RE: Meaning of "backward compatible" WAS RE: Consensus Call on RADEXT WG re-charter

["Glen Zorn" <glenzorn@comcast.net>]

owner-radiusext@ops.ietf.org <> scribbled on Thursday, April 17, 2008
1:07 AM:

> Matt Holdrege writes...
> 
>> OK, that's fine, but then if *real* RADIUS clients aren't really a
>> part of this effort, then why is it in this WG?
> 
> Hmmm.  Because the WG isn't limited to considering only RADIUS
> extensions that [primarily] impact the NAS?

Hmmm.  Since _everything_ has to change, how can you say that?

> 
>> I assume you have some reason for not using IETF recommended IPsec to
>> secure proxy-to-proxy data?
> 
> That issue has been discussed.  There are implementations and
> deployments of RADIUS over IPsec.  The thing that some folks
> don't like about IPsec is that it's a Layer 3 protocol and
> isn't visible to applications at Layer 4 (e.g.
> at the socket interface) the way TLS is.
> 
>> If so, why don't you create another proxy-server to proxy-server
>> encryption protocol?
> 
> One could claim that RADSEC neatly fills that bill.

Conceptually, yes; it's nowhere near fully baked from a standards POV
IMHO, but it (or something very similar) has been working in very large
commercial roaming networks for a very long time.  BTW (since it doesn't
seem to have gotten through to some people) let me say it again: I am
not & never have been opposed to the standardization of RadSec.  I think
that it's a mistake to undertake the task in this WG (not least of all
because of an obvious antagonism to innovation on the part of some
members) but since the tide of opinion seems to be to do that it's fine.
I AM REALLY OPPOSED TO BS, however & I don't really understand this
manic grasping at straws to claim RadSec's "backward compatibility", to
the point that now we have 'if you used this interface when you wrote
your code (as opposed to the easy, obvious one)' then it's really almost
the same but not quite'.  Please.

...



--
to unsubscribe send a message to radiusext-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://psg.com/lists/radiusext/>