Re: Fwd: Re: RADIUS

[Bernard Aboba <aboba@internaut.com>]

> Would it be unreasonable to ask such people to generate a companion AAA
> draft at the same time, to show the way forward?

Assuming that there is empirical evidence that a AAA-based approach to the
problem makes sense, and there is some thought about the security issues,
and a volunteer to write the draft, sure.

BTW, when the phrase "RADIUS is dead" or "the IETF is done with RADIUS" is
used, my eperience is that this is typically used to justify why a
particular "extension" should not be subjected to IETF review. We've just
gone through a review of the 3GPP2 Credit Control document for Diameter,
which is based on a RADIUS "extension" that appears to qualify as Level 2
RADIUS Abuse (it cannot work reliably). So not only will 3GPP2 probably
need to redo their pre-paid RADIUS specification, but the Diameter
specification has some of the same problems, too. All in all, if the
documents had been brought to the IETF first, the whole process would have
been considerably shortened (and implementations in progress would not
need to be rewritten).