RE: RADEXT WG re-charter

["David B. Nelson" <dnelson@elbrysnetworks.com>]

Joseph Salowey writes...

> ...you could encrypt the attributes that need to be separated, such
> as keys, with an appropriate algorithm, such as SIV or the ever 
> unpopular AES keywrap, and then encapsulate the whole message 
> including the encrypted attributes with DTLS, IPSEC, etc. to 
> protect additional attributes in transit.
> 
> So, I don't view these mechanisms as mutually exclusive.

In point of fact, based on the notion that NASes may be required to continue
using the legacy UDP-based RADIUS, these approaches may be complementary.
There may be cases where encrypted attributes are preferable to encrypted
transport.  The converse may also be true.



--
to unsubscribe send a message to radiusext-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://psg.com/lists/radiusext/>