draft-chiba-radius-dynamic-authorization-18

[Russ Housley <housley@vigilsec.com>]

  Section 5.3 says:

    When IPsec ESP is used with RADIUS, DES-CBC SHOULD NOT be used as the
    encryption transform, and per-packet authentication, integrity and
    replay protection MUST be used.  A typical IPsec policy for an IPsec-
    capable RADIUS client is "Initiate IPsec, from me to any destination
    port UDP 1812".

    This causes an IPsec SA to be set up by the RADIUS client prior to
    sending RADIUS traffic.  If some RADIUS servers contacted by the client
    do not support IPsec, then a more granular policy will be required:
    "Initiate IPsec, from me to IPsec-Capable-RADIUS-Server, destination
    port UDP 1812".

  I agree that DES-CBC should not be used; however, we ought to tell the 
implementors what algorithm ought to be used for 
interoperability.  Further, the text requires integrity protection, but no 
integrity mechanisms are discussed.  Also, the discussion of IPsec policy 
should not be split between these two paragraphs.

  I propose the following:

    When IPsec ESP is used with RADIUS, per-packet authentication,
    integrity and replay protection MUST be used.  AES-CBC SHOULD be
    used as the encryption transform, and HMAC-SHA1-96 SHOULD be used
    as the authentication function.  DES-CBC SHOULD NOT be used as the
    encryption transform.

    A typical IPsec policy for an IPsec-capable RADIUS client is
    "Initiate IPsec, from me to any destination port UDP 1812".  This
    IPsec policy causes an IPsec SA to be set up by the RADIUS client
    prior to sending RADIUS traffic.  If some RADIUS servers contacted
    by the client do not support IPsec, then a more granular policy
    will be required: "Initiate IPsec, from me to
    IPsec-Capable-RADIUS-Server, destination port UDP 1812".

  Later in section 5.3, the text says: "... it is important that trust be 
demonstrated ..."  In this context, "trust" is very ambiguous.  Please 
reword.  I think that the paragraph should discuss "authentication" and 
"authorization."

  Later in section 5.3, change "Certificate Authority (CA)" to 
"Certification Authority (CA)."