA
communications.  DTLS is better for transport, but still may be
difficult for some to implement.  Encrypting only the keys is likely
sufficient.

  Alan DeKok.

--
to unsubscribe send a message to radiusext-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://psg.com/lists/radiusext/>