
From jouni.nospam@gmail.com  Thu Jan  2 00:50:57 2014
Return-Path: <jouni.nospam@gmail.com>
X-Original-To: radext@ietfa.amsl.com
Delivered-To: radext@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4E51D1ADF77 for <radext@ietfa.amsl.com>; Thu,  2 Jan 2014 00:50:57 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level: 
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9,  DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MGR2n-9L0N2e for <radext@ietfa.amsl.com>; Thu,  2 Jan 2014 00:50:56 -0800 (PST)
Received: from mail-lb0-x235.google.com (mail-lb0-x235.google.com [IPv6:2a00:1450:4010:c04::235]) by ietfa.amsl.com (Postfix) with ESMTP id 980171AE361 for <radext@ietf.org>; Thu,  2 Jan 2014 00:50:55 -0800 (PST)
Received: by mail-lb0-f181.google.com with SMTP id q8so7203905lbi.12 for <radext@ietf.org>; Thu, 02 Jan 2014 00:50:48 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=content-type:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=6UV4XUM2i4a8DfKB29Wa0Ko1dT+Xf9k+Ih2STb2nOv8=; b=0tYXllXrPrCnVT3ThKuPGbosa4pifhdto8J0cWHIiQ6tZD+WFidPDN0RiIqhK9iVTn asLFSOfJJo7zQrcTyt5uXjh1/4F7erZ2OF92LmJH6+0vv4Bx8fCUi+J0uO7GDShmr8v0 sZnwCSMv/kvIiDlAF1N3m+QJdGHQLjBz3c/Jzf7WgbRAgCc0VD2wNIYmP8IkepndpV0t QMx28HGZWTGTcvS5wLCCG2nwMwQ85C9KCGFCvLbavml5JflFOVYHmvO+BNQgHMruyQkf URjcH8M2idoC4VRzxFEIv1RTWdrMrVrH3i/3eS3D0Rff+ZpN3Y60ryE8QwX3zwks3kUs QcmQ==
X-Received: by 10.112.168.66 with SMTP id zu2mr2061229lbb.60.1388652648091; Thu, 02 Jan 2014 00:50:48 -0800 (PST)
Received: from [188.117.15.108] ([188.117.15.108]) by mx.google.com with ESMTPSA id t9sm43699268lat.1.2014.01.02.00.50.45 for <multiple recipients> (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Thu, 02 Jan 2014 00:50:45 -0800 (PST)
Content-Type: text/plain; charset=us-ascii
Mime-Version: 1.0 (Mac OS X Mail 6.6 \(1510\))
From: Jouni Korhonen <jouni.nospam@gmail.com>
In-Reply-To: <FB2094C6-9956-4690-A4EC-5423D8D33C68@gmail.com>
Date: Thu, 2 Jan 2014 10:51:19 +0200
Content-Transfer-Encoding: quoted-printable
Message-Id: <33207D43-234B-4EB9-A712-E719F573252B@gmail.com>
References: <FB2094C6-9956-4690-A4EC-5423D8D33C68@gmail.com>
To: "radext@ietf.org" <radext@ietf.org>
X-Mailer: Apple Mail (2.1510)
Cc: Mauricio Sanchez <mauricio.sanchez@hp.com>, "draft-ietf-radext-radius-fragmentation@tools.ietf.org" <draft-ietf-radext-radius-fragmentation@tools.ietf.org>
Subject: Re: [radext] WGLC for draft-ietf-radext-radius-fragmentation-02
X-BeenThere: radext@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: RADIUS EXTensions working group discussion list <radext.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/radext>, <mailto:radext-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/radext/>
List-Post: <mailto:radext@ietf.org>
List-Help: <mailto:radext-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/radext>, <mailto:radext-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 02 Jan 2014 08:50:57 -0000

Folks,

Come on.. zero reviews/comments so far.

- Jouni


On Dec 19, 2013, at 3:10 PM, Jouni Korhonen <jouni.nospam@gmail.com> =
wrote:

> Folks,
>=20
> This email starts a two week WGLC for =
draft-ietf-radext-radius-fragmentation-02.
> The WGLC end 2nd Jan 2014. Express your comments and concerns in the =
mailing
> list. If you want your comments to be properly tracked and reflected, =
enter them
> into the Issue Tracker.
>=20
> - Jouni & Mauricio


From jouni.nospam@gmail.com  Tue Jan 14 00:47:01 2014
Return-Path: <jouni.nospam@gmail.com>
X-Original-To: radext@ietfa.amsl.com
Delivered-To: radext@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8A9AF1AE21B for <radext@ietfa.amsl.com>; Tue, 14 Jan 2014 00:47:01 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level: 
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9,  DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6eS3p4RiIcvh for <radext@ietfa.amsl.com>; Tue, 14 Jan 2014 00:47:00 -0800 (PST)
Received: from mail-la0-x22e.google.com (mail-la0-x22e.google.com [IPv6:2a00:1450:4010:c03::22e]) by ietfa.amsl.com (Postfix) with ESMTP id 12B011AE1DB for <radext@ietf.org>; Tue, 14 Jan 2014 00:46:59 -0800 (PST)
Received: by mail-la0-f46.google.com with SMTP id b8so64357lan.33 for <radext@ietf.org>; Tue, 14 Jan 2014 00:46:48 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=content-type:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=0OpIWf2sDWAOD3aDM8sCoY7azbxpiuBdUkmPhByq4FU=; b=M+OIcSLOQ1Wq/NVgg5rYXJRNC7YPYhYBveJ+dI3LQoJJIls6H2uqjtq9ZVchW76C2T OHcnm20WiSjYGoMXLKpupCd8EFDX5IpiW4vwC/Qz5n2gD2iiuLfqzPDSAntlGj3IHn7a 7pyC2cptWjHHGB5mTwLyuXgWyNdgaB4p2+D3lTp7hExXWWmdAFDkVM+In53An33a/Jew WA/mxF+sERskCCkESioyB6SLkSfNn8lK/3B2d40UIzzAmQqYKsIsQyB9N2cjsjNraOBf cMQoIazXhzuVpTOtWarGnBRMvxEsoxIY0runeDx5c+9ewScrwXgOdZCcz3mEncVJYMQL yIeQ==
X-Received: by 10.112.234.194 with SMTP id ug2mr147456lbc.86.1389689208043; Tue, 14 Jan 2014 00:46:48 -0800 (PST)
Received: from [192.168.250.117] ([194.100.71.98]) by mx.google.com with ESMTPSA id e6sm11397447lbs.3.2014.01.14.00.46.43 for <multiple recipients> (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Tue, 14 Jan 2014 00:46:43 -0800 (PST)
Content-Type: text/plain; charset=us-ascii
Mime-Version: 1.0 (Mac OS X Mail 6.6 \(1510\))
From: Jouni Korhonen <jouni.nospam@gmail.com>
In-Reply-To: <15BCB5AD-55A0-4C74-B9BB-67448122EFF6@gmail.com>
Date: Tue, 14 Jan 2014 10:46:43 +0200
Content-Transfer-Encoding: 7bit
Message-Id: <23ABE552-71C9-4231-82B0-0D1861C922CB@gmail.com>
References: <15BCB5AD-55A0-4C74-B9BB-67448122EFF6@gmail.com>
To: "radext@ietf.org" <radext@ietf.org>
X-Mailer: Apple Mail (2.1510)
Cc: "radext-chairs@tools.ietf.org" <radext-chairs@tools.ietf.org>, draft-ietf-radext-dynamic-discovery@tools.ietf.org
Subject: Re: [radext] WGLC for draft-ietf-radext-dynamic-discovery-09
X-BeenThere: radext@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: RADIUS EXTensions working group discussion list <radext.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/radext>, <mailto:radext-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/radext/>
List-Post: <mailto:radext@ietf.org>
List-Help: <mailto:radext-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/radext>, <mailto:radext-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 14 Jan 2014 08:47:01 -0000

The WGLC ended recently for this document. Zero reviews or comments.
If folks think the document is ready, at least express that on the
list. I'll extend the WGLC by few weeks shortly.

In a meanwhile I have requested reviews from various externals
interest groups (secdir, DNS ppl etc).

- Jouni & Mauricio

On Dec 30, 2013, at 7:00 AM, Jouni Korhonen <jouni.nospam@gmail.com> wrote:

> Folks,
> 
> This email starts a two week WGLC for the
> draft-ietf-radext-dynamic-discovery-09.
> The WGLC ends 13th Jan 2014.
> 
> Please, review the document, submit your
> comments to the mailing list and also enter
> them into Issue Tracker.
> 
> - Jouni & Mauricio
> 
> 


From stefan.winter@restena.lu  Tue Jan 14 05:28:25 2014
Return-Path: <stefan.winter@restena.lu>
X-Original-To: radext@ietfa.amsl.com
Delivered-To: radext@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5747C1AE0D4 for <radext@ietfa.amsl.com>; Tue, 14 Jan 2014 05:28:25 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.437
X-Spam-Level: 
X-Spam-Status: No, score=-2.437 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-0.538, WEIRD_PORT=0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vwqBbQs_bExc for <radext@ietfa.amsl.com>; Tue, 14 Jan 2014 05:28:22 -0800 (PST)
Received: from smtprelay.restena.lu (smtprelay.restena.lu [IPv6:2001:a18:1::62]) by ietfa.amsl.com (Postfix) with ESMTP id 150CB1AE0C3 for <radext@ietf.org>; Tue, 14 Jan 2014 05:28:21 -0800 (PST)
Received: from smtprelay.restena.lu (localhost [127.0.0.1]) by smtprelay.restena.lu (Postfix) with ESMTP id D79D410583 for <radext@ietf.org>; Tue, 14 Jan 2014 14:28:09 +0100 (CET)
Received: from [IPv6:2001:a18:1:8:921b:eff:fe1b:d2e7] (unknown [IPv6:2001:a18:1:8:921b:eff:fe1b:d2e7]) by smtprelay.restena.lu (Postfix) with ESMTPS id C5F421057F for <radext@ietf.org>; Tue, 14 Jan 2014 14:28:09 +0100 (CET)
Message-ID: <52D53B65.7020503@restena.lu>
Date: Tue, 14 Jan 2014 14:28:05 +0100
From: Stefan Winter <stefan.winter@restena.lu>
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Thunderbird/24.2.0
MIME-Version: 1.0
To: radext@ietf.org
References: <15BCB5AD-55A0-4C74-B9BB-67448122EFF6@gmail.com> <23ABE552-71C9-4231-82B0-0D1861C922CB@gmail.com>
In-Reply-To: <23ABE552-71C9-4231-82B0-0D1861C922CB@gmail.com>
X-Enigmail-Version: 1.6
OpenPGP: id=8A39DC66; url=http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66
Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="cP3k4r0x2MeONdJ4b1CKG5StCkCwTgDbE"
X-Virus-Scanned: ClamAV
Subject: Re: [radext] WGLC for draft-ietf-radext-dynamic-discovery-09
X-BeenThere: radext@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: RADIUS EXTensions working group discussion list <radext.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/radext>, <mailto:radext-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/radext/>
List-Post: <mailto:radext@ietf.org>
List-Help: <mailto:radext-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/radext>, <mailto:radext-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 14 Jan 2014 13:28:25 -0000

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--cP3k4r0x2MeONdJ4b1CKG5StCkCwTgDbE
Content-Type: multipart/mixed;
 boundary="------------070800020009000307090002"

This is a multi-part message in MIME format.
--------------070800020009000307090002
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

Hi,

> The WGLC ended recently for this document. Zero reviews or comments.
> If folks think the document is ready, at least express that on the
> list. I'll extend the WGLC by few weeks shortly.

FWIW, I like the document and think it should be allowed to move ahead :-=
)

Jim posted two comments to the document within hours of your WGLC
announcement (30 and 31 dec 2013). I'll work on those in the coming days.=


> In a meanwhile I have requested reviews from various externals
> interest groups (secdir, DNS ppl etc).

Ah, thanks. I'm sure I'll get more beating from those guys then :-)

Stefan

>=20
> - Jouni & Mauricio
>=20
> On Dec 30, 2013, at 7:00 AM, Jouni Korhonen <jouni.nospam@gmail.com> wr=
ote:
>=20
>> Folks,
>>
>> This email starts a two week WGLC for the
>> draft-ietf-radext-dynamic-discovery-09.
>> The WGLC ends 13th Jan 2014.
>>
>> Please, review the document, submit your
>> comments to the mailing list and also enter
>> them into Issue Tracker.
>>
>> - Jouni & Mauricio
>>
>>
>=20
> _______________________________________________
> radext mailing list
> radext@ietf.org
> https://www.ietf.org/mailman/listinfo/radext
>=20


--=20
Stefan WINTER
Ingenieur de Recherche
Fondation RESTENA - R=E9seau T=E9l=E9informatique de l'Education National=
e et
de la Recherche
6, rue Richard Coudenhove-Kalergi
L-1359 Luxembourg

Tel: +352 424409 1
Fax: +352 422473

PGP key updated to 4096 Bit RSA - I will encrypt all mails if the
recipient's key is known to me

http://pgp.mit.edu:11371/pks/lookup?op=3Dget&search=3D0xC0DE6A358A39DC66

--------------070800020009000307090002
Content-Type: application/pgp-keys;
 name="0x8A39DC66.asc"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: attachment;
 filename="0x8A39DC66.asc"

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v2.0.22 (GNU/Linux)

mQINBFIplEwBEADTSz+DS8nio+RSvfSLLfaOnCGi1nqpn8Pb1laVUyEvnAAzZ5je
miS88GxfiDH6hUGlWzcaW0hCfUHGiohr485adbjxRksPngWgAt/1bRxpifsW3zOb
Fjgog01WWQV5Sihlwc4zr8zvYbFA5BJZ6YdkR9C5J015riv5OS30WTjA65SSXgYr
b7zJWPwmegTFwE093uBFvC39waz3xYpVu5j87nO6w2MVQt/8sY2/2BFPEq+xfOaj
l18UEwc7w8SCgnZdlVNcmEK4UBvJuwS/1lsR2JeQa8Gu1EDxC7PRgMgNXsDSWnnB
e9aVmfG54+6ILe1QH2dwk9sPBQT5w2+vjijrb3Dv9ur+1kN+TNU2XE436jVpnnY/
3OsLdix30STQn4Q/XOm7YoVMeDwwviefilRxzK0dXA+wKj92T68Od82CFxuZqPAg
BCVmWfQM91iK9piqFK+QP+R3vF6+NGDBdwbe68iVKs0v5L8XmbxBQndjpmo+lo2a
smBR2TAIfZHaKdgtBw13u3GPVVKlg/Mpko8ki9JOSem2aFyi3kQEVKptWgXT3POl
97DWJzsR5VyKz6GOx9kJAEISRyLZwm0wqh8+9LCza5oeIKW381lzq1b9x30vOh8C
BSQQJ+cG9ko0yPHAj7Suw2TmPXx1qMctmE6Ahq82ZW30SljdZby8WQuR2wARAQAB
tDxTdGVmYW4gV2ludGVyIChSRVNURU5BIGtleSAyMDEzKykgPHN0ZWZhbi53aW50
ZXJAcmVzdGVuYS5sdT6JAjkEEwECACMFAlIplEwCGwMHCwkIBwMCAQYVCAIJCgsE
FgIDAQIeAQIXgAAKCRDA3mo1ijncZj7/D/99hVS+mJr8dSPCaDaUFFxBiT2eI1Lo
R8VKEerTCRw5BsdL6pN2eRJZ9NmsqWo1ynWVHEzO91bNZ+oZGgyoNohcBAI7p+r0
qUTzkyqwdZO4kMm0pqKoM9xkP3tf2mjGujKjOz4Y7S7wnz2ZFokeUsecoRVJF/++
/qHnmeWLn44J1HUKLHYCjMu+QXGOgGXgz024jQ5eUrnPwzNp0Z90AFVHlWC+bymt
y/ToIUUCQqS5Ff0jzdWLd8U695OG9iGvjBQT1LdEjsfbAwuKV5UcnpxNqUpUwKa5
9hdX5/2cMZP07FI1UXwnBlxa8rJfdb13FLjSKX4vUUHedYUZMjMPgcwl1a+zGE22
lHiSQWgP8QLA/W3BLsi22ERCEPZBfexOeOtaWIItDIz18fIaQoMDoRPshzar0JI2
CzLYsyeKySAtYJEHFVoLmMvhkwzBmgqA/BEswUA67CfCr1jFHRXdpmWM7YkyAmMa
9q6LwquWKS5+MXlUXe/3oZUcgpw/T9Uuy3Jo3RdS7B3jFcWaVr6KsO/A9u1gr/aY
n5M+iJTQSj4vzqtkQaJTpSspRZoKa66HZt3IwSYiDiYZqtM83ynuj9kjnZzGfnuT
aNIi996q6Mptr33mOzIE1wmMqnJYwTr3EcNtf483q/qrJwh5ES8Q9xY7aat/ZcSl
8fKubW4TlfVr8YhGBBARAgAGBQJSKZUGAAoJEPo5vdH/HhVmYTgAn24eoqO/O98o
vNpt08Uab/+/tmYKAJ9kjXm9Njz5h33efzeelZUa484rr7kCDQRSKZRMARAAvBPp
n7FQq7LQ5glohtbL6XIEo1U4X67S0TzUYieENSWSVYuWYIhCBldmWdmH8Bpj/qHe
qdon7v+SLtR4WngzMR9toupKcFfHnbP9kpazTSB2ySHxXWGX1gJOpPXdCcg9iveK
BHEsDn00ThTcPsvtXpnnzET16pXIvOXO0bxTmVZ4INIF1SWgvYma/g8kBbgXLpkj
8tOywBqFiiYPEZlDeCxDHiMgUDh6olda9K/0TZFTdMPUgjKuubfAeaDNCOrVt4Rj
mFOaRLikcZocmgJhm3z/j25x7/mnNu+0di1H/S67YGQJ+pqCFInzIXDx7aRW2+JC
iqsY2X3xOPWZZzjyis5SNnfOcPH3gt2hYz1fy+thsBGf4NgCN01JRqIJ2/MOQCgU
dwh+9l8xqaJvCkUHM4hVh4W62MAe1u7UEqQbvvNEqxM5034vcvlE+/LRkrDCspw+
2YJ9QyroLerVRwW5DVleP8Ifi8VB3yD80nqXYs9aqRy0BkDNIQ43ERhESMt8dJqr
NkxgC6pemZrhNwyDh+hy2kPNGQh/iBpdKuH1o3E24TIZoV2v3YHvzob7aAYHddE/
PofAXhJW7I9mAs+HdWDmnI8ckuPDFpFH+Y/BFGvEXgcnJAJ1wEvf+4LuiIi0MHjR
4EWFn9vvoFDAIqD10h3FSd3D59HGtdSsNn4XaCsAEQEAAYkCHwQYAQIACQUCUimU
TAIbDAAKCRDA3mo1ijncZhBtEACL036ddjc5pFoYIdoUY1vT8SMXJNquewCnL1qu
DADzqDZFU5GNlQEy10krSfBwlTb9ahTtE0JFrOdZwUZtoa1Pgfr8nU6KOgrXPHbN
jS/9dyc5CwGVVIpOavIm2CsMVDJ9LCF/NT+u/t1k6eGfHhPVl3dUQyDa/lzc1chK
UIVQYQkFmr0A/iXP+29lFCaI+IeyU0bSdZhezDwUROn5vEx+fiPZyHDShCb+BxJv
/o2LQp9JHenCiSbO+ioRZdxgbWfoKBuXOfmSStqMWXas/gZ5vS3xq72LNtKPRxgp
jX3P8Zml1XDqpcBau7eK75VKE0Yd06YxnUIsbcEzInUc3uzW/u0DFpXYkMJb0XIv
JyUt5yYPKfV13N8kSkPi5pLxm8yuftXMzfgeFMR7nafY3glTVj/TxElzg6xeZNqf
C2ZjIbBtZg9ylHU8u8wwB+dX282crs0R3N9A064C71/cXlBqcjzjlKH2NUIWGxr+
od3TXFIFjszSU3NgMPKrWNhFLLwS81MpbkOe73s6aDhS8RDyNucoxtKXriLR+4Xi
u4+pyj5ukYP1JqpB3ZobY/XZgCnJMye+7xeTpIDJ1LPORxM3NNAElyb26lxAK2P+
km+EpI0Zzz6rNSCfg5jYQ474+e/GBgaSG4MlaPoZ+XAfN46u1Xjjv1/AkkA4IA6m
5zP5og=3D=3D
=3D3NUt
-----END PGP PUBLIC KEY BLOCK-----

--------------070800020009000307090002--

--cP3k4r0x2MeONdJ4b1CKG5StCkCwTgDbE
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iQIcBAEBCgAGBQJS1TtmAAoJEMDeajWKOdxm+bQP/i+5frRj5nVCSR4qoprOERGa
kS4A1XlvDCu7olK8ITxIqRilllNsa7K6OPhR0mN1DZl3EvcRrVrn6giy6BYoHS7b
/D5kLY7/4VqFKW56ZCWigLcJRN7vs5suiNszDOlBItR9tq8/jkVCHmtc9GRe+LKk
iN4k4tKMr2MuvuOy35bR2lwHtt2sHftHQstqPFfX4UOxrnKXnTNtZTgkSvfOGREP
eNKz2FNUwVcjZk0+KisiDLGg/mQ44wRUnmsROILr1OK7OjGQykA/x16wTCxFsRH8
UIZ3KC2F4kdcajWpKr5qjyDGlBKbMo8zx8Zckg4tXreYkGcT8nZEfP9zulPVCXDL
xj+6r0VIaVUz1pTRmPGMNFIYA3PbZoBEiyNeJzksDBfcxhsGiD2ZwrbTfZII7yiS
UsBnkPUtLKw/fJl3SqWV/VzAfc5pIIsazpCyHsqc/Ps4ptGKhXI9ZbmKdh9yOfmn
SYfzk5wKMqZXfZBSToaoBiWmU3ytACtlqgc6P4v+6LffROzOGCib54hZBPbMSgvT
dbo09DA/zoRRFfU3aHBuilE7SsCQ994aKTM/QXpiKyF30YphEybpQjrnTkW469C+
/LS/EtC07wBdO/s63qvix1JXkX6lD3GSfwBNSDR5sCPsN+raol3qFPrrA5Yv8D0C
hqV54tqm+HEAMS2doKqM
=gxDn
-----END PGP SIGNATURE-----

--cP3k4r0x2MeONdJ4b1CKG5StCkCwTgDbE--

From lionel.morand@orange.com  Tue Jan 14 05:43:17 2014
Return-Path: <lionel.morand@orange.com>
X-Original-To: radext@ietfa.amsl.com
Delivered-To: radext@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A511D1AE067 for <radext@ietfa.amsl.com>; Tue, 14 Jan 2014 05:43:17 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -0.699
X-Spam-Level: 
X-Spam-Status: No, score=-0.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FROM=0.001, J_CHICKENPOX_34=0.6, J_CHICKENPOX_37=0.6, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7oKESYitt0Dk for <radext@ietfa.amsl.com>; Tue, 14 Jan 2014 05:43:16 -0800 (PST)
Received: from relais-inet.francetelecom.com (relais-ias244.francetelecom.com [80.12.204.244]) by ietfa.amsl.com (Postfix) with ESMTP id 7FBA51AE056 for <radext@ietf.org>; Tue, 14 Jan 2014 05:43:15 -0800 (PST)
Received: from omfeda05.si.francetelecom.fr (unknown [xx.xx.xx.198]) by omfeda14.si.francetelecom.fr (ESMTP service) with ESMTP id 550C22AC0D3; Tue, 14 Jan 2014 14:43:03 +0100 (CET)
Received: from Exchangemail-eme1.itn.ftgroup (unknown [10.114.1.183]) by omfeda05.si.francetelecom.fr (ESMTP service) with ESMTP id 38F96180051; Tue, 14 Jan 2014 14:43:03 +0100 (CET)
Received: from PEXCVZYM13.corporate.adroot.infra.ftgroup ([fe80::cc7e:e40b:42ef:164e]) by PEXCVZYH02.corporate.adroot.infra.ftgroup ([::1]) with mapi id 14.03.0174.001; Tue, 14 Jan 2014 14:43:02 +0100
From: <lionel.morand@orange.com>
To: Jouni Korhonen <jouni.nospam@gmail.com>, "radext@ietf.org" <radext@ietf.org>
Thread-Topic: [radext] WGLC for draft-ietf-radext-dynamic-discovery-09
Thread-Index: AQHPBRwWQ1ipdRVr6EqY0ZMy7ZuBfpqD71CAgAA2R6A=
Date: Tue, 14 Jan 2014 13:43:02 +0000
Message-ID: <11892_1389706983_52D53EE7_11892_12055_1_6B7134B31289DC4FAF731D844122B36E43D683@PEXCVZYM13.corporate.adroot.infra.ftgroup>
References: <15BCB5AD-55A0-4C74-B9BB-67448122EFF6@gmail.com> <23ABE552-71C9-4231-82B0-0D1861C922CB@gmail.com>
In-Reply-To: <23ABE552-71C9-4231-82B0-0D1861C922CB@gmail.com>
Accept-Language: fr-FR, en-US
Content-Language: fr-FR
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
x-originating-ip: [10.197.38.3]
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-PMX-Version: 6.0.3.2322014, Antispam-Engine: 2.7.2.2107409, Antispam-Data: 2014.1.14.52715
Cc: "radext-chairs@tools.ietf.org" <radext-chairs@tools.ietf.org>, "draft-ietf-radext-dynamic-discovery@tools.ietf.org" <draft-ietf-radext-dynamic-discovery@tools.ietf.org>
Subject: Re: [radext] WGLC for draft-ietf-radext-dynamic-discovery-09
X-BeenThere: radext@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: RADIUS EXTensions working group discussion list <radext.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/radext>, <mailto:radext-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/radext/>
List-Post: <mailto:radext@ietf.org>
List-Help: <mailto:radext-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/radext>, <mailto:radext-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 14 Jan 2014 13:43:17 -0000

Hi Stefan, Jouni,


I'm ok with the general content of this draft.
But, just after a brief review of the last version, I have the following co=
mments/questions.

In Section 2.1.1.1. Registration of Application Service and Protocol Tags


   This specification defines three S-NAPTR service tags:


   +-----------------+-----------------------------------------+
   | Service Tag     | Use                                     |
   +-----------------+-----------------------------------------+
   | aaa+auth        | RADIUS Authentication, i.e. traffic as  |
   |                 | defined in [RFC2865]                    |
   | - - - - - - - - | - - - - - - - - - - - - - - - - - - - - |
   | aaa+acct        | RADIUS Accounting, i.e. traffic as      |
   |                 | defined in [RFC2866]                    |
   | - - - - - - - - | - - - - - - - - - - - - - - - - - - - - |
   | aaa+dynauth     | RADIUS Dynamic Authorisation, i.e.      |
   |                 | traffic as defined in [RFC5176]         |
   +--------------- --+-----------------------------------------+

                      Figure 1: List of Service Tags

[LM] For historical reasons, "aaa" is already assigned to Diameter. The pro=
posed values for RADIUS related Application Service Tags are not wrong per =
se but it could be misleading... What about using "RADIUS+" instead of "aaa=
+" to avoid such possible confusion?=20

[LM] I don't know if it is something commonly in use but I was wondering if=
 it would be also suitable to define a service tag for Auth+Acc when both t=
ypes of traffic are sent to the same server.=20


In Section 3.1. Applicability


   Dynamic server discovery as defined in this document is only
   applicable for AAA transactions where a RADIUS entity which acts as a
   forwarding server for one or more realms receives a request with a
   realm for which it is not authoritative, and which no explicit next
   hop is configured.  It is only applicable for

   a.  new user sessions, i.e. for the initial Access-Request.
       Subsequent messages concerning this session, for example Access-
       Challenges and Access-Accepts use the previously-established
       communication channel between client and server.

   b.  RADIUS DynAuth server discovery

[LM] I think that the case for initial Accounting-Request is missing. Sorry=
 if this point was discussed earlier on the mailing list.

Regards,

Lionel

-----Message d'origine-----
De=A0: radext [mailto:radext-bounces@ietf.org] De la part de Jouni Korhonen
Envoy=E9=A0: mardi 14 janvier 2014 09:47
=C0=A0: radext@ietf.org
Cc=A0: radext-chairs@tools.ietf.org; draft-ietf-radext-dynamic-discovery@to=
ols.ietf.org
Objet=A0: Re: [radext] WGLC for draft-ietf-radext-dynamic-discovery-09


The WGLC ended recently for this document. Zero reviews or comments.
If folks think the document is ready, at least express that on the
list. I'll extend the WGLC by few weeks shortly.

In a meanwhile I have requested reviews from various externals
interest groups (secdir, DNS ppl etc).

- Jouni & Mauricio

On Dec 30, 2013, at 7:00 AM, Jouni Korhonen <jouni.nospam@gmail.com> wrote:

> Folks,
>=20
> This email starts a two week WGLC for the
> draft-ietf-radext-dynamic-discovery-09.
> The WGLC ends 13th Jan 2014.
>=20
> Please, review the document, submit your
> comments to the mailing list and also enter
> them into Issue Tracker.
>=20
> - Jouni & Mauricio
>=20
>=20

_______________________________________________
radext mailing list
radext@ietf.org
https://www.ietf.org/mailman/listinfo/radext

___________________________________________________________________________=
______________________________________________

Ce message et ses pieces jointes peuvent contenir des informations confiden=
tielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu=
 ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages el=
ectroniques etant susceptibles d'alteration,
Orange decline toute responsabilite si ce message a ete altere, deforme ou =
falsifie. Merci.

This message and its attachments may contain confidential or privileged inf=
ormation that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and dele=
te this message and its attachments.
As emails may be altered, Orange is not liable for messages that have been =
modified, changed or falsified.
Thank you.


From stefan.winter@restena.lu  Tue Jan 14 06:15:32 2014
Return-Path: <stefan.winter@restena.lu>
X-Original-To: radext@ietfa.amsl.com
Delivered-To: radext@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E84C51AE074 for <radext@ietfa.amsl.com>; Tue, 14 Jan 2014 06:15:32 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.237
X-Spam-Level: 
X-Spam-Status: No, score=-1.237 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, J_CHICKENPOX_34=0.6, J_CHICKENPOX_37=0.6, RP_MATCHES_RCVD=-0.538, WEIRD_PORT=0.001] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KzQnpKII5pmj for <radext@ietfa.amsl.com>; Tue, 14 Jan 2014 06:15:31 -0800 (PST)
Received: from smtprelay.restena.lu (smtprelay.restena.lu [IPv6:2001:a18:1::62]) by ietfa.amsl.com (Postfix) with ESMTP id 06B961AE077 for <radext@ietf.org>; Tue, 14 Jan 2014 06:15:31 -0800 (PST)
Received: from smtprelay.restena.lu (localhost [127.0.0.1]) by smtprelay.restena.lu (Postfix) with ESMTP id 5D8E310583; Tue, 14 Jan 2014 15:15:19 +0100 (CET)
Received: from [IPv6:2001:a18:1:8:921b:eff:fe1b:d2e7] (unknown [IPv6:2001:a18:1:8:921b:eff:fe1b:d2e7]) by smtprelay.restena.lu (Postfix) with ESMTPS id 48FB81057E; Tue, 14 Jan 2014 15:15:19 +0100 (CET)
Message-ID: <52D54673.9000600@restena.lu>
Date: Tue, 14 Jan 2014 15:15:15 +0100
From: Stefan Winter <stefan.winter@restena.lu>
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Thunderbird/24.2.0
MIME-Version: 1.0
To: lionel.morand@orange.com, Jouni Korhonen <jouni.nospam@gmail.com>,  "radext@ietf.org" <radext@ietf.org>
References: <15BCB5AD-55A0-4C74-B9BB-67448122EFF6@gmail.com> <23ABE552-71C9-4231-82B0-0D1861C922CB@gmail.com> <11892_1389706983_52D53EE7_11892_12055_1_6B7134B31289DC4FAF731D844122B36E43D683@PEXCVZYM13.corporate.adroot.infra.ftgroup>
In-Reply-To: <11892_1389706983_52D53EE7_11892_12055_1_6B7134B31289DC4FAF731D844122B36E43D683@PEXCVZYM13.corporate.adroot.infra.ftgroup>
X-Enigmail-Version: 1.6
OpenPGP: id=8A39DC66; url=http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66
Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="7Nd7ALn24ASoOJunQT4IT38mQeMLHLmHl"
X-Virus-Scanned: ClamAV
Cc: "radext-chairs@tools.ietf.org" <radext-chairs@tools.ietf.org>, "draft-ietf-radext-dynamic-discovery@tools.ietf.org" <draft-ietf-radext-dynamic-discovery@tools.ietf.org>
Subject: Re: [radext] WGLC for draft-ietf-radext-dynamic-discovery-09
X-BeenThere: radext@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: RADIUS EXTensions working group discussion list <radext.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/radext>, <mailto:radext-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/radext/>
List-Post: <mailto:radext@ietf.org>
List-Help: <mailto:radext-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/radext>, <mailto:radext-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 14 Jan 2014 14:15:33 -0000

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--7Nd7ALn24ASoOJunQT4IT38mQeMLHLmHl
Content-Type: multipart/mixed;
 boundary="------------090200000307080800040304"

This is a multi-part message in MIME format.
--------------090200000307080800040304
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

Hi,

> But, just after a brief review of the last version, I have the followin=
g comments/questions.
>=20
> In Section 2.1.1.1. Registration of Application Service and Protocol Ta=
gs
>=20
>=20
>    This specification defines three S-NAPTR service tags:
>=20
>=20
>    +-----------------+-----------------------------------------+
>    | Service Tag     | Use                                     |
>    +-----------------+-----------------------------------------+
>    | aaa+auth        | RADIUS Authentication, i.e. traffic as  |
>    |                 | defined in [RFC2865]                    |
>    | - - - - - - - - | - - - - - - - - - - - - - - - - - - - - |
>    | aaa+acct        | RADIUS Accounting, i.e. traffic as      |
>    |                 | defined in [RFC2866]                    |
>    | - - - - - - - - | - - - - - - - - - - - - - - - - - - - - |
>    | aaa+dynauth     | RADIUS Dynamic Authorisation, i.e.      |
>    |                 | traffic as defined in [RFC5176]         |
>    +--------------- --+-----------------------------------------+
>=20
>                       Figure 1: List of Service Tags
>=20
> [LM] For historical reasons, "aaa" is already assigned to Diameter. The=
 proposed values for RADIUS related Application Service Tags are not wron=
g per se but it could be misleading... What about using "RADIUS+" instead=
 of "aaa+" to avoid such possible confusion?=20

We developed the RADIUS spec in sync with the Diameter equivalent, and
this was the way forward everybody agreed to.

There are multiple things to consider in this:

* IANA assignments of a service tag are NOT sensitive to a "+"
separator; the entire thing is a string of bytes. It either literally
matches the service you are looking for or not. In that light, two
different strings which by chance have the first four characters in
common does not mean they have anything to do with each other.

* There is no possibility for a naming clash between Diameter's
aaa+ap<int> and RADIUS aaa+{auth,acct,dynauth}.

* The protocol tag which follows the service tag in the DNS NAPTR record
makes clear that we're talking RADIUS, not Diameter.

* I don't think "aaa" as a whole is owned by Diameter anyway... Even in
the Diameter spec, there is a protocol tag for Diameter following the
service tag. Both in combination make the NAPTR type "owned" by
Diameter. And the old RFC3588 definition uses the monolithic "aaa+D2x"
string (where x varies, and the D hard-codes Diameter).

> [LM] I don't know if it is something commonly in use but I was wonderin=
g if it would be also suitable to define a service tag for Auth+Acc when =
both types of traffic are sent to the same server.=20

It may or may not be that both types of traffic end up at the same
server. If they do, adding a second NAPTR for Accounting doesn't add
much overhead. I would be concerned about this if there were "hundreds"
of NAPTR records per domain to evaluate, and economising on their number
was important. I didn't ever encounter this in reality though.

Looking sideways, not even the Diameter S-NAPTR spec allows to
concatenate multiple application IDs into one service tag, so... if you
guys haven't found a use case for it in 3G big-scale, I don't think it's
necessary or urgent?

> [LM] I think that the case for initial Accounting-Request is missing. S=
orry if this point was discussed earlier on the mailing list.

It may well have been, I don't remember it though. :-)

You are right; where the NAS has a User-Name for its Accounting record,
it would need to discover a destination using the algorithm, so this
should be reflected in an added bullet. I'll do this for the next
revision update.

Greetings,

Stefan Winter

--=20
Stefan WINTER
Ingenieur de Recherche
Fondation RESTENA - R=E9seau T=E9l=E9informatique de l'Education National=
e et
de la Recherche
6, rue Richard Coudenhove-Kalergi
L-1359 Luxembourg

Tel: +352 424409 1
Fax: +352 422473

PGP key updated to 4096 Bit RSA - I will encrypt all mails if the
recipient's key is known to me

http://pgp.mit.edu:11371/pks/lookup?op=3Dget&search=3D0xC0DE6A358A39DC66

--------------090200000307080800040304
Content-Type: application/pgp-keys;
 name="0x8A39DC66.asc"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: attachment;
 filename="0x8A39DC66.asc"

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v2.0.22 (GNU/Linux)

mQINBFIplEwBEADTSz+DS8nio+RSvfSLLfaOnCGi1nqpn8Pb1laVUyEvnAAzZ5je
miS88GxfiDH6hUGlWzcaW0hCfUHGiohr485adbjxRksPngWgAt/1bRxpifsW3zOb
Fjgog01WWQV5Sihlwc4zr8zvYbFA5BJZ6YdkR9C5J015riv5OS30WTjA65SSXgYr
b7zJWPwmegTFwE093uBFvC39waz3xYpVu5j87nO6w2MVQt/8sY2/2BFPEq+xfOaj
l18UEwc7w8SCgnZdlVNcmEK4UBvJuwS/1lsR2JeQa8Gu1EDxC7PRgMgNXsDSWnnB
e9aVmfG54+6ILe1QH2dwk9sPBQT5w2+vjijrb3Dv9ur+1kN+TNU2XE436jVpnnY/
3OsLdix30STQn4Q/XOm7YoVMeDwwviefilRxzK0dXA+wKj92T68Od82CFxuZqPAg
BCVmWfQM91iK9piqFK+QP+R3vF6+NGDBdwbe68iVKs0v5L8XmbxBQndjpmo+lo2a
smBR2TAIfZHaKdgtBw13u3GPVVKlg/Mpko8ki9JOSem2aFyi3kQEVKptWgXT3POl
97DWJzsR5VyKz6GOx9kJAEISRyLZwm0wqh8+9LCza5oeIKW381lzq1b9x30vOh8C
BSQQJ+cG9ko0yPHAj7Suw2TmPXx1qMctmE6Ahq82ZW30SljdZby8WQuR2wARAQAB
tDxTdGVmYW4gV2ludGVyIChSRVNURU5BIGtleSAyMDEzKykgPHN0ZWZhbi53aW50
ZXJAcmVzdGVuYS5sdT6JAjkEEwECACMFAlIplEwCGwMHCwkIBwMCAQYVCAIJCgsE
FgIDAQIeAQIXgAAKCRDA3mo1ijncZj7/D/99hVS+mJr8dSPCaDaUFFxBiT2eI1Lo
R8VKEerTCRw5BsdL6pN2eRJZ9NmsqWo1ynWVHEzO91bNZ+oZGgyoNohcBAI7p+r0
qUTzkyqwdZO4kMm0pqKoM9xkP3tf2mjGujKjOz4Y7S7wnz2ZFokeUsecoRVJF/++
/qHnmeWLn44J1HUKLHYCjMu+QXGOgGXgz024jQ5eUrnPwzNp0Z90AFVHlWC+bymt
y/ToIUUCQqS5Ff0jzdWLd8U695OG9iGvjBQT1LdEjsfbAwuKV5UcnpxNqUpUwKa5
9hdX5/2cMZP07FI1UXwnBlxa8rJfdb13FLjSKX4vUUHedYUZMjMPgcwl1a+zGE22
lHiSQWgP8QLA/W3BLsi22ERCEPZBfexOeOtaWIItDIz18fIaQoMDoRPshzar0JI2
CzLYsyeKySAtYJEHFVoLmMvhkwzBmgqA/BEswUA67CfCr1jFHRXdpmWM7YkyAmMa
9q6LwquWKS5+MXlUXe/3oZUcgpw/T9Uuy3Jo3RdS7B3jFcWaVr6KsO/A9u1gr/aY
n5M+iJTQSj4vzqtkQaJTpSspRZoKa66HZt3IwSYiDiYZqtM83ynuj9kjnZzGfnuT
aNIi996q6Mptr33mOzIE1wmMqnJYwTr3EcNtf483q/qrJwh5ES8Q9xY7aat/ZcSl
8fKubW4TlfVr8YhGBBARAgAGBQJSKZUGAAoJEPo5vdH/HhVmYTgAn24eoqO/O98o
vNpt08Uab/+/tmYKAJ9kjXm9Njz5h33efzeelZUa484rr7kCDQRSKZRMARAAvBPp
n7FQq7LQ5glohtbL6XIEo1U4X67S0TzUYieENSWSVYuWYIhCBldmWdmH8Bpj/qHe
qdon7v+SLtR4WngzMR9toupKcFfHnbP9kpazTSB2ySHxXWGX1gJOpPXdCcg9iveK
BHEsDn00ThTcPsvtXpnnzET16pXIvOXO0bxTmVZ4INIF1SWgvYma/g8kBbgXLpkj
8tOywBqFiiYPEZlDeCxDHiMgUDh6olda9K/0TZFTdMPUgjKuubfAeaDNCOrVt4Rj
mFOaRLikcZocmgJhm3z/j25x7/mnNu+0di1H/S67YGQJ+pqCFInzIXDx7aRW2+JC
iqsY2X3xOPWZZzjyis5SNnfOcPH3gt2hYz1fy+thsBGf4NgCN01JRqIJ2/MOQCgU
dwh+9l8xqaJvCkUHM4hVh4W62MAe1u7UEqQbvvNEqxM5034vcvlE+/LRkrDCspw+
2YJ9QyroLerVRwW5DVleP8Ifi8VB3yD80nqXYs9aqRy0BkDNIQ43ERhESMt8dJqr
NkxgC6pemZrhNwyDh+hy2kPNGQh/iBpdKuH1o3E24TIZoV2v3YHvzob7aAYHddE/
PofAXhJW7I9mAs+HdWDmnI8ckuPDFpFH+Y/BFGvEXgcnJAJ1wEvf+4LuiIi0MHjR
4EWFn9vvoFDAIqD10h3FSd3D59HGtdSsNn4XaCsAEQEAAYkCHwQYAQIACQUCUimU
TAIbDAAKCRDA3mo1ijncZhBtEACL036ddjc5pFoYIdoUY1vT8SMXJNquewCnL1qu
DADzqDZFU5GNlQEy10krSfBwlTb9ahTtE0JFrOdZwUZtoa1Pgfr8nU6KOgrXPHbN
jS/9dyc5CwGVVIpOavIm2CsMVDJ9LCF/NT+u/t1k6eGfHhPVl3dUQyDa/lzc1chK
UIVQYQkFmr0A/iXP+29lFCaI+IeyU0bSdZhezDwUROn5vEx+fiPZyHDShCb+BxJv
/o2LQp9JHenCiSbO+ioRZdxgbWfoKBuXOfmSStqMWXas/gZ5vS3xq72LNtKPRxgp
jX3P8Zml1XDqpcBau7eK75VKE0Yd06YxnUIsbcEzInUc3uzW/u0DFpXYkMJb0XIv
JyUt5yYPKfV13N8kSkPi5pLxm8yuftXMzfgeFMR7nafY3glTVj/TxElzg6xeZNqf
C2ZjIbBtZg9ylHU8u8wwB+dX282crs0R3N9A064C71/cXlBqcjzjlKH2NUIWGxr+
od3TXFIFjszSU3NgMPKrWNhFLLwS81MpbkOe73s6aDhS8RDyNucoxtKXriLR+4Xi
u4+pyj5ukYP1JqpB3ZobY/XZgCnJMye+7xeTpIDJ1LPORxM3NNAElyb26lxAK2P+
km+EpI0Zzz6rNSCfg5jYQ474+e/GBgaSG4MlaPoZ+XAfN46u1Xjjv1/AkkA4IA6m
5zP5og=3D=3D
=3D3NUt
-----END PGP PUBLIC KEY BLOCK-----

--------------090200000307080800040304--

--7Nd7ALn24ASoOJunQT4IT38mQeMLHLmHl
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iQIcBAEBCgAGBQJS1UZzAAoJEMDeajWKOdxmyI0QAJhsalGoiEaV1+/P+Nq7Y4zq
8HZaNilPJjpOaPQ+Lc3YTz81C8ickvrRwdwysNyokJoPcEx3Ic2BQEQlraMsRdKX
Uuwtt2u2F5p0qIyx/TvtSkqcGUV02ka1QiTakBopgP7poA3NSDycmHcLR5k7e6M2
G+acgrVqcKsk0qlkBlOCmDHE3ZOX6P35Dwu0Tynj+JP4c/TSBs55xzDgjg4N/RQQ
1/7fvk/kBZSsqg7PdOBjfTUyevHUfvKSamxn2FkMch4XUip9WuGMkSr+fpkK6yad
1Wrg6PXDZidx7PrTJCQPbJqPwZv525TtLo+Et0qYSsLuAgnNNVURFDZbQOYBKPIn
j/6Ao6RebgORjdefOajOzMtygdIGxG6jJ5t6FOW8ck7MgIDtNL/0HvreQZvMPlbo
w6SLZH3SdBQQDh/ezhjpsAA3nm1lLArk80JW7hHlmo7pQ6PJ5gv8inWb+r/USPJ/
LZiIw8PmBhvyMA0yeFirYS3Org7zwEDEbYZiHIOcDNrD0g8xyCu33un/bK8tbT32
6d1kiK0XXKxIqZyfKEzyrAyqgxTIWB9owZIvG5RloyseAsOI32Yl9vSAFmkgtaI8
yw1f/XqKEgSXJix2jPSNB2g6KyyvNfR0G4VjZnPc/6fIs1WsCGszhIdCssLm1t+B
u6Ty93+/e+pbDVLq0Vv9
=oKxi
-----END PGP SIGNATURE-----

--7Nd7ALn24ASoOJunQT4IT38mQeMLHLmHl--

From lionel.morand@orange.com  Tue Jan 14 08:59:54 2014
Return-Path: <lionel.morand@orange.com>
X-Original-To: radext@ietfa.amsl.com
Delivered-To: radext@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A632D1AE14A for <radext@ietfa.amsl.com>; Tue, 14 Jan 2014 08:59:54 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -0.698
X-Spam-Level: 
X-Spam-Status: No, score=-0.698 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FROM=0.001, J_CHICKENPOX_34=0.6, J_CHICKENPOX_37=0.6, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001, WEIRD_PORT=0.001] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sVFKsJU3JII9 for <radext@ietfa.amsl.com>; Tue, 14 Jan 2014 08:59:52 -0800 (PST)
Received: from relais-inet.francetelecom.com (relais-ias92.francetelecom.com [193.251.215.92]) by ietfa.amsl.com (Postfix) with ESMTP id 660C11ADFAE for <radext@ietf.org>; Tue, 14 Jan 2014 08:59:52 -0800 (PST)
Received: from omfedm07.si.francetelecom.fr (unknown [xx.xx.xx.3]) by omfedm14.si.francetelecom.fr (ESMTP service) with ESMTP id 5954322C17F; Tue, 14 Jan 2014 17:59:40 +0100 (CET)
Received: from Exchangemail-eme1.itn.ftgroup (unknown [10.114.1.183]) by omfedm07.si.francetelecom.fr (ESMTP service) with ESMTP id 3AB2F4C056; Tue, 14 Jan 2014 17:59:40 +0100 (CET)
Received: from PEXCVZYM13.corporate.adroot.infra.ftgroup ([fe80::cc7e:e40b:42ef:164e]) by PEXCVZYH02.corporate.adroot.infra.ftgroup ([::1]) with mapi id 14.03.0174.001; Tue, 14 Jan 2014 17:59:38 +0100
From: <lionel.morand@orange.com>
To: Stefan Winter <stefan.winter@restena.lu>, Jouni Korhonen <jouni.nospam@gmail.com>, "radext@ietf.org" <radext@ietf.org>
Thread-Topic: [radext] WGLC for draft-ietf-radext-dynamic-discovery-09
Thread-Index: AQHPBRwWQ1ipdRVr6EqY0ZMy7ZuBfpqD71CAgAA2R6CAACWEgIAAEoDw
Date: Tue, 14 Jan 2014 16:59:38 +0000
Message-ID: <22239_1389718780_52D56CFC_22239_11701_1_6B7134B31289DC4FAF731D844122B36E43DBB2@PEXCVZYM13.corporate.adroot.infra.ftgroup>
References: <15BCB5AD-55A0-4C74-B9BB-67448122EFF6@gmail.com> <23ABE552-71C9-4231-82B0-0D1861C922CB@gmail.com> <11892_1389706983_52D53EE7_11892_12055_1_6B7134B31289DC4FAF731D844122B36E43D683@PEXCVZYM13.corporate.adroot.infra.ftgroup> <52D54673.9000600@restena.lu>
In-Reply-To: <52D54673.9000600@restena.lu>
Accept-Language: fr-FR, en-US
Content-Language: fr-FR
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
x-originating-ip: [10.197.38.3]
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-PMX-Version: 6.0.3.2322014, Antispam-Engine: 2.7.2.2107409, Antispam-Data: 2014.1.14.55715
Cc: "radext-chairs@tools.ietf.org" <radext-chairs@tools.ietf.org>, "draft-ietf-radext-dynamic-discovery@tools.ietf.org" <draft-ietf-radext-dynamic-discovery@tools.ietf.org>
Subject: Re: [radext] WGLC for draft-ietf-radext-dynamic-discovery-09
X-BeenThere: radext@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: RADIUS EXTensions working group discussion list <radext.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/radext>, <mailto:radext-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/radext/>
List-Post: <mailto:radext@ietf.org>
List-Help: <mailto:radext-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/radext>, <mailto:radext-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 14 Jan 2014 16:59:54 -0000

Hi Stefan,

Thank you for our quick feedback. Please see below.
To sum-up, I can agree with your answer. Not a strong issue. But... as you =
know me, please see below :)

Regards,

Lionel

-----Message d'origine-----
De=A0: Stefan Winter [mailto:stefan.winter@restena.lu]=20
Envoy=E9=A0: mardi 14 janvier 2014 15:15
=C0=A0: MORAND Lionel IMT/OLN; Jouni Korhonen; radext@ietf.org
Cc=A0: radext-chairs@tools.ietf.org; draft-ietf-radext-dynamic-discovery@to=
ols.ietf.org
Objet=A0: Re: [radext] WGLC for draft-ietf-radext-dynamic-discovery-09

Hi,

> But, just after a brief review of the last version, I have the following =
comments/questions.
>=20
> In Section 2.1.1.1. Registration of Application Service and Protocol=20
> Tags
>=20
>=20
>    This specification defines three S-NAPTR service tags:
>=20
>=20
>    +-----------------+-----------------------------------------+
>    | Service Tag     | Use                                     |
>    +-----------------+-----------------------------------------+
>    | aaa+auth        | RADIUS Authentication, i.e. traffic as  |
>    |                 | defined in [RFC2865]                    |
>    | - - - - - - - - | - - - - - - - - - - - - - - - - - - - - |
>    | aaa+acct        | RADIUS Accounting, i.e. traffic as      |
>    |                 | defined in [RFC2866]                    |
>    | - - - - - - - - | - - - - - - - - - - - - - - - - - - - - |
>    | aaa+dynauth     | RADIUS Dynamic Authorisation, i.e.      |
>    |                 | traffic as defined in [RFC5176]         |
>    +--------------- --+-----------------------------------------+
>=20
>                       Figure 1: List of Service Tags
>=20
> [LM] For historical reasons, "aaa" is already assigned to Diameter. The p=
roposed values for RADIUS related Application Service Tags are not wrong pe=
r se but it could be misleading... What about using "RADIUS+" instead of "a=
aa+" to avoid such possible confusion?=20

We developed the RADIUS spec in sync with the Diameter equivalent, and this=
 was the way forward everybody agreed to.

There are multiple things to consider in this:

* IANA assignments of a service tag are NOT sensitive to a "+"
separator; the entire thing is a string of bytes. It either literally match=
es the service you are looking for or not. In that light, two different str=
ings which by chance have the first four characters in common does not mean=
 they have anything to do with each other.

* There is no possibility for a naming clash between Diameter's
aaa+ap<int> and RADIUS aaa+{auth,acct,dynauth}.

* The protocol tag which follows the service tag in the DNS NAPTR record ma=
kes clear that we're talking RADIUS, not Diameter.

* I don't think "aaa" as a whole is owned by Diameter anyway... Even in the=
 Diameter spec, there is a protocol tag for Diameter following the service =
tag. Both in combination make the NAPTR type "owned" by Diameter. And the o=
ld RFC3588 definition uses the monolithic "aaa+D2x"
string (where x varies, and the D hard-codes Diameter).

[LM] =3D=3D> I was just referring to the following in RFC6408:=20

   IANA has reserved a value of "aaa" for Diameter in the "(S-NAPTR)
   Application Service Tag" registry created by [RFC3958].

It is not a problem of syntax (which is correct as I said) but more a quest=
ion of the ambiguity around the prefix "aaa" for the (human) reader.

> [LM] I don't know if it is something commonly in use but I was wondering =
if it would be also suitable to define a service tag for Auth+Acc when both=
 types of traffic are sent to the same server.=20

It may or may not be that both types of traffic end up at the same server. =
If they do, adding a second NAPTR for Accounting doesn't add much overhead.=
 I would be concerned about this if there were "hundreds"
of NAPTR records per domain to evaluate, and economising on their number wa=
s important. I didn't ever encounter this in reality though.

Looking sideways, not even the Diameter S-NAPTR spec allows to concatenate =
multiple application IDs into one service tag, so... if you guys haven't fo=
und a use case for it in 3G big-scale, I don't think it's necessary or urge=
nt?

[LM] =3D=3D> I think that the issue is slightly different for Diameter appl=
ications. In 3GPP, different applications usually point to different functi=
onal entities or multiple capabilities are grouped into the same applicatio=
n when used between the same entities. In the specific case of RADIUS, I wa=
s thinking that one could prefer to choose an Authentication server that su=
pports also accounting when both functions are required, especially when yo=
u have to open TLS/DTLS connections with the remote server. This server mig=
ht be prioritized among servers auth-only + servers acc-only.=20

> [LM] I think that the case for initial Accounting-Request is missing. Sor=
ry if this point was discussed earlier on the mailing list.

It may well have been, I don't remember it though. :-)

You are right; where the NAS has a User-Name for its Accounting record, it =
would need to discover a destination using the algorithm, so this should be=
 reflected in an added bullet. I'll do this for the next revision update.

[LM] Good.

Greetings,

Stefan Winter

--
Stefan WINTER
Ingenieur de Recherche
Fondation RESTENA - R=E9seau T=E9l=E9informatique de l'Education Nationale =
et de la Recherche 6, rue Richard Coudenhove-Kalergi
L-1359 Luxembourg

Tel: +352 424409 1
Fax: +352 422473

PGP key updated to 4096 Bit RSA - I will encrypt all mails if the recipient=
's key is known to me

http://pgp.mit.edu:11371/pks/lookup?op=3Dget&search=3D0xC0DE6A358A39DC66

___________________________________________________________________________=
______________________________________________

Ce message et ses pieces jointes peuvent contenir des informations confiden=
tielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu=
 ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages el=
ectroniques etant susceptibles d'alteration,
Orange decline toute responsabilite si ce message a ete altere, deforme ou =
falsifie. Merci.

This message and its attachments may contain confidential or privileged inf=
ormation that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and dele=
te this message and its attachments.
As emails may be altered, Orange is not liable for messages that have been =
modified, changed or falsified.
Thank you.


From stefan.winter@restena.lu  Wed Jan 15 00:51:57 2014
Return-Path: <stefan.winter@restena.lu>
X-Original-To: radext@ietfa.amsl.com
Delivered-To: radext@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A06821AE2E5 for <radext@ietfa.amsl.com>; Wed, 15 Jan 2014 00:51:57 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.837
X-Spam-Level: 
X-Spam-Status: No, score=-1.837 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, J_CHICKENPOX_34=0.6, RP_MATCHES_RCVD=-0.538, WEIRD_PORT=0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BVYIx3a8a2Ta for <radext@ietfa.amsl.com>; Wed, 15 Jan 2014 00:51:54 -0800 (PST)
Received: from smtprelay.restena.lu (smtprelay.restena.lu [IPv6:2001:a18:1::62]) by ietfa.amsl.com (Postfix) with ESMTP id 5770F1AE223 for <radext@ietf.org>; Wed, 15 Jan 2014 00:51:54 -0800 (PST)
Received: from smtprelay.restena.lu (localhost [127.0.0.1]) by smtprelay.restena.lu (Postfix) with ESMTP id F25D71058E; Wed, 15 Jan 2014 09:51:41 +0100 (CET)
Received: from [IPv6:2001:a18:1:8:921b:eff:fe1b:d2e7] (unknown [IPv6:2001:a18:1:8:921b:eff:fe1b:d2e7]) by smtprelay.restena.lu (Postfix) with ESMTPS id E5C461058A; Wed, 15 Jan 2014 09:51:41 +0100 (CET)
Message-ID: <52D64C19.90703@restena.lu>
Date: Wed, 15 Jan 2014 09:51:37 +0100
From: Stefan Winter <stefan.winter@restena.lu>
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Thunderbird/24.2.0
MIME-Version: 1.0
To: lionel.morand@orange.com, Jouni Korhonen <jouni.nospam@gmail.com>,  "radext@ietf.org" <radext@ietf.org>
References: <15BCB5AD-55A0-4C74-B9BB-67448122EFF6@gmail.com> <23ABE552-71C9-4231-82B0-0D1861C922CB@gmail.com> <11892_1389706983_52D53EE7_11892_12055_1_6B7134B31289DC4FAF731D844122B36E43D683@PEXCVZYM13.corporate.adroot.infra.ftgroup> <52D54673.9000600@restena.lu> <22239_1389718780_52D56CFC_22239_11701_1_6B7134B31289DC4FAF731D844122B36E43DBB2@PEXCVZYM13.corporate.adroot.infra.ftgroup>
In-Reply-To: <22239_1389718780_52D56CFC_22239_11701_1_6B7134B31289DC4FAF731D844122B36E43DBB2@PEXCVZYM13.corporate.adroot.infra.ftgroup>
X-Enigmail-Version: 1.6
OpenPGP: id=8A39DC66; url=http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66
Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="PdoPOCTBHUC3g2SJNbbImXl2GIw0gFVul"
X-Virus-Scanned: ClamAV
Cc: "radext-chairs@tools.ietf.org" <radext-chairs@tools.ietf.org>, "draft-ietf-radext-dynamic-discovery@tools.ietf.org" <draft-ietf-radext-dynamic-discovery@tools.ietf.org>
Subject: Re: [radext] WGLC for draft-ietf-radext-dynamic-discovery-09
X-BeenThere: radext@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: RADIUS EXTensions working group discussion list <radext.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/radext>, <mailto:radext-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/radext/>
List-Post: <mailto:radext@ietf.org>
List-Help: <mailto:radext-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/radext>, <mailto:radext-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 15 Jan 2014 08:51:57 -0000

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--PdoPOCTBHUC3g2SJNbbImXl2GIw0gFVul
Content-Type: multipart/mixed;
 boundary="------------000806010801080307030605"

This is a multi-part message in MIME format.
--------------000806010801080307030605
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

Hi,

> * I don't think "aaa" as a whole is owned by Diameter anyway... Even in=
 the Diameter spec, there is a protocol tag for Diameter following the se=
rvice tag. Both in combination make the NAPTR type "owned" by Diameter. A=
nd the old RFC3588 definition uses the monolithic "aaa+D2x"
> string (where x varies, and the D hard-codes Diameter).
>=20
> [LM] =3D=3D> I was just referring to the following in RFC6408:=20
>=20
>    IANA has reserved a value of "aaa" for Diameter in the "(S-NAPTR)
>    Application Service Tag" registry created by [RFC3958].
>=20
> It is not a problem of syntax (which is correct as I said) but more a q=
uestion of the ambiguity around the prefix "aaa" for the (human) reader.

Ah, now I see that in RFC6408. I didn't at first glance because the ABNF
exclusively defines aaa+ap<int>.

The raw "aaa" sneaks in later. I don't understand what it is trying to
achieve (it is associated with "legacy" Diameter nodes which do not
support RFC6408; but if they don't support RFC6408 then they are not
going to use that tag; it's just as new as the aaa+apx ones - the
original NAPTR tags in RFC3588 were only "AAA+D2S" and "AAA+D2T"). ??
RFC6733 finally does the "right" thing and mentions "aaa" as the service
tag, but that's still not going to help implementations which only do
RFC3588.

Anyway... that's not my business :-)

Still no syntax problem, as the string "aaa" is still only a prefix of
the strings used in the radext draft.

I agree that an innocent reader might get a bit startled by the
similarity. In most cases, the service tag will be immediately followed
by the desired protocol though, which spells out "radius" or "diameter"
in clear-text. That should make the matter clear to the human eye.

Only in the case where a Diameter node uses no protocol indication
(Section 5.2.e of RFC6408) then he sees a raw "aaa" indeed; but there's
still no ambiguity: the radext draft has a mandatory protocol
indication; a raw "aaa" can thus not have anything to do with RADIUS.

I notice now, however, that the protocol tags are not sufficiently
covered in the actual algorithm; the server needs to maintain state
which transport it got from DNS so that he can later connect either via
DTLS or TLS. I will make that clearer in the next rev.

> Looking sideways, not even the Diameter S-NAPTR spec allows to concaten=
ate multiple application IDs into one service tag, so... if you guys have=
n't found a use case for it in 3G big-scale, I don't think it's necessary=
 or urgent?
>=20
> [LM] =3D=3D> I think that the issue is slightly different for Diameter =
applications. In 3GPP, different applications usually point to different =
functional entities or multiple capabilities are grouped into the same ap=
plication when used between the same entities. In the specific case of RA=
DIUS, I was thinking that one could prefer to choose an Authentication se=
rver that supports also accounting when both functions are required, espe=
cially when you have to open TLS/DTLS connections with the remote server.=
 This server might be prioritized among servers auth-only + servers acc-o=
nly.=20

Prioritisation is done by NAPTR's and SRV's order/preference fields and
is in the discretion of the server operator. If the server operator of
the "auth+acct" server wants clients to talk to that one with priority
for both auth and acct, he will list this server with the same, highest
preference in DNS for both service tags.

It's not the client's decision to resort to a lower-priority server just
because it feels like it.

And as an extra thought: if multiple servers share the same priority,
and only one of them could also do accounting, then the RADIUS client
could still find out about it by evaluating the list of NAPTRs for
aaa+auth and aaa+acct simultaneously, and seeing that they have the same
replacement field content. He can then make an informed choice.

FWIW, I would be against adding this extra choice into the I-D text. It
is a very small corner case, and the algorithm is about finding an
output for a given input. It's not about being clever to find a common
output for two distinct inputs, which might by chance be identical (but
this could only be found out later). Extending the scope to cover that
would make things a bit blurry.

Greetings,

Stefan Winter

--=20
Stefan WINTER
Ingenieur de Recherche
Fondation RESTENA - R=E9seau T=E9l=E9informatique de l'Education National=
e et
de la Recherche
6, rue Richard Coudenhove-Kalergi
L-1359 Luxembourg

Tel: +352 424409 1
Fax: +352 422473

PGP key updated to 4096 Bit RSA - I will encrypt all mails if the
recipient's key is known to me

http://pgp.mit.edu:11371/pks/lookup?op=3Dget&search=3D0xC0DE6A358A39DC66

--------------000806010801080307030605
Content-Type: application/pgp-keys;
 name="0x8A39DC66.asc"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: attachment;
 filename="0x8A39DC66.asc"

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v2.0.22 (GNU/Linux)

mQINBFIplEwBEADTSz+DS8nio+RSvfSLLfaOnCGi1nqpn8Pb1laVUyEvnAAzZ5je
miS88GxfiDH6hUGlWzcaW0hCfUHGiohr485adbjxRksPngWgAt/1bRxpifsW3zOb
Fjgog01WWQV5Sihlwc4zr8zvYbFA5BJZ6YdkR9C5J015riv5OS30WTjA65SSXgYr
b7zJWPwmegTFwE093uBFvC39waz3xYpVu5j87nO6w2MVQt/8sY2/2BFPEq+xfOaj
l18UEwc7w8SCgnZdlVNcmEK4UBvJuwS/1lsR2JeQa8Gu1EDxC7PRgMgNXsDSWnnB
e9aVmfG54+6ILe1QH2dwk9sPBQT5w2+vjijrb3Dv9ur+1kN+TNU2XE436jVpnnY/
3OsLdix30STQn4Q/XOm7YoVMeDwwviefilRxzK0dXA+wKj92T68Od82CFxuZqPAg
BCVmWfQM91iK9piqFK+QP+R3vF6+NGDBdwbe68iVKs0v5L8XmbxBQndjpmo+lo2a
smBR2TAIfZHaKdgtBw13u3GPVVKlg/Mpko8ki9JOSem2aFyi3kQEVKptWgXT3POl
97DWJzsR5VyKz6GOx9kJAEISRyLZwm0wqh8+9LCza5oeIKW381lzq1b9x30vOh8C
BSQQJ+cG9ko0yPHAj7Suw2TmPXx1qMctmE6Ahq82ZW30SljdZby8WQuR2wARAQAB
tDxTdGVmYW4gV2ludGVyIChSRVNURU5BIGtleSAyMDEzKykgPHN0ZWZhbi53aW50
ZXJAcmVzdGVuYS5sdT6JAjkEEwECACMFAlIplEwCGwMHCwkIBwMCAQYVCAIJCgsE
FgIDAQIeAQIXgAAKCRDA3mo1ijncZj7/D/99hVS+mJr8dSPCaDaUFFxBiT2eI1Lo
R8VKEerTCRw5BsdL6pN2eRJZ9NmsqWo1ynWVHEzO91bNZ+oZGgyoNohcBAI7p+r0
qUTzkyqwdZO4kMm0pqKoM9xkP3tf2mjGujKjOz4Y7S7wnz2ZFokeUsecoRVJF/++
/qHnmeWLn44J1HUKLHYCjMu+QXGOgGXgz024jQ5eUrnPwzNp0Z90AFVHlWC+bymt
y/ToIUUCQqS5Ff0jzdWLd8U695OG9iGvjBQT1LdEjsfbAwuKV5UcnpxNqUpUwKa5
9hdX5/2cMZP07FI1UXwnBlxa8rJfdb13FLjSKX4vUUHedYUZMjMPgcwl1a+zGE22
lHiSQWgP8QLA/W3BLsi22ERCEPZBfexOeOtaWIItDIz18fIaQoMDoRPshzar0JI2
CzLYsyeKySAtYJEHFVoLmMvhkwzBmgqA/BEswUA67CfCr1jFHRXdpmWM7YkyAmMa
9q6LwquWKS5+MXlUXe/3oZUcgpw/T9Uuy3Jo3RdS7B3jFcWaVr6KsO/A9u1gr/aY
n5M+iJTQSj4vzqtkQaJTpSspRZoKa66HZt3IwSYiDiYZqtM83ynuj9kjnZzGfnuT
aNIi996q6Mptr33mOzIE1wmMqnJYwTr3EcNtf483q/qrJwh5ES8Q9xY7aat/ZcSl
8fKubW4TlfVr8YhGBBARAgAGBQJSKZUGAAoJEPo5vdH/HhVmYTgAn24eoqO/O98o
vNpt08Uab/+/tmYKAJ9kjXm9Njz5h33efzeelZUa484rr7kCDQRSKZRMARAAvBPp
n7FQq7LQ5glohtbL6XIEo1U4X67S0TzUYieENSWSVYuWYIhCBldmWdmH8Bpj/qHe
qdon7v+SLtR4WngzMR9toupKcFfHnbP9kpazTSB2ySHxXWGX1gJOpPXdCcg9iveK
BHEsDn00ThTcPsvtXpnnzET16pXIvOXO0bxTmVZ4INIF1SWgvYma/g8kBbgXLpkj
8tOywBqFiiYPEZlDeCxDHiMgUDh6olda9K/0TZFTdMPUgjKuubfAeaDNCOrVt4Rj
mFOaRLikcZocmgJhm3z/j25x7/mnNu+0di1H/S67YGQJ+pqCFInzIXDx7aRW2+JC
iqsY2X3xOPWZZzjyis5SNnfOcPH3gt2hYz1fy+thsBGf4NgCN01JRqIJ2/MOQCgU
dwh+9l8xqaJvCkUHM4hVh4W62MAe1u7UEqQbvvNEqxM5034vcvlE+/LRkrDCspw+
2YJ9QyroLerVRwW5DVleP8Ifi8VB3yD80nqXYs9aqRy0BkDNIQ43ERhESMt8dJqr
NkxgC6pemZrhNwyDh+hy2kPNGQh/iBpdKuH1o3E24TIZoV2v3YHvzob7aAYHddE/
PofAXhJW7I9mAs+HdWDmnI8ckuPDFpFH+Y/BFGvEXgcnJAJ1wEvf+4LuiIi0MHjR
4EWFn9vvoFDAIqD10h3FSd3D59HGtdSsNn4XaCsAEQEAAYkCHwQYAQIACQUCUimU
TAIbDAAKCRDA3mo1ijncZhBtEACL036ddjc5pFoYIdoUY1vT8SMXJNquewCnL1qu
DADzqDZFU5GNlQEy10krSfBwlTb9ahTtE0JFrOdZwUZtoa1Pgfr8nU6KOgrXPHbN
jS/9dyc5CwGVVIpOavIm2CsMVDJ9LCF/NT+u/t1k6eGfHhPVl3dUQyDa/lzc1chK
UIVQYQkFmr0A/iXP+29lFCaI+IeyU0bSdZhezDwUROn5vEx+fiPZyHDShCb+BxJv
/o2LQp9JHenCiSbO+ioRZdxgbWfoKBuXOfmSStqMWXas/gZ5vS3xq72LNtKPRxgp
jX3P8Zml1XDqpcBau7eK75VKE0Yd06YxnUIsbcEzInUc3uzW/u0DFpXYkMJb0XIv
JyUt5yYPKfV13N8kSkPi5pLxm8yuftXMzfgeFMR7nafY3glTVj/TxElzg6xeZNqf
C2ZjIbBtZg9ylHU8u8wwB+dX282crs0R3N9A064C71/cXlBqcjzjlKH2NUIWGxr+
od3TXFIFjszSU3NgMPKrWNhFLLwS81MpbkOe73s6aDhS8RDyNucoxtKXriLR+4Xi
u4+pyj5ukYP1JqpB3ZobY/XZgCnJMye+7xeTpIDJ1LPORxM3NNAElyb26lxAK2P+
km+EpI0Zzz6rNSCfg5jYQ474+e/GBgaSG4MlaPoZ+XAfN46u1Xjjv1/AkkA4IA6m
5zP5og=3D=3D
=3D3NUt
-----END PGP PUBLIC KEY BLOCK-----

--------------000806010801080307030605--

--PdoPOCTBHUC3g2SJNbbImXl2GIw0gFVul
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iQIcBAEBCgAGBQJS1kwZAAoJEMDeajWKOdxmMysP/j9sdLKezEk+u8qdW1lWO2f6
JQUdqB93+Frhlpuyot8s5aFLAiPxIyX7r3jyZOd8AYw2pxGnvDtG9iERiHRJwmXt
3iVl1WJJuMTb5S600CLENeAak/qUbkVTzKdaTIVxj+b3OwefGX625OABDXK7tCyM
153Q8QMmR5hwvJFHqxd+hIrxkmPrx42tSWJ8OrER8RQZlaoEWBtDf00O1GE1z7Mw
o2kgbKjZ36HJRePfrGsloMI171vTv+3mAAaw1n2Z8Bb25Tfors0jgACevC3SPKbD
DmoTydepk8hC/ZSngrq05yTDM2PQAZ8pjx04Z7kak3xl8Hw0vCn7eiPE2TH3/UXH
XKRhya6CKCM3DfcgcW+X25VsqTcJDBDrg4LM7DsosrXW8dTdsLYGFQrYFfwtKL8v
37seXyxCaKGGIbF7eXaBDCH6V210wCSU2GcTO8Krhs7KljhibAT3kFNwNg/kF7TU
77CI9zeGCl249qLWhfxD5r2gx4ms6lTTwIMrbisS8E58EfVVZ8jQLCfIiG0Bukzo
TTMoUaoqAINx+wMZg7tq1daolJnVViaWLEi5zvGiIsjYgq+qxCJeq18z5UFkhiQs
mZcB0MLvYixCYghdpHDPSGN1bfBgsZkxI+46zPUladf52dim3bbcN1btZtM4ZvJf
ZipwUoTEzqe+mISsEzDZ
=E7ZV
-----END PGP SIGNATURE-----

--PdoPOCTBHUC3g2SJNbbImXl2GIw0gFVul--

From lionel.morand@orange.com  Wed Jan 15 01:24:08 2014
Return-Path: <lionel.morand@orange.com>
X-Original-To: radext@ietfa.amsl.com
Delivered-To: radext@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D38C71AE02E for <radext@ietfa.amsl.com>; Wed, 15 Jan 2014 01:24:08 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.298
X-Spam-Level: 
X-Spam-Status: No, score=-1.298 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FROM=0.001, J_CHICKENPOX_34=0.6, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001, WEIRD_PORT=0.001] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WLiUl_GFpijE for <radext@ietfa.amsl.com>; Wed, 15 Jan 2014 01:24:06 -0800 (PST)
Received: from relais-inet.francetelecom.com (relais-ias91.francetelecom.com [193.251.215.91]) by ietfa.amsl.com (Postfix) with ESMTP id 3FC4C1ACCE9 for <radext@ietf.org>; Wed, 15 Jan 2014 01:24:06 -0800 (PST)
Received: from omfedm05.si.francetelecom.fr (unknown [xx.xx.xx.1]) by omfedm10.si.francetelecom.fr (ESMTP service) with ESMTP id CE6CB2641C2; Wed, 15 Jan 2014 10:23:53 +0100 (CET)
Received: from Exchangemail-eme1.itn.ftgroup (unknown [10.114.1.186]) by omfedm05.si.francetelecom.fr (ESMTP service) with ESMTP id AF15435C04E; Wed, 15 Jan 2014 10:23:53 +0100 (CET)
Received: from PEXCVZYM13.corporate.adroot.infra.ftgroup ([fe80::cc7e:e40b:42ef:164e]) by PEXCVZYH01.corporate.adroot.infra.ftgroup ([::1]) with mapi id 14.03.0174.001; Wed, 15 Jan 2014 10:23:53 +0100
From: <lionel.morand@orange.com>
To: Jouni Korhonen <jouni.nospam@gmail.com>, "radext@ietf.org" <radext@ietf.org>, Stefan Winter <stefan.winter@restena.lu>
Thread-Topic: [radext] WGLC for draft-ietf-radext-dynamic-discovery-09
Thread-Index: Ac8R04G9Q1ipdRVr6EqY0ZMy7ZuBfg==
Date: Wed, 15 Jan 2014 09:23:52 +0000
Message-ID: <27565_1389777833_52D653A9_27565_978_1_vy5o93whbtx1scg6pf5nmqt2.1389777521513@email.android.com>
Accept-Language: fr-FR, en-US
Content-Language: fr-FR
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
Content-Type: text/plain; charset="utf-8"
Content-ID: <7A23397472BD404E90AB0CC1A6C06BCD@adroot.infra.ftgroup>
Content-Transfer-Encoding: base64
MIME-Version: 1.0
X-PMX-Version: 6.0.3.2322014, Antispam-Engine: 2.7.2.2107409, Antispam-Data: 2013.11.20.60015
Cc: "radext-chairs@tools.ietf.org" <radext-chairs@tools.ietf.org>, "draft-ietf-radext-dynamic-discovery@tools.ietf.org" <draft-ietf-radext-dynamic-discovery@tools.ietf.org>
Subject: Re: [radext] WGLC for draft-ietf-radext-dynamic-discovery-09
X-BeenThere: radext@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: RADIUS EXTensions working group discussion list <radext.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/radext>, <mailto:radext-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/radext/>
List-Post: <mailto:radext@ietf.org>
List-Help: <mailto:radext-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/radext>, <mailto:radext-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 15 Jan 2014 09:24:09 -0000

SSBjYW4gbGl2ZSB3aXRoIHRoZSBhbnN3ZXIgb24gImFhYSIgZXZlbiBpZiBJIHVzdWFsbHkgcHJl
ZmVyIHRvIGJlIHNlbGYtZXhwbGljaXQgcmF0aGVyIHRoYW4gcmVzb3J0aW5nIHRvIGRlZHVjdGl2
ZSBza2lsbHMuLi4gdGhhdCBzb21lb25lIG1heSBub3QgaGF2ZSA6LSkKCk9rIHdpdGggeW91ciBj
b25jbHVzaW9uIG9uIGF1dGgtYWNjIHNlcnZpY2UgdGFnLgoKVGhhbmsgeW91IGZvciB0aGUgZGlz
Y3Vzc2lvbi4KClJlZ2FyZHMsCgpMaW9uZWwgCgpFbnZvecOpIGRlcHVpcyBtb24gU29ueSBYcGVy
aWEgU1AgZCdPcmFuZ2UKClN0ZWZhbiBXaW50ZXIgPHN0ZWZhbi53aW50ZXJAcmVzdGVuYS5sdT4g
YSDDqWNyaXTCoDoKCj5IaSwKPgo+PiAqIEkgZG9uJ3QgdGhpbmsgImFhYSIgYXMgYSB3aG9sZSBp
cyBvd25lZCBieSBEaWFtZXRlciBhbnl3YXkuLi4gRXZlbiBpbiB0aGUgRGlhbWV0ZXIgc3BlYywg
dGhlcmUgaXMgYSBwcm90b2NvbCB0YWcgZm9yIERpYW1ldGVyIGZvbGxvd2luZyB0aGUgc2Vydmlj
ZSB0YWcuIEJvdGggaW4gY29tYmluYXRpb24gbWFrZSB0aGUgTkFQVFIgdHlwZSAib3duZWQiIGJ5
IERpYW1ldGVyLiBBbmQgdGhlIG9sZCBSRkMzNTg4IGRlZmluaXRpb24gdXNlcyB0aGUgbW9ub2xp
dGhpYyAiYWFhK0QyeCIKPj4gc3RyaW5nICh3aGVyZSB4IHZhcmllcywgYW5kIHRoZSBEIGhhcmQt
Y29kZXMgRGlhbWV0ZXIpLgo+PiAKPj4gW0xNXSA9PT4gSSB3YXMganVzdCByZWZlcnJpbmcgdG8g
dGhlIGZvbGxvd2luZyBpbiBSRkM2NDA4OiAKPj4gCj4+ICAgIElBTkEgaGFzIHJlc2VydmVkIGEg
dmFsdWUgb2YgImFhYSIgZm9yIERpYW1ldGVyIGluIHRoZSAiKFMtTkFQVFIpCj4+ICAgIEFwcGxp
Y2F0aW9uIFNlcnZpY2UgVGFnIiByZWdpc3RyeSBjcmVhdGVkIGJ5IFtSRkMzOTU4XS4KPj4gCj4+
IEl0IGlzIG5vdCBhIHByb2JsZW0gb2Ygc3ludGF4ICh3aGljaCBpcyBjb3JyZWN0IGFzIEkgc2Fp
ZCkgYnV0IG1vcmUgYSBxdWVzdGlvbiBvZiB0aGUgYW1iaWd1aXR5IGFyb3VuZCB0aGUgcHJlZml4
ICJhYWEiIGZvciB0aGUgKGh1bWFuKSByZWFkZXIuCj4KPkFoLCBub3cgSSBzZWUgdGhhdCBpbiBS
RkM2NDA4LiBJIGRpZG4ndCBhdCBmaXJzdCBnbGFuY2UgYmVjYXVzZSB0aGUgQUJORgo+ZXhjbHVz
aXZlbHkgZGVmaW5lcyBhYWErYXA8aW50Pi4KPgo+VGhlIHJhdyAiYWFhIiBzbmVha3MgaW4gbGF0
ZXIuIEkgZG9uJ3QgdW5kZXJzdGFuZCB3aGF0IGl0IGlzIHRyeWluZyB0bwo+YWNoaWV2ZSAoaXQg
aXMgYXNzb2NpYXRlZCB3aXRoICJsZWdhY3kiIERpYW1ldGVyIG5vZGVzIHdoaWNoIGRvIG5vdAo+
c3VwcG9ydCBSRkM2NDA4OyBidXQgaWYgdGhleSBkb24ndCBzdXBwb3J0IFJGQzY0MDggdGhlbiB0
aGV5IGFyZSBub3QKPmdvaW5nIHRvIHVzZSB0aGF0IHRhZzsgaXQncyBqdXN0IGFzIG5ldyBhcyB0
aGUgYWFhK2FweCBvbmVzIC0gdGhlCj5vcmlnaW5hbCBOQVBUUiB0YWdzIGluIFJGQzM1ODggd2Vy
ZSBvbmx5ICJBQUErRDJTIiBhbmQgIkFBQStEMlQiKS4gPz8KPlJGQzY3MzMgZmluYWxseSBkb2Vz
IHRoZSAicmlnaHQiIHRoaW5nIGFuZCBtZW50aW9ucyAiYWFhIiBhcyB0aGUgc2VydmljZQo+dGFn
LCBidXQgdGhhdCdzIHN0aWxsIG5vdCBnb2luZyB0byBoZWxwIGltcGxlbWVudGF0aW9ucyB3aGlj
aCBvbmx5IGRvCj5SRkMzNTg4Lgo+Cj5Bbnl3YXkuLi4gdGhhdCdzIG5vdCBteSBidXNpbmVzcyA6
LSkKPgo+U3RpbGwgbm8gc3ludGF4IHByb2JsZW0sIGFzIHRoZSBzdHJpbmcgImFhYSIgaXMgc3Rp
bGwgb25seSBhIHByZWZpeCBvZgo+dGhlIHN0cmluZ3MgdXNlZCBpbiB0aGUgcmFkZXh0IGRyYWZ0
Lgo+Cj5JIGFncmVlIHRoYXQgYW4gaW5ub2NlbnQgcmVhZGVyIG1pZ2h0IGdldCBhIGJpdCBzdGFy
dGxlZCBieSB0aGUKPnNpbWlsYXJpdHkuIEluIG1vc3QgY2FzZXMsIHRoZSBzZXJ2aWNlIHRhZyB3
aWxsIGJlIGltbWVkaWF0ZWx5IGZvbGxvd2VkCj5ieSB0aGUgZGVzaXJlZCBwcm90b2NvbCB0aG91
Z2gsIHdoaWNoIHNwZWxscyBvdXQgInJhZGl1cyIgb3IgImRpYW1ldGVyIgo+aW4gY2xlYXItdGV4
dC4gVGhhdCBzaG91bGQgbWFrZSB0aGUgbWF0dGVyIGNsZWFyIHRvIHRoZSBodW1hbiBleWUuCj4K
Pk9ubHkgaW4gdGhlIGNhc2Ugd2hlcmUgYSBEaWFtZXRlciBub2RlIHVzZXMgbm8gcHJvdG9jb2wg
aW5kaWNhdGlvbgo+KFNlY3Rpb24gNS4yLmUgb2YgUkZDNjQwOCkgdGhlbiBoZSBzZWVzIGEgcmF3
ICJhYWEiIGluZGVlZDsgYnV0IHRoZXJlJ3MKPnN0aWxsIG5vIGFtYmlndWl0eTogdGhlIHJhZGV4
dCBkcmFmdCBoYXMgYSBtYW5kYXRvcnkgcHJvdG9jb2wKPmluZGljYXRpb247IGEgcmF3ICJhYWEi
IGNhbiB0aHVzIG5vdCBoYXZlIGFueXRoaW5nIHRvIGRvIHdpdGggUkFESVVTLgo+Cj5JIG5vdGlj
ZSBub3csIGhvd2V2ZXIsIHRoYXQgdGhlIHByb3RvY29sIHRhZ3MgYXJlIG5vdCBzdWZmaWNpZW50
bHkKPmNvdmVyZWQgaW4gdGhlIGFjdHVhbCBhbGdvcml0aG07IHRoZSBzZXJ2ZXIgbmVlZHMgdG8g
bWFpbnRhaW4gc3RhdGUKPndoaWNoIHRyYW5zcG9ydCBpdCBnb3QgZnJvbSBETlMgc28gdGhhdCBo
ZSBjYW4gbGF0ZXIgY29ubmVjdCBlaXRoZXIgdmlhCj5EVExTIG9yIFRMUy4gSSB3aWxsIG1ha2Ug
dGhhdCBjbGVhcmVyIGluIHRoZSBuZXh0IHJldi4KPgo+PiBMb29raW5nIHNpZGV3YXlzLCBub3Qg
ZXZlbiB0aGUgRGlhbWV0ZXIgUy1OQVBUUiBzcGVjIGFsbG93cyB0byBjb25jYXRlbmF0ZSBtdWx0
aXBsZSBhcHBsaWNhdGlvbiBJRHMgaW50byBvbmUgc2VydmljZSB0YWcsIHNvLi4uIGlmIHlvdSBn
dXlzIGhhdmVuJ3QgZm91bmQgYSB1c2UgY2FzZSBmb3IgaXQgaW4gM0cgYmlnLXNjYWxlLCBJIGRv
bid0IHRoaW5rIGl0J3MgbmVjZXNzYXJ5IG9yIHVyZ2VudD8KPj4gCj4+IFtMTV0gPT0+IEkgdGhp
bmsgdGhhdCB0aGUgaXNzdWUgaXMgc2xpZ2h0bHkgZGlmZmVyZW50IGZvciBEaWFtZXRlciBhcHBs
aWNhdGlvbnMuIEluIDNHUFAsIGRpZmZlcmVudCBhcHBsaWNhdGlvbnMgdXN1YWxseSBwb2ludCB0
byBkaWZmZXJlbnQgZnVuY3Rpb25hbCBlbnRpdGllcyBvciBtdWx0aXBsZSBjYXBhYmlsaXRpZXMg
YXJlIGdyb3VwZWQgaW50byB0aGUgc2FtZSBhcHBsaWNhdGlvbiB3aGVuIHVzZWQgYmV0d2VlbiB0
aGUgc2FtZSBlbnRpdGllcy4gSW4gdGhlIHNwZWNpZmljIGNhc2Ugb2YgUkFESVVTLCBJIHdhcyB0
aGlua2luZyB0aGF0IG9uZSBjb3VsZCBwcmVmZXIgdG8gY2hvb3NlIGFuIEF1dGhlbnRpY2F0aW9u
IHNlcnZlciB0aGF0IHN1cHBvcnRzIGFsc28gYWNjb3VudGluZyB3aGVuIGJvdGggZnVuY3Rpb25z
IGFyZSByZXF1aXJlZCwgZXNwZWNpYWxseSB3aGVuIHlvdSBoYXZlIHRvIG9wZW4gVExTL0RUTFMg
Y29ubmVjdGlvbnMgd2l0aCB0aGUgcmVtb3RlIHNlcnZlci4gVGhpcyBzZXJ2ZXIgbWlnaHQgYmUg
cHJpb3JpdGl6ZWQgYW1vbmcgc2VydmVycyBhdXRoLW9ubHkgKyBzZXJ2ZXJzIGFjYy1vbmx5LiAK
Pgo+UHJpb3JpdGlzYXRpb24gaXMgZG9uZSBieSBOQVBUUidzIGFuZCBTUlYncyBvcmRlci9wcmVm
ZXJlbmNlIGZpZWxkcyBhbmQKPmlzIGluIHRoZSBkaXNjcmV0aW9uIG9mIHRoZSBzZXJ2ZXIgb3Bl
cmF0b3IuIElmIHRoZSBzZXJ2ZXIgb3BlcmF0b3Igb2YKPnRoZSAiYXV0aCthY2N0IiBzZXJ2ZXIg
d2FudHMgY2xpZW50cyB0byB0YWxrIHRvIHRoYXQgb25lIHdpdGggcHJpb3JpdHkKPmZvciBib3Ro
IGF1dGggYW5kIGFjY3QsIGhlIHdpbGwgbGlzdCB0aGlzIHNlcnZlciB3aXRoIHRoZSBzYW1lLCBo
aWdoZXN0Cj5wcmVmZXJlbmNlIGluIEROUyBmb3IgYm90aCBzZXJ2aWNlIHRhZ3MuCj4KPkl0J3Mg
bm90IHRoZSBjbGllbnQncyBkZWNpc2lvbiB0byByZXNvcnQgdG8gYSBsb3dlci1wcmlvcml0eSBz
ZXJ2ZXIganVzdAo+YmVjYXVzZSBpdCBmZWVscyBsaWtlIGl0Lgo+Cj5BbmQgYXMgYW4gZXh0cmEg
dGhvdWdodDogaWYgbXVsdGlwbGUgc2VydmVycyBzaGFyZSB0aGUgc2FtZSBwcmlvcml0eSwKPmFu
ZCBvbmx5IG9uZSBvZiB0aGVtIGNvdWxkIGFsc28gZG8gYWNjb3VudGluZywgdGhlbiB0aGUgUkFE
SVVTIGNsaWVudAo+Y291bGQgc3RpbGwgZmluZCBvdXQgYWJvdXQgaXQgYnkgZXZhbHVhdGluZyB0
aGUgbGlzdCBvZiBOQVBUUnMgZm9yCj5hYWErYXV0aCBhbmQgYWFhK2FjY3Qgc2ltdWx0YW5lb3Vz
bHksIGFuZCBzZWVpbmcgdGhhdCB0aGV5IGhhdmUgdGhlIHNhbWUKPnJlcGxhY2VtZW50IGZpZWxk
IGNvbnRlbnQuIEhlIGNhbiB0aGVuIG1ha2UgYW4gaW5mb3JtZWQgY2hvaWNlLgo+Cj5GV0lXLCBJ
IHdvdWxkIGJlIGFnYWluc3QgYWRkaW5nIHRoaXMgZXh0cmEgY2hvaWNlIGludG8gdGhlIEktRCB0
ZXh0LiBJdAo+aXMgYSB2ZXJ5IHNtYWxsIGNvcm5lciBjYXNlLCBhbmQgdGhlIGFsZ29yaXRobSBp
cyBhYm91dCBmaW5kaW5nIGFuCj5vdXRwdXQgZm9yIGEgZ2l2ZW4gaW5wdXQuIEl0J3Mgbm90IGFi
b3V0IGJlaW5nIGNsZXZlciB0byBmaW5kIGEgY29tbW9uCj5vdXRwdXQgZm9yIHR3byBkaXN0aW5j
dCBpbnB1dHMsIHdoaWNoIG1pZ2h0IGJ5IGNoYW5jZSBiZSBpZGVudGljYWwgKGJ1dAo+dGhpcyBj
b3VsZCBvbmx5IGJlIGZvdW5kIG91dCBsYXRlcikuIEV4dGVuZGluZyB0aGUgc2NvcGUgdG8gY292
ZXIgdGhhdAo+d291bGQgbWFrZSB0aGluZ3MgYSBiaXQgYmx1cnJ5Lgo+Cj5HcmVldGluZ3MsCj4K
PlN0ZWZhbiBXaW50ZXIKPgo+LS0gCj5TdGVmYW4gV0lOVEVSCj5JbmdlbmlldXIgZGUgUmVjaGVy
Y2hlCj5Gb25kYXRpb24gUkVTVEVOQSAtIFLDqXNlYXUgVMOpbMOpaW5mb3JtYXRpcXVlIGRlIGwn
RWR1Y2F0aW9uIE5hdGlvbmFsZSBldAo+ZGUgbGEgUmVjaGVyY2hlCj42LCBydWUgUmljaGFyZCBD
b3VkZW5ob3ZlLUthbGVyZ2kKPkwtMTM1OSBMdXhlbWJvdXJnCj4KPlRlbDogKzM1MiA0MjQ0MDkg
MQo+RmF4OiArMzUyIDQyMjQ3Mwo+Cj5QR1Aga2V5IHVwZGF0ZWQgdG8gNDA5NiBCaXQgUlNBIC0g
SSB3aWxsIGVuY3J5cHQgYWxsIG1haWxzIGlmIHRoZQo+cmVjaXBpZW50J3Mga2V5IGlzIGtub3du
IHRvIG1lCj4KPmh0dHA6Ly9wZ3AubWl0LmVkdToxMTM3MS9wa3MvbG9va3VwP29wPWdldCZzZWFy
Y2g9MHhDMERFNkEzNThBMzlEQzY2CgpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCgpDZSBtZXNzYWdlIGV0IHNlcyBwaWVjZXMg
am9pbnRlcyBwZXV2ZW50IGNvbnRlbmlyIGRlcyBpbmZvcm1hdGlvbnMgY29uZmlkZW50aWVsbGVz
IG91IHByaXZpbGVnaWVlcyBldCBuZSBkb2l2ZW50IGRvbmMKcGFzIGV0cmUgZGlmZnVzZXMsIGV4
cGxvaXRlcyBvdSBjb3BpZXMgc2FucyBhdXRvcmlzYXRpb24uIFNpIHZvdXMgYXZleiByZWN1IGNl
IG1lc3NhZ2UgcGFyIGVycmV1ciwgdmV1aWxsZXogbGUgc2lnbmFsZXIKYSBsJ2V4cGVkaXRldXIg
ZXQgbGUgZGV0cnVpcmUgYWluc2kgcXVlIGxlcyBwaWVjZXMgam9pbnRlcy4gTGVzIG1lc3NhZ2Vz
IGVsZWN0cm9uaXF1ZXMgZXRhbnQgc3VzY2VwdGlibGVzIGQnYWx0ZXJhdGlvbiwKT3JhbmdlIGRl
Y2xpbmUgdG91dGUgcmVzcG9uc2FiaWxpdGUgc2kgY2UgbWVzc2FnZSBhIGV0ZSBhbHRlcmUsIGRl
Zm9ybWUgb3UgZmFsc2lmaWUuIE1lcmNpLgoKVGhpcyBtZXNzYWdlIGFuZCBpdHMgYXR0YWNobWVu
dHMgbWF5IGNvbnRhaW4gY29uZmlkZW50aWFsIG9yIHByaXZpbGVnZWQgaW5mb3JtYXRpb24gdGhh
dCBtYXkgYmUgcHJvdGVjdGVkIGJ5IGxhdzsKdGhleSBzaG91bGQgbm90IGJlIGRpc3RyaWJ1dGVk
LCB1c2VkIG9yIGNvcGllZCB3aXRob3V0IGF1dGhvcmlzYXRpb24uCklmIHlvdSBoYXZlIHJlY2Vp
dmVkIHRoaXMgZW1haWwgaW4gZXJyb3IsIHBsZWFzZSBub3RpZnkgdGhlIHNlbmRlciBhbmQgZGVs
ZXRlIHRoaXMgbWVzc2FnZSBhbmQgaXRzIGF0dGFjaG1lbnRzLgpBcyBlbWFpbHMgbWF5IGJlIGFs
dGVyZWQsIE9yYW5nZSBpcyBub3QgbGlhYmxlIGZvciBtZXNzYWdlcyB0aGF0IGhhdmUgYmVlbiBt
b2RpZmllZCwgY2hhbmdlZCBvciBmYWxzaWZpZWQuClRoYW5rIHlvdS4KCg==

From bclaise@cisco.com  Fri Jan 17 02:30:42 2014
Return-Path: <bclaise@cisco.com>
X-Original-To: radext@ietfa.amsl.com
Delivered-To: radext@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DBBE61ADFCE for <radext@ietfa.amsl.com>; Fri, 17 Jan 2014 02:30:42 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -10.038
X-Spam-Level: 
X-Spam-Status: No, score=-10.038 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RP_MATCHES_RCVD=-0.538, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id c5q_LvWc4ghr for <radext@ietfa.amsl.com>; Fri, 17 Jan 2014 02:30:40 -0800 (PST)
Received: from aer-iport-2.cisco.com (aer-iport-2.cisco.com [173.38.203.52]) by ietfa.amsl.com (Postfix) with ESMTP id 4BDFB1ADFC6 for <radext@ietf.org>; Fri, 17 Jan 2014 02:30:40 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=7813; q=dns/txt; s=iport; t=1389954628; x=1391164228; h=message-id:date:from:mime-version:to:cc:subject; bh=o95c9nZx7W448CkKg5xkPncDLzUqWi89W174jEL47ZA=; b=Odh8shXqVjeWY5dbt2AuZJ87Ok6zR6e7CqD+B4sdYcltkmiv1QO2gP/c B+clLOLyV+vtfM5E9mLXmpBJ2Rx7UN0zuOS6dyEugmJVBcI6PMFIoRlv+ eUSkjf3RV3lw2suhRkNStGXwj5y5Cz7iOfyXGaXg4UZ1T2lJ32Xppl8yP k=;
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: AjMFAJFf2FKQ/khL/2dsb2JhbABZgws4iTGyNoEPFnSDJAE8FhgDAgECAUsNAQcBAYgADcU0EwSOf4Q/BIxfi0KGRnyKVYMuOw
X-IronPort-AV: E=Sophos;i="4.95,670,1384300800"; d="scan'208,217";a="3094493"
Received: from ams-core-2.cisco.com ([144.254.72.75]) by aer-iport-2.cisco.com with ESMTP; 17 Jan 2014 10:30:27 +0000
Received: from [10.60.67.85] (ams-bclaise-8914.cisco.com [10.60.67.85]) by ams-core-2.cisco.com (8.14.5/8.14.5) with ESMTP id s0HAUQrQ028312; Fri, 17 Jan 2014 10:30:26 GMT
Message-ID: <52D90642.4000000@cisco.com>
Date: Fri, 17 Jan 2014 11:30:26 +0100
From: Benoit Claise <bclaise@cisco.com>
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20100101 Thunderbird/24.2.0
MIME-Version: 1.0
To: "radext@ietf.org" <radext@ietf.org>
Content-Type: multipart/alternative; boundary="------------080008050106020301020404"
Cc: "<lionel.morand@orange.com>" <lionel.morand@orange.com>
Subject: [radext] AD review of draft-ietf-radext-ieee802ext-09
X-BeenThere: radext@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: RADIUS EXTensions working group discussion list <radext.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/radext>, <mailto:radext-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/radext/>
List-Post: <mailto:radext@ietf.org>
List-Help: <mailto:radext-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/radext>, <mailto:radext-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 17 Jan 2014 10:30:43 -0000

This is a multi-part message in MIME format.
--------------080008050106020301020404
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit

Dear all,

Glad that this document finally makes progress.

 From the writeup (https://datatracker.ietf.org/doc/draft-ietf-radext-ieee802ext/shepherdwriteup/), I see:

    (6) Describe any specific concerns or issues that the Document Shepherd
    has with this document that the Responsible Area Director and/or the
    IESG should be aware of? For example, perhaps he or she is uncomfortable
    with certain parts of the document, or has concerns whether there really
    is a need for it. In any event, if the WG has discussed those issues and
    has indicated that it still wishes to advance the document, detail those
    concerns here.

        The document (informatively) references to RFC4005 on its Diameter
        considerations. The RFC4005 will soon be obsoleted by RFC4005bis.
        The RFC4005bis also deprecates the RADIUS-Diameter automated
        translation, which is discussed in detail in Section 4 Diameter Considerations.

        The shepherd would recommend removing entire Section 4, since
        RADIUS-Diameter considerations are not really endorsed anymore.

        Furthermore, Section 4 uses Diameter AVP Flag rules as defined in RFC3588,
        which has already been obsoleted by RFC6733 and there the AVP Flag rules
        are less due to e.g. deprecation of Diameter in-band security.



I would actually prefer to keep the section 4, because the AVPs are 
allocated in the range 1-255.
However, RFC 4005bis must be mentioned as well.
This specific point is also discussed in draft-ietf-dime-app-design-guide-21

     Guidelines for implementing a RADIUS-Diameter translation agent
     were put into the Diameter NASREQ Application RFC 4005.
     However, it was acknowledged that such translation mechanism was not
     so obvious and deeper protocol analysis was required to ensure
     efficient interworking between RADIUS and Diameter.  Moreover, the
     interworking requirements depend on the functionalities provided by
     the Diameter application under specification, and a case-by-case
     analysis is required.
     As a consequence, all the material related to RADIUS-to-Diameter translation has been
     removed from the new version of the Diameter NASREQ application specification
     [RFC4005bis], which deprecates RFC4005

Feel free to synchronize with Lionel Morand, the 
draft-ietf-dime-app-design-guide-21 editor, who is currently working on 
a revised text

Regarding this point below, I agree with Jouni, can you please make the 
change to be in line with the RFC 6733 format (for example, RFC 6733 
doesn't have encryption)

    Furthermore, Section 4 uses Diameter AVP Flag rules as defined in RFC3588,
    which has already been obsoleted by RFC6733 and there the AVP Flag rules
    are less due to e.g. deprecation of Diameter in-band security.


EDITORIAL
The guidelines in RFC 3580 are still valid, right?

OLD:
    "IEEE 802.1X Remote Authentication Dial In User Service (RADIUS)
    Usage Guidelines" [RFC3580] provided guidelines for the use of the
    Remote Authentication Dialin User Service (RADIUS) within networks
    utilizing IEEE 802 local area networks.
NEW:
  "IEEE 802.1X Remote Authentication Dial In User Service (RADIUS)
    Usage Guidelines" [RFC3580]_provides_guidelines for the use of the
    Remote Authentication Dialin User Service (RADIUS) within networks
    utilizing IEEE 802 local area networks.

Regards, Benoit


--------------080008050106020301020404
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit

<html>
  <head>

    <meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">
  </head>
  <body bgcolor="#FFFFFF" text="#000000">
    <pre>Dear all,

Glad that this document finally makes progress.

>From the writeup (<a class="moz-txt-link-freetext" href="https://datatracker.ietf.org/doc/draft-ietf-radext-ieee802ext/shepherdwriteup/">https://datatracker.ietf.org/doc/draft-ietf-radext-ieee802ext/shepherdwriteup/</a>), I see:
</pre>
    <blockquote>
      <pre>(6) Describe any specific concerns or issues that the Document Shepherd
has with this document that the Responsible Area Director and/or the
IESG should be aware of? For example, perhaps he or she is uncomfortable
with certain parts of the document, or has concerns whether there really
is a need for it. In any event, if the WG has discussed those issues and
has indicated that it still wishes to advance the document, detail those
concerns here.

   The document (informatively) references to RFC4005 on its Diameter
   considerations. The RFC4005 will soon be obsoleted by RFC4005bis.
   The RFC4005bis also deprecates the RADIUS-Diameter automated
   translation, which is discussed in detail in Section 4 Diameter Considerations.

   The shepherd would recommend removing entire Section 4, since
   RADIUS-Diameter considerations are not really endorsed anymore.
</pre>
    </blockquote>
    <blockquote>
      <pre>  &nbsp;Furthermore, Section 4 uses Diameter AVP Flag rules as defined in RFC3588,
   which has already been obsoleted by RFC6733 and there the AVP Flag rules
   are less due to e.g. deprecation of Diameter in-band security.



</pre>
    </blockquote>
    I would actually prefer to keep the section 4, because the AVPs are
    allocated in the range 1-255.<br>
    However, RFC 4005bis must be mentioned as well.<br>
    This specific point is also discussed in
    draft-ietf-dime-app-design-guide-21<br>
    <pre wrap="">    Guidelines for implementing a RADIUS-Diameter translation agent 
    were put into the Diameter NASREQ Application RFC 4005.
    However, it was acknowledged that such translation mechanism was not
    so obvious and deeper protocol analysis was required to ensure
    efficient interworking between RADIUS and Diameter.  Moreover, the
    interworking requirements depend on the functionalities provided by
    the Diameter application under specification, and a case-by-case
    analysis is required.
    As a consequence, all the material related to RADIUS-to-Diameter translation has been   
    removed from the new version of the Diameter NASREQ application specification 
    [RFC4005bis], which deprecates RFC4005
</pre>
    Feel free to synchronize with Lionel Morand, the
    draft-ietf-dime-app-design-guide-21 editor, who is currently working
    on a revised text<br>
    <br>
    Regarding this point below, I agree with Jouni, can you please make
    the change to be in line with the RFC 6733 format (for example, RFC
    6733 doesn't have encryption)<br>
    <pre>   Furthermore, Section 4 uses Diameter AVP Flag rules as defined in RFC3588,
   which has already been obsoleted by RFC6733 and there the AVP Flag rules
   are less due to e.g. deprecation of Diameter in-band security.
</pre>
    <br>
    <pre>EDITORIAL
The guidelines in RFC 3580 are still valid, right?

OLD:
  &nbsp;"IEEE 802.1X Remote Authentication Dial In User Service (RADIUS)
   Usage Guidelines" [RFC3580] provided guidelines for the use of the
   Remote Authentication Dialin User Service (RADIUS) within networks
   utilizing IEEE 802 local area networks. 
NEW:
 "IEEE 802.1X Remote Authentication Dial In User Service (RADIUS)
   Usage Guidelines" [RFC3580] <u>provides </u>guidelines for the use of the
   Remote Authentication Dialin User Service (RADIUS) within networks
   utilizing IEEE 802 local area networks. 

Regards, Benoit
</pre>
  </body>
</html>

--------------080008050106020301020404--

From kwiereng@cisco.com  Tue Jan 21 07:31:01 2014
Return-Path: <kwiereng@cisco.com>
X-Original-To: radext@ietfa.amsl.com
Delivered-To: radext@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5CF141A02BE for <radext@ietfa.amsl.com>; Tue, 21 Jan 2014 07:31:01 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -10.035
X-Spam-Level: 
X-Spam-Status: No, score=-10.035 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RP_MATCHES_RCVD=-0.535, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yTeEFzbXri_E for <radext@ietfa.amsl.com>; Tue, 21 Jan 2014 07:30:59 -0800 (PST)
Received: from alln-iport-6.cisco.com (alln-iport-6.cisco.com [173.37.142.93]) by ietfa.amsl.com (Postfix) with ESMTP id D628E1A0199 for <radext@ietf.org>; Tue, 21 Jan 2014 07:30:58 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=6478; q=dns/txt; s=iport; t=1390318259; x=1391527859; h=from:to:subject:date:message-id:references:in-reply-to: mime-version; bh=5GrhRtOQsxQiSUdPNMEjG/Uc/Yl+mIrVNA6/5BVp8sI=; b=Wj85RHTxZIWXOxecwODWOEeAp3FJHdbwXpJR9qMtE7NtK0y09fj5fcpd 0aoC3QPknSmPm/ZMaquIdmdBo4p35R1na2bHt+pubLXoF5fic0Qb66M/R AkuBVMCEhhCRwbukt0s6emQbHS9uJ64z/HYSL4j9MFH2NetoHsAXd2keJ w=;
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: AmsHAPuR3lKtJV2d/2dsb2JhbABagws4UIVkrT2IUoERFnSCJQEBAQR3EgIBGQECAQIoBzIUAwQCCAIEEwmHfAgFxCkXjm4NCgEGgx6BFASYIoEykGaDLQ
X-IronPort-AV: E=Sophos;i="4.95,696,1384300800"; d="scan'208,217";a="14381472"
Received: from rcdn-core-6.cisco.com ([173.37.93.157]) by alln-iport-6.cisco.com with ESMTP; 21 Jan 2014 15:30:58 +0000
Received: from xhc-aln-x11.cisco.com (xhc-aln-x11.cisco.com [173.36.12.85]) by rcdn-core-6.cisco.com (8.14.5/8.14.5) with ESMTP id s0LFUwu3005662 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=FAIL) for <radext@ietf.org>; Tue, 21 Jan 2014 15:30:58 GMT
Received: from xmb-aln-x12.cisco.com ([169.254.7.104]) by xhc-aln-x11.cisco.com ([173.36.12.85]) with mapi id 14.03.0123.003; Tue, 21 Jan 2014 09:30:58 -0600
From: "Klaas Wierenga (kwiereng)" <kwiereng@cisco.com>
To: "radext@ietf.org" <radext@ietf.org>
Thread-Topic: New Version Notification for draft-wierenga-ietf-eduroam-02.txt
Thread-Index: AQHPFrT3SGF2GoMuFEymcjF8vrkTG5qPTiYo
Date: Tue, 21 Jan 2014 15:30:57 +0000
Message-ID: <100D5B29-49E2-42EF-A213-00077DA5409E@cisco.com>
References: <20140121142747.23967.60034.idtracker@ietfa.amsl.com>
In-Reply-To: <20140121142747.23967.60034.idtracker@ietfa.amsl.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
Content-Type: multipart/alternative; boundary="_000_100D5B2949E242EFA21300077DA5409Eciscocom_"
MIME-Version: 1.0
X-Mailman-Approved-At: Tue, 21 Jan 2014 08:30:51 -0800
Subject: [radext] Fwd: New Version Notification for draft-wierenga-ietf-eduroam-02.txt
X-BeenThere: radext@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: RADIUS EXTensions working group discussion list <radext.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/radext>, <mailto:radext-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/radext/>
List-Post: <mailto:radext@ietf.org>
List-Help: <mailto:radext-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/radext>, <mailto:radext-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 21 Jan 2014 15:31:01 -0000

--_000_100D5B2949E242EFA21300077DA5409Eciscocom_
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

FYI

Sent from my iPad

Begin forwarded message:

From: <internet-drafts@ietf.org<mailto:internet-drafts@ietf.org>>
Date: 21 januari 2014 15:27:47 CET
To: Tomasz Wolniewicz <twoln@umk.pl<mailto:twoln@umk.pl>>, Tomasz Wolniewic=
z <twoln@umk.pl<mailto:twoln@umk.pl>>, "Klaas Wierenga" <klaas@cisco.com<ma=
ilto:klaas@cisco.com>>, Klaas Wierenga <klaas@cisco.com<mailto:klaas@cisco.=
com>>, Stefan Winter <stefan.winter@restena.lu<mailto:stefan.winter@restena=
.lu>>, Stefan Winter <stefan.winter@restena.lu<mailto:stefan.winter@restena=
.lu>>
Subject: New Version Notification for draft-wierenga-ietf-eduroam-02.txt


A new version of I-D, draft-wierenga-ietf-eduroam-02.txt
has been successfully submitted by Klaas Wierenga and posted to the
IETF repository.

Name:        draft-wierenga-ietf-eduroam
Revision:    02
Title:        The eduroam architecture for network roaming
Document date:    2014-01-21
Group:        Individual Submission
Pages:        34
URL:            http://www.ietf.org/internet-drafts/draft-wierenga-ietf-edu=
roam-02.txt
Status:         https://datatracker.ietf.org/doc/draft-wierenga-ietf-eduroa=
m/
Htmlized:       http://tools.ietf.org/html/draft-wierenga-ietf-eduroam-02
Diff:           http://www.ietf.org/rfcdiff?url2=3Ddraft-wierenga-ietf-edur=
oam-02

Abstract:
  This document describes the architecture of the eduroam service for
  federated (wireless) network access in academia.  The combination of
  802.1X, EAP and RADIUS that is used in eduroam provides a secure,
  scalable and deployable service for roaming network access.  The
  successful deployment of eduroam over the last decade in the
  educational sector may serve as an example for other sectors, hence
  this document.  In particular the initial architectural and standards
  choices and the changes that were prompted by operational experience
  are highlighted.




Please note that it may take a couple of minutes from the time of submissio=
n
until the htmlized version and diff are available at tools.ietf.org<http://=
tools.ietf.org>.

The IETF Secretariat


--_000_100D5B2949E242EFA21300077DA5409Eciscocom_
Content-Type: text/html; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<html>
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dus-ascii"=
>
</head>
<body dir=3D"auto">
<div>FYI<br>
<br>
Sent from my iPad</div>
<div><br>
Begin forwarded message:<br>
<br>
</div>
<blockquote type=3D"cite">
<div><b>From:</b> &lt;<a href=3D"mailto:internet-drafts@ietf.org">internet-=
drafts@ietf.org</a>&gt;<br>
<b>Date:</b> 21 januari 2014 15:27:47 CET<br>
<b>To:</b> Tomasz Wolniewicz &lt;<a href=3D"mailto:twoln@umk.pl">twoln@umk.=
pl</a>&gt;, Tomasz Wolniewicz &lt;<a href=3D"mailto:twoln@umk.pl">twoln@umk=
.pl</a>&gt;, &quot;Klaas Wierenga&quot; &lt;<a href=3D"mailto:klaas@cisco.c=
om">klaas@cisco.com</a>&gt;, Klaas Wierenga &lt;<a href=3D"mailto:klaas@cis=
co.com">klaas@cisco.com</a>&gt;,
 Stefan Winter &lt;<a href=3D"mailto:stefan.winter@restena.lu">stefan.winte=
r@restena.lu</a>&gt;, Stefan Winter &lt;<a href=3D"mailto:stefan.winter@res=
tena.lu">stefan.winter@restena.lu</a>&gt;<br>
<b>Subject:</b> <b>New Version Notification for draft-wierenga-ietf-eduroam=
-02.txt</b><br>
<br>
</div>
</blockquote>
<blockquote type=3D"cite">
<div><span></span><br>
<span>A new version of I-D, draft-wierenga-ietf-eduroam-02.txt</span><br>
<span>has been successfully submitted by Klaas Wierenga and posted to the</=
span><br>
<span>IETF repository.</span><br>
<span></span><br>
<span>Name: &nbsp; &nbsp; &nbsp; &nbsp;draft-wierenga-ietf-eduroam</span><b=
r>
<span>Revision: &nbsp; &nbsp;02</span><br>
<span>Title: &nbsp; &nbsp; &nbsp; &nbsp;The eduroam architecture for networ=
k roaming</span><br>
<span>Document date: &nbsp; &nbsp;2014-01-21</span><br>
<span>Group: &nbsp; &nbsp; &nbsp; &nbsp;Individual Submission</span><br>
<span>Pages: &nbsp; &nbsp; &nbsp; &nbsp;34</span><br>
<span>URL: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbs=
p;<a href=3D"http://www.ietf.org/internet-drafts/draft-wierenga-ietf-eduroa=
m-02.txt">http://www.ietf.org/internet-drafts/draft-wierenga-ietf-eduroam-0=
2.txt</a></span><br>
<span>Status: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a href=3D"ht=
tps://datatracker.ietf.org/doc/draft-wierenga-ietf-eduroam/">https://datatr=
acker.ietf.org/doc/draft-wierenga-ietf-eduroam/</a></span><br>
<span>Htmlized: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a href=3D"http://tools=
.ietf.org/html/draft-wierenga-ietf-eduroam-02">http://tools.ietf.org/html/d=
raft-wierenga-ietf-eduroam-02</a></span><br>
<span>Diff: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a =
href=3D"http://www.ietf.org/rfcdiff?url2=3Ddraft-wierenga-ietf-eduroam-02">=
http://www.ietf.org/rfcdiff?url2=3Ddraft-wierenga-ietf-eduroam-02</a></span=
><br>
<span></span><br>
<span>Abstract:</span><br>
<span>&nbsp;&nbsp;This document describes the architecture of the eduroam s=
ervice for</span><br>
<span>&nbsp;&nbsp;federated (wireless) network access in academia. &nbsp;Th=
e combination of</span><br>
<span>&nbsp;&nbsp;802.1X, EAP and RADIUS that is used in eduroam provides a=
 secure,</span><br>
<span>&nbsp;&nbsp;scalable and deployable service for roaming network acces=
s. &nbsp;The</span><br>
<span>&nbsp;&nbsp;successful deployment of eduroam over the last decade in =
the</span><br>
<span>&nbsp;&nbsp;educational sector may serve as an example for other sect=
ors, hence</span><br>
<span>&nbsp;&nbsp;this document. &nbsp;In particular the initial architectu=
ral and standards</span><br>
<span>&nbsp;&nbsp;choices and the changes that were prompted by operational=
 experience</span><br>
<span>&nbsp;&nbsp;are highlighted.</span><br>
<span></span><br>
<span></span><br>
<span></span><br>
<span></span><br>
<span>Please note that it may take a couple of minutes from the time of sub=
mission</span><br>
<span>until the htmlized version and diff are available at <a href=3D"http:=
//tools.ietf.org">
tools.ietf.org</a>.</span><br>
<span></span><br>
<span>The IETF Secretariat</span><br>
<span></span><br>
</div>
</blockquote>
</body>
</html>

--_000_100D5B2949E242EFA21300077DA5409Eciscocom_--

From internet-drafts@ietf.org  Tue Jan 21 12:04:26 2014
Return-Path: <internet-drafts@ietf.org>
X-Original-To: radext@ietfa.amsl.com
Delivered-To: radext@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5779C1A03C9; Tue, 21 Jan 2014 12:04:26 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.9
X-Spam-Level: 
X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id r7wMuU0J29_9; Tue, 21 Jan 2014 12:04:24 -0800 (PST)
Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id B85C51A0393; Tue, 21 Jan 2014 12:04:24 -0800 (PST)
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
From: internet-drafts@ietf.org
To: i-d-announce@ietf.org
X-Test-IDTracker: no
X-IETF-IDTracker: 4.90.p2
Auto-Submitted: auto-generated
Precedence: bulk
Message-ID: <20140121200424.24836.44203.idtracker@ietfa.amsl.com>
Date: Tue, 21 Jan 2014 12:04:24 -0800
Cc: radext@ietf.org
Subject: [radext] I-D Action: draft-ietf-radext-ieee802ext-10.txt
X-BeenThere: radext@ietf.org
X-Mailman-Version: 2.1.15
List-Id: RADIUS EXTensions working group discussion list <radext.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/radext>, <mailto:radext-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/radext/>
List-Post: <mailto:radext@ietf.org>
List-Help: <mailto:radext-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/radext>, <mailto:radext-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 21 Jan 2014 20:04:26 -0000

A New Internet-Draft is available from the on-line Internet-Drafts director=
ies.
 This draft is a work item of the RADIUS EXTensions Working Group of the IE=
TF.

        Title           : RADIUS Attributes for IEEE 802 Networks
        Authors         : Bernard Aboba
                          Jouni Malinen
                          Paul Congdon
                          Joseph Salowey
                          Mark Jones
	Filename        : draft-ietf-radext-ieee802ext-10.txt
	Pages           : 27
	Date            : 2014-01-21

Abstract:
   RFC 3580 provides guidelines for the use of the Remote Authentication
   Dialin User Service (RADIUS) within IEEE 802 local area networks
   (LANs).  This document proposes additional attributes for use within
   IEEE 802 networks, as well as clarifying the usage of the EAP-Key-
   Name attribute and the Called-Station-Id attribute.  This document
   updates RFC 3580 as well as RFC 4072.


The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-radext-ieee802ext/

There's also a htmlized version available at:
http://tools.ietf.org/html/draft-ietf-radext-ieee802ext-10

A diff from the previous version is available at:
http://www.ietf.org/rfcdiff?url2=3Ddraft-ietf-radext-ieee802ext-10


Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/


From bclaise@cisco.com  Tue Jan 21 14:44:13 2014
Return-Path: <bclaise@cisco.com>
X-Original-To: radext@ietfa.amsl.com
Delivered-To: radext@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7FA691A035E for <radext@ietfa.amsl.com>; Tue, 21 Jan 2014 14:44:13 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -10.035
X-Spam-Level: 
X-Spam-Status: No, score=-10.035 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RP_MATCHES_RCVD=-0.535, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JChdE75LuM05 for <radext@ietfa.amsl.com>; Tue, 21 Jan 2014 14:44:10 -0800 (PST)
Received: from aer-iport-1.cisco.com (aer-iport-1.cisco.com [173.38.203.51]) by ietfa.amsl.com (Postfix) with ESMTP id 3F8691A0356 for <radext@ietf.org>; Tue, 21 Jan 2014 14:44:10 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=9214; q=dns/txt; s=iport; t=1390344250; x=1391553850; h=message-id:date:from:mime-version:to:cc:subject: references:in-reply-to; bh=BJE0ceUl8QQgoR7GiamherGlIWR65/MOtyYvjWjpKFc=; b=B0NlrGOi3w/pF7PfRihesxIFS5v8/M0ecpqUJgmDzqaNvKVSkKZn5FJW rdBIUyWwxctg9k4758SBGp8ny0ywgnO8N+rCF3wmfW3XvfyNpjE7KSewl gDiVQ9tedTCAp3KYyJ5cXnZUaRnW5NuXPug2VeIyE8VCkBO/eyT3Wh+JA o=;
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: AgwFABP33lKQ/khN/2dsb2JhbABagws4u3ZPgRcWdIImAQEEAQEBawoBEAshFg8JAwIBAgEVMAYNAQUCAQGIAQ3CYxMEjn8HhDgEjGCLQoZHfIpVgy47
X-IronPort-AV: E=Sophos;i="4.95,697,1384300800"; d="scan'208,217";a="3976418"
Received: from ams-core-4.cisco.com ([144.254.72.77]) by aer-iport-1.cisco.com with ESMTP; 21 Jan 2014 22:44:09 +0000
Received: from [10.60.67.85] (ams-bclaise-8914.cisco.com [10.60.67.85]) by ams-core-4.cisco.com (8.14.5/8.14.5) with ESMTP id s0LMi8Q2015839; Tue, 21 Jan 2014 22:44:08 GMT
Message-ID: <52DEF838.1010406@cisco.com>
Date: Tue, 21 Jan 2014 23:44:08 +0100
From: Benoit Claise <bclaise@cisco.com>
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20100101 Thunderbird/24.2.0
MIME-Version: 1.0
To: "radext@ietf.org" <radext@ietf.org>
References: <52D90642.4000000@cisco.com>
In-Reply-To: <52D90642.4000000@cisco.com>
Content-Type: multipart/alternative; boundary="------------040602050202050801070203"
Cc: "<lionel.morand@orange.com>" <lionel.morand@orange.com>
Subject: Re: [radext] AD review of draft-ietf-radext-ieee802ext-09
X-BeenThere: radext@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: RADIUS EXTensions working group discussion list <radext.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/radext>, <mailto:radext-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/radext/>
List-Post: <mailto:radext@ietf.org>
List-Help: <mailto:radext-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/radext>, <mailto:radext-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 21 Jan 2014 22:44:13 -0000

This is a multi-part message in MIME format.
--------------040602050202050801070203
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit

Dear authors,
> Dear all,
>
> Glad that this document finally makes progress.
>
> >From the writeup (https://datatracker.ietf.org/doc/draft-ietf-radext-ieee802ext/shepherdwriteup/), I see:
>
>     (6) Describe any specific concerns or issues that the Document Shepherd
>     has with this document that the Responsible Area Director and/or the
>     IESG should be aware of? For example, perhaps he or she is uncomfortable
>     with certain parts of the document, or has concerns whether there really
>     is a need for it. In any event, if the WG has discussed those issues and
>     has indicated that it still wishes to advance the document, detail those
>     concerns here.
>
>         The document (informatively) references to RFC4005 on its Diameter
>         considerations. The RFC4005 will soon be obsoleted by RFC4005bis.
>         The RFC4005bis also deprecates the RADIUS-Diameter automated
>         translation, which is discussed in detail in Section 4 Diameter Considerations.
>
>         The shepherd would recommend removing entire Section 4, since
>         RADIUS-Diameter considerations are not really endorsed anymore.
>
>         Furthermore, Section 4 uses Diameter AVP Flag rules as defined in RFC3588,
>         which has already been obsoleted by RFC6733 and there the AVP Flag rules
>         are less due to e.g. deprecation of Diameter in-band security.
>
>
>
> I would actually prefer to keep the section 4, because the AVPs are 
> allocated in the range 1-255.
So it seems that you went the easier way, i.e. removing the entire 
section 4...
Progressing the document now.

Regards, Benoit
> However, RFC 4005bis must be mentioned as well.
> This specific point is also discussed in 
> draft-ietf-dime-app-design-guide-21
>      Guidelines for implementing a RADIUS-Diameter translation agent
>      were put into the Diameter NASREQ Application RFC 4005.
>      However, it was acknowledged that such translation mechanism was not
>      so obvious and deeper protocol analysis was required to ensure
>      efficient interworking between RADIUS and Diameter.  Moreover, the
>      interworking requirements depend on the functionalities provided by
>      the Diameter application under specification, and a case-by-case
>      analysis is required.
>      As a consequence, all the material related to RADIUS-to-Diameter translation has been
>      removed from the new version of the Diameter NASREQ application specification
>      [RFC4005bis], which deprecates RFC4005
> Feel free to synchronize with Lionel Morand, the 
> draft-ietf-dime-app-design-guide-21 editor, who is currently working 
> on a revised text
>
> Regarding this point below, I agree with Jouni, can you please make 
> the change to be in line with the RFC 6733 format (for example, RFC 
> 6733 doesn't have encryption)
>     Furthermore, Section 4 uses Diameter AVP Flag rules as defined in RFC3588,
>     which has already been obsoleted by RFC6733 and there the AVP Flag rules
>     are less due to e.g. deprecation of Diameter in-band security.
>
> EDITORIAL
> The guidelines in RFC 3580 are still valid, right?
>
> OLD:
>     "IEEE 802.1X Remote Authentication Dial In User Service (RADIUS)
>     Usage Guidelines" [RFC3580] provided guidelines for the use of the
>     Remote Authentication Dialin User Service (RADIUS) within networks
>     utilizing IEEE 802 local area networks.
> NEW:
>   "IEEE 802.1X Remote Authentication Dial In User Service (RADIUS)
>     Usage Guidelines" [RFC3580]_provides_guidelines for the use of the
>     Remote Authentication Dialin User Service (RADIUS) within networks
>     utilizing IEEE 802 local area networks.
>
> Regards, Benoit
>
>
> _______________________________________________
> radext mailing list
> radext@ietf.org
> https://www.ietf.org/mailman/listinfo/radext


--------------040602050202050801070203
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit

<html>
  <head>
    <meta content="text/html; charset=ISO-8859-1"
      http-equiv="Content-Type">
  </head>
  <body bgcolor="#FFFFFF" text="#000000">
    <div class="moz-cite-prefix">Dear authors, <br>
    </div>
    <blockquote cite="mid:52D90642.4000000@cisco.com" type="cite">
      <meta http-equiv="Content-Type" content="text/html;
        charset=ISO-8859-1">
      <pre>Dear all,

Glad that this document finally makes progress.

&gt;From the writeup (<a moz-do-not-send="true" class="moz-txt-link-freetext" href="https://datatracker.ietf.org/doc/draft-ietf-radext-ieee802ext/shepherdwriteup/">https://datatracker.ietf.org/doc/draft-ietf-radext-ieee802ext/shepherdwriteup/</a>), I see:
</pre>
      <blockquote>
        <pre>(6) Describe any specific concerns or issues that the Document Shepherd
has with this document that the Responsible Area Director and/or the
IESG should be aware of? For example, perhaps he or she is uncomfortable
with certain parts of the document, or has concerns whether there really
is a need for it. In any event, if the WG has discussed those issues and
has indicated that it still wishes to advance the document, detail those
concerns here.

   The document (informatively) references to RFC4005 on its Diameter
   considerations. The RFC4005 will soon be obsoleted by RFC4005bis.
   The RFC4005bis also deprecates the RADIUS-Diameter automated
   translation, which is discussed in detail in Section 4 Diameter Considerations.

   The shepherd would recommend removing entire Section 4, since
   RADIUS-Diameter considerations are not really endorsed anymore.
</pre>
      </blockquote>
      <blockquote>
        <pre>  &nbsp;Furthermore, Section 4 uses Diameter AVP Flag rules as defined in RFC3588,
   which has already been obsoleted by RFC6733 and there the AVP Flag rules
   are less due to e.g. deprecation of Diameter in-band security.



</pre>
      </blockquote>
      I would actually prefer to keep the section 4, because the AVPs
      are allocated in the range 1-255.<br>
    </blockquote>
    So it seems that you went the easier way, i.e. removing the entire
    section 4...<br>
    Progressing the document now.<br>
    <br>
    Regards, Benoit<br>
    <blockquote cite="mid:52D90642.4000000@cisco.com" type="cite">
      However, RFC 4005bis must be mentioned as well.<br>
      This specific point is also discussed in
      draft-ietf-dime-app-design-guide-21<br>
      <pre wrap="">    Guidelines for implementing a RADIUS-Diameter translation agent 
    were put into the Diameter NASREQ Application RFC 4005.
    However, it was acknowledged that such translation mechanism was not
    so obvious and deeper protocol analysis was required to ensure
    efficient interworking between RADIUS and Diameter.  Moreover, the
    interworking requirements depend on the functionalities provided by
    the Diameter application under specification, and a case-by-case
    analysis is required.
    As a consequence, all the material related to RADIUS-to-Diameter translation has been   
    removed from the new version of the Diameter NASREQ application specification 
    [RFC4005bis], which deprecates RFC4005
</pre>
      Feel free to synchronize with Lionel Morand, the
      draft-ietf-dime-app-design-guide-21 editor, who is currently
      working on a revised text<br>
      <br>
      Regarding this point below, I agree with Jouni, can you please
      make the change to be in line with the RFC 6733 format (for
      example, RFC 6733 doesn't have encryption)<br>
      <pre>   Furthermore, Section 4 uses Diameter AVP Flag rules as defined in RFC3588,
   which has already been obsoleted by RFC6733 and there the AVP Flag rules
   are less due to e.g. deprecation of Diameter in-band security.
</pre>
      <br>
      <pre>EDITORIAL
The guidelines in RFC 3580 are still valid, right?

OLD:
  &nbsp;"IEEE 802.1X Remote Authentication Dial In User Service (RADIUS)
   Usage Guidelines" [RFC3580] provided guidelines for the use of the
   Remote Authentication Dialin User Service (RADIUS) within networks
   utilizing IEEE 802 local area networks. 
NEW:
 "IEEE 802.1X Remote Authentication Dial In User Service (RADIUS)
   Usage Guidelines" [RFC3580] <u>provides </u>guidelines for the use of the
   Remote Authentication Dialin User Service (RADIUS) within networks
   utilizing IEEE 802 local area networks. 

Regards, Benoit
</pre>
      <br>
      <fieldset class="mimeAttachmentHeader"></fieldset>
      <br>
      <pre wrap="">_______________________________________________
radext mailing list
<a class="moz-txt-link-abbreviated" href="mailto:radext@ietf.org">radext@ietf.org</a>
<a class="moz-txt-link-freetext" href="https://www.ietf.org/mailman/listinfo/radext">https://www.ietf.org/mailman/listinfo/radext</a>
</pre>
    </blockquote>
    <br>
  </body>
</html>

--------------040602050202050801070203--

From iesg-secretary@ietf.org  Tue Jan 21 14:51:56 2014
Return-Path: <iesg-secretary@ietf.org>
X-Original-To: radext@ietfa.amsl.com
Delivered-To: radext@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 17D3B1A0374; Tue, 21 Jan 2014 14:51:56 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.9
X-Spam-Level: 
X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WZBGiA5Nmiz0; Tue, 21 Jan 2014 14:51:54 -0800 (PST)
Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id B19791A0240; Tue, 21 Jan 2014 14:51:54 -0800 (PST)
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
From: The IESG <iesg-secretary@ietf.org>
To: IETF-Announce <ietf-announce@ietf.org>
X-Test-IDTracker: no
X-IETF-IDTracker: 4.90.p2
Auto-Submitted: auto-generated
Precedence: bulk
Sender: <iesg-secretary@ietf.org>
Message-ID: <20140121225154.1128.3918.idtracker@ietfa.amsl.com>
Date: Tue, 21 Jan 2014 14:51:54 -0800
Cc: radext@ietf.org
Subject: [radext] Last Call: <draft-ietf-radext-ieee802ext-10.txt> (RADIUS Attributes for IEEE 802 Networks) to Proposed Standard
X-BeenThere: radext@ietf.org
X-Mailman-Version: 2.1.15
Reply-To: ietf@ietf.org
List-Id: RADIUS EXTensions working group discussion list <radext.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/radext>, <mailto:radext-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/radext/>
List-Post: <mailto:radext@ietf.org>
List-Help: <mailto:radext-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/radext>, <mailto:radext-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 21 Jan 2014 22:51:56 -0000

The IESG has received a request from the RADIUS EXTensions WG (radext) to
consider the following document:
- 'RADIUS Attributes for IEEE 802 Networks'
  <draft-ietf-radext-ieee802ext-10.txt> as Proposed Standard

The IESG plans to make a decision in the next few weeks, and solicits
final comments on this action. Please send substantive comments to the
ietf@ietf.org mailing lists by 2014-02-04. Exceptionally, comments may be
sent to iesg@ietf.org instead. In either case, please retain the
beginning of the Subject line to allow automated sorting.

Abstract


   RFC 3580 provides guidelines for the use of the Remote Authentication
   Dialin User Service (RADIUS) within IEEE 802 local area networks
   (LANs).  This document proposes additional attributes for use within
   IEEE 802 networks, as well as clarifying the usage of the EAP-Key-
   Name attribute and the Called-Station-Id attribute.  This document
   updates RFC 3580 as well as RFC 4072.




The file can be obtained via
http://datatracker.ietf.org/doc/draft-ietf-radext-ieee802ext/

IESG discussion can be tracked via
http://datatracker.ietf.org/doc/draft-ietf-radext-ieee802ext/ballot/


No IPR declarations have been submitted directly on this I-D.



From aland@deployingradius.com  Thu Jan 23 11:06:33 2014
Return-Path: <aland@deployingradius.com>
X-Original-To: radext@ietfa.amsl.com
Delivered-To: radext@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 733791A019E; Thu, 23 Jan 2014 11:06:32 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: 0.4
X-Spam-Level: 
X-Spam-Status: No, score=0.4 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, MANGLED_LIST=2.3] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uj2ssDEyyYjr; Thu, 23 Jan 2014 11:06:28 -0800 (PST)
Received: from power.freeradius.org (power.freeradius.org [88.190.25.44]) by ietfa.amsl.com (Postfix) with ESMTP id 61FFD1A01E5; Thu, 23 Jan 2014 11:06:20 -0800 (PST)
Received: from localhost (localhost [127.0.0.1]) by power.freeradius.org (Postfix) with ESMTP id EBE4E224015C; Thu, 23 Jan 2014 20:05:48 +0100 (CET)
X-Virus-Scanned: Debian amavisd-new at power.freeradius.org
Received: from power.freeradius.org ([127.0.0.1]) by localhost (power.freeradius.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cztsKwlFyhsl; Thu, 23 Jan 2014 20:05:46 +0100 (CET)
Received: from Thor.local (unknown [70.50.217.206]) by power.freeradius.org (Postfix) with ESMTPSA id 469D7224013A; Thu, 23 Jan 2014 20:05:45 +0100 (CET)
Message-ID: <52E16808.3070308@deployingradius.com>
Date: Thu, 23 Jan 2014 14:05:44 -0500
From: Alan DeKok <aland@deployingradius.com>
User-Agent: Thunderbird 2.0.0.24 (Macintosh/20100228)
MIME-Version: 1.0
To: Ben Campbell <ben@nostrum.com>
References: <C3DF6E99-2B7E-4606-A8F6-5D76C338B265@nostrum.com>
In-Reply-To: <C3DF6E99-2B7E-4606-A8F6-5D76C338B265@nostrum.com>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Cc: radext@ietf.org, draft-ietf-radext-dtls.all@tools.ietf.org, "gen-art@ietf.org Team \(gen-art@ietf.org\)" <gen-art@ietf.org>
Subject: Re: [radext] Gen-Art Early Review of draft-ietf-radext-dtls-07
X-BeenThere: radext@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: RADIUS EXTensions working group discussion list <radext.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/radext>, <mailto:radext-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/radext/>
List-Post: <mailto:radext@ietf.org>
List-Help: <mailto:radext-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/radext>, <mailto:radext-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 23 Jan 2014 19:06:33 -0000

Ben Campbell wrote:
> *** Major issues:
> 
> -- General:
> 
> The draft needs an overhaul of it's use of normative language. There appears to be redundant (and possibly contradictory) language for the same requirements sprinkled throughout. There are also cases of normative language being used for internal implementation guidance, which is not appropriate as described by RFC 2119. (See the minor issues section for details--most of the instances would not qualify as major issues by themselves, but I think they constitute a major issue in the aggregate.)
> 
> -- section 3, 2nd paragraph:  "... long-term use of RADIUS/UDP is NOT RECOMMENDED." 
> 
> While I agree with the sentiment, that's not an appropriate assertion for an experimental RFC. It would either need to go into an standards-track update to the RADIUS spec, or a BCP.

  OK.

> (Also applies to the reiteration in 10.1)

  I'm less sure of that.  10.1 doesn't re-iterate the point above.  It
makes a security recommendation.  i.e. allowing secure and insecure
traffic from the same client is bad.

  This imposes no change on existing RADIUS/UDP clients, as they will
only be sending RADIUS/UDP.  It does impose security requirements on
RADIUS/DTLS clients and servers, which is the intent of the section.

> *** Minor issues:
> 
> -- General:  It might be worth some text on why this is experimental rather than informational. Is there any plan to evaluate the implementation results? Is there an expectation that a future RADIUS/DTLS spec could become standards-track? Is there any plan to evaluate the outcome of this document?

  It's probably easiest to reference Section 1.3 of RFC 6614.  The
issues are the same.

> -- Section 1, 2nd paragraph:
> 
> Isn't this true for almost any use of IPSec? Is there some specific reason this is worse for RADIUS than for other protocols?

  It's true for most protocols.

> -- Section 1, 4th paragraph:
> 
> The second sentence mentions that firewall rules do not need to be changed. The following sentence recommends a change to firewall rules.

  That's left over from earlier drafts.  I'll fix it.

> The firewall rule recommendations in the 3rd sentence seems odd, since it seems like any protocol over DTLS would pass. Also, does this imply a recommendation that firewalls with DPI be used in the first place, since the absence of such a firewall has the same effect as having one that doesn't enforce the protocol? (Is there a reason a protocol spec should recommend firewall rules in the first place, other than to mention places where certain firewall rules might prevent interfere with operation?)

  I'll clarify it, and move it to the Security Considerations section.

> -- section 2.1, 5th paragraph (3rd paragraph after bullet list) :  "Implementations MUST support encapsulated RADIUS packets of 4096 in length..."
> 
> Please be more precise than "MUST support". Specifically, does "MUST support" indicate you must support both sending and receiving of that size? (since 4096 would generally exceed PMTU even for RADIUS/UDP)

  Yes.  RADIUS/UDP has the same 4096 octet limit for sending and
receiving packets.

> -- 2.2 and children:
> 
> I find this section confusing as to where to find the authoritative text. Some, but not all, of the material from 6614 is repeated as normative text in later sections.  The description of this draft as applying 'semantic "patches"' to 6614 seems to imply you mean the 6114 text, with these patches applied, to be normative, which creates some potential conflicts. If, on the other hand, 2.2 (.x) is intended more as a informative description of the differences, please say so.

  What conflicts occur?  The intent is show this specification as a
revision / patch from 6614.

> -- 3, 1st paragraph:
> 
> Can you elaborate on the resulting "timeouts, lost traffic, and network instabilities"?

  RADIUS/UDP has no provisions for protocol negotiation.  So simply
disabling UDP makes it look like the server is gone, rather than
transitioned to DTLS.

> -- 3.1: 
> 
> The section describes UDP/2083 as the "default port". But later sections describe port related behavior in a way that makes it it look like the impementations must always use 2083, which makes it more than just a default. Is the administrator allowed to choose some other port for any reason?

  Yes.  As with most protocols, implementations allow the administrator
to use non0-standard ports.

> If so, it might make more sense to refer to the port by role rather than number when discussing port related behavior. (I note that 6614 only mentions the port number in the initial assignment, the IANA considerations, and the appendix.)

  Maybe.  That makes the text a bit more awkward.  "UDP/2083" would get
replaced by "that or any other port you happen to use".

> -- 3.2, last paragraph:
> 
> Can you elaborate on the bid down attack? Given that the use of dtls is configured, rather than negotiated, how would an attacker bid it down?

  When secure and insecure packets are allowed from the same client, a
malicious or broken client can choose the insecure one.  That's bad,
when the intent is to use DTLS.

> -- 4, 2nd paragraph:
> 
> Seems like an (or maybe even the) important point would be that a client should not fall back to cleartext if a server appears to not support it.

  That's reasonable.

> -4, 3rd paragraph:
> 
> Is the recommendation to use a local proxy for all clients, or just those implemented as multiple processes?

  Only ones with multiple processes.

> -- 5.1.1, third paragraph: "In those cases, the implementation MAY delete the underlying session"
> 
> Can you elaborate on why that's a MAY and not a SHOULD or MUST?

  There was a long discussion about this on the RADEXT list.  In short,
the session MUST be closed when there are security issues, or when the
tunneled data isn't RADIUS.

  When security is OK and the tunneled data is RADIUS, it's OK to
silently drop the unexpected RADIUS packets.  Doing so doesn't cause any
problems.

> -- 5.1.1, 4th paragraph:
> 
> This paragraph rephrases 2119 normative language with more normative language. That creates confusion about which text is authoritative. I suggest either keeping the second paragraph and deleting the first, or make the second non-normative.

  I'm not sure what you mean here.  The two paragraphs discuss different
things, so deleting one isn't possible.

> -- 5.1.1, 6th paragraph: "The timestamp SHOULD be updated ..."
> 
> Why not MUST?

  The granularity could be 1 second, with packets being received 1000's
of times per second.

> -- 5.1.1, 7th paragraph:
> 
> Is the "idle time" configurable setting on a per peer or global basis?

  Possibly both.  That depends on the implementation.  I don't see it as
being useful to either restrict the implementations, or make
recommendations here.

  The text here talks about idle timeouts per *session*.  How the
implementation takes that from a configuration setting to a session is
up to the implementation.

> -- 5.1.1, 8th paragraph:
> 
> What does it mean to "track" sessions?  Also, it seems like the "SHOULD stop creating" guidance contradicts later guidance that least recently used sessions might get dropped instead?

  Perhaps "open sessions" is better than "tracked sessions".

  The idea is that it will either drop the new one, or drop an old one.
 Either way, the "maximum sessions" value should not be exceeded.  I'll
update the text.

> -- 5.1.1, 10th paragraph:  
> 
> Should the second sentence contain a normative MUST?

  Yes.

> Also, the 2nd and 3rd sentences taken together seem say "the server must keep the session open until it decides not to" 

  It closes the session when the client asks for it to be closed, or
when the idle timeouts are reached.

  But really, the server is allowed to close sessions any time it wants.
 I don't think we want to restrict that power.

> How would an unauthenticated client close an active DTLS session?

  If a 4-tuple is re-used, AND the server closes an old session to
handle the "new" one.  I'll clarify the text.

> -- 5.2, 1st paragraph:
> 
> The normative requirement for a client to use heartbeats _or_ the application level watchdog algorithm seems to contradict the normative guidance that a server SHOULD use both.

  I'll clarify the text.

> -- 5.2, 3rd paragraph, 1st sentence:
> 
> I would hesitate to phrase this that a client may violate the previous normative SHOULDs. It would be better to phrase this as describing th econsequences should the client ignore the SHOULD.

  I'll clarify the text.

> -- 5.2, 2nd to last paragraph:
> 
> Does this have actual interop or security issues beyond saying, "it's harder to implement and you might screw it up"? If not, it seems counter to the 2119 guidance on when normative language is appropriate. It would be more properly non-normative  implementation guidance.

  OK.

> -- 6, 1st paragraph:
> 
> You mention that these are implementation guidelines, and not part of the protocol. But the section contains 2119 style normative requirements. in general, that's not appropriate unless non-compliance impact interoperability or create some other Bad Thing, such as insecure behavior, excessive bandwidth usage, congestion, etc. Implementation guidance for behavior that is not externally observable should use non-normative.

  OK.

> -- 6, 2nd and 3rd paragraph:
> 
> The RECOMMENDation to allow administrative entry of keys and to derive keys from a PRNG seem contradictory.

  The idea is that admins shouldn't be entering "0xabababab" as a key.
Instead, they get secure keys from a secure location.  People are
notoriously bad at creating randomness.

> -- 6.1, 1st paragraph:
> 
> Does the guidance to use connected sockets remove previous normative requirements about session management and tracking? If not, please indicate the difference.

  No.  The previous text about client session management doesn't talk
about multiple sessions.  It just talks about how to manage *one* session.

  This text is intended to suggest that managing multiple DTLS sessions
on one socket isn't necessary.

> -- 6.1, 3rd paragraph:
> 
> This seems to assume that all radius clients are implementd as multiple processes. Is that the intent?

  No.

> Also,  it's better not to use normative requirements for internal implementation choices. Describe the externally visible behavior normatively. You can give implementation advice in the form of example strategies to fulfill the black-box normative requirements.

  I'll copy the text from earlier in the document which discusses this.

> -- 9
> 
> Why not choose a new port? Is there absolute certainty this won't conflict with the previous usage? I do note that 6414 made the same choice, so I guess consistency with radius/TLS has some value. But that draft talks about compatibility between radsec and radius/tls, which is not mentioned here.

  No one is using UDP/2083 for anything.  Re-using it is OK.

> -- 10, last paragraph:
> 
> You describe the use of null crypto as an implementation or configuration error. Was it intended to be forbidden from intentional use? Is there a need to remove the fixed secret requirement for null crypto, or to disallow null crypto entirely?

  null crypto should be forbidden.

> -- 10.1, 3rd paragraph:
> 
> It would be helpful to have guidance on how to match a certificate to a client or server identity,

  I'll add a note to see RFC 6614 Section 2.5.

> how to configure trust for a self-signed cert, etc.

  I'll avoid that, to be honest.

> -- 10.1, 4th paragraph: 
> 
> -- 10.1, last paragraph:
> 
> Why does the historic use of shared secrets matter, since this document requires all implementations to use a fixed value? Or do you mean the use of poor secrets as PSKs?

  I mean the use of poor secrets as PSKs.

> -- 10.2, 2nd paragraph:
> 
> This is redundant with previous normative requirements. (Also contradictory, since the previous text said "SHOULD", and contradictory guidance on what to do when the limit is exceeded.)

  I've fixed the text to be consistent.

> -- 10.3, 4th paragraph:
> 
> Does this need to be as strong as SHOULD? Is this likely to conflict with dynamic discovery, should it ever exist?

  RADIUS is a critical piece of infrastructure.  Exposing your RADIUS
server to the entire IPv4 range is a bad idea.

  The recommendation is a SHOULD so that it does not conflict with
dynamic discovery.

> -- 10.3, 5th and 6th paragraphs:
> 
> Paragraph 5 says credentials should be statically configured. To me, "credentials" means "the certificate" in this case. That seems to disallow things like statically configuring a name that must match a certificate (perhaps signed by a CA.)

  Credentials for the client should be statically configured.  It could
be a PSK, or a certificate.

  I'm not sure what "name" would match a certificate.  The document
doesn't refer to names, and doesn't use names for anything.

> Paragraph 6 seems to entirely contradict paragraph 5 by recommending private CAs, and accepting any peer that presents a cert signed by that CA. That's pretty much the opposite of statically configured credentials. (Paragraph 8 also seems to contradict the static configuration part.)

  Both client and server still need to be configured with the private
CA.  The alternative is to allow anyone to connect with any credentials,
which seems odd.

> The last sentence refers to "the invalid server". What invalid server is that? None have been mentioned so far.

  The previous sentence talks about a "valid" server.  I'll clarify.

> -- 10.4:
> 
> The guidance in the last paragraph does not make sense. The section seems to say that NATs will break radius/dtls, so you should use dtls when behind a NAT.

  RADIUS/UDP clients should not be behind a NAT.  I'll clarify.

> -- 10.6, last paragraph:
> 
> Can you elaborate on this? Why would an unauthorized 3rd party be able to get packets past the DTLS layer? OTOH, If an authorized client is sending invalid radius packets, wouldn't  you want to terminate the session?

  That was a *long* discussion on the RADEXT list.

  A server may be at protocol rev X, and a client may be at protocol rev
X+1.  If the client sends packets allowed by X+1, the server should
ignore them, as it does today with RADIUS/UDP.  Closing the connection
is not necessary.

> -- 10.7
> 
> Redundant normative requirements (This is at least the third time the separate process issue and local proxy guidance has been described.)

  It's a security considerations section, and needs to mention this.  It
refers to Section 6.1, and adds new text explaining the security
benefits of the approach.

> 
> 
> *** Nits/editorial comments:
> 
> -- IDNits reports some issues; please check.

  They're fine.

> -- Abstract:
> Please avoid citations in the abstract. Please consider removing the "scare quotes".

  OK.

> -- Section 1, 5th paragraph:
> 
> it seems like the RADIUS problems that this does not solve are in generally solved by RADIUS/TLS. If so, it would probably be worth a mention.

  OK.

> -- section 2.1, 4th paragraph from end: 
> 
> Seems like there are other changes as well. For example, you don't include "Use DTLS" as one of the changes in RADIUS/DTLS from RADIUS/USP.

  OK.

> -- 2.2 and children:
> 
> In my strictly personal opinion, the approach of patching 6614 transfers a lot of effort from the author to the reader. A reader will basically need to keep both docs open side by side to understand this.  I understand the desire to avoid duplicating normative text, but I think that the balance here has swung too far away from readability.  (OTOH, see my related comment under "minor issues).

  I think re-doing the document is a non-starter at this point.

  Having done this myself, the bulk of the implementation work in doing
DTLS is the UDP layer.  Most everything else can be re-used directly
from RADIUS/TLS.

> -- 2.2.1, paragraph 5:
> 
> should TLS parameters be DTLS parameters?

  Yes.

> -- 2.2.2:
> 
> Why a separate section to say sections 4 and 6 also apply? (The re-iteration seems unneeded.)

  OK.

> -- 3.1, last sentence:
> 
> Really, 2.2.1 doesn't describe that. 6114 describes that. Better to cite the source than to cite a citation to the source, especially when that citation doesn't mention the issues at all.

  OK.

> -- 4, 3rd paragraph:
> 
> Do you really mean multiple independent _implementations_? Or multiple independent instances or processes, perhaps running the same implementation?

  All of that.

> -- section 5 and children:
> 
> In consistent use of "connection" vs "session".

  I'll fix that.

> -- 5.1.1, 2nd paragraph:
> 
> What is an "entry" session?

  The 4-tuple is logically a table tracking (4-tuple) -> (session data).
 Each one is an entry.

  I'll try to clarify the text.

> -- 6.1, 2nd paragraph:
> 
> Source port? Source address? Both?

  Both.

> -- 7:
> 
> Only the first paragraph seems to be about implementation experience.

  OK.

> -- 10, 2nd paragraph: "All of the security considerations for RADIUS apply to the RADIUS portion of the specification."
> 
> The next paragraph seems to contradict this.

  OK.

> -- 10.3, 2nd paragraph: "... a client has a fixed IP address for a server ..."
> 
> This is ambiguous. Do you mean the server knows the client address, or the client knows the server address? It sounds like the latter, but later text makes me wonder if you meant the former.

  The following sentence addresses this.  The client has a fixed IP for
the server, and the server has a fixed IP for the client.

> -- 10.3, 7th paragraph: "... pre-configured with a list of known public CAs."
> 
> By pre-configured, you mean by the manufacturer or vendor, right?

  Yes.

> -- 10.5, 2nd paragraph:
> 
> Does this contradict guidance about using a private CA to identify multiple peers?

  No.

> I don't think you intend it that way; I assume you mean the cert presented by a client must be unique, but as written it's easy to assume that you mean the server has to have unique certs configured for each client, which it would not if it were to allow any arbitrary client that has a cert signed by a private CA.

  That's what it says, so far as I can tell.

From internet-drafts@ietf.org  Fri Jan 24 06:41:47 2014
Return-Path: <internet-drafts@ietf.org>
X-Original-To: radext@ietfa.amsl.com
Delivered-To: radext@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 704951A044A; Fri, 24 Jan 2014 06:41:47 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.9
X-Spam-Level: 
X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jPk3jMtm763e; Fri, 24 Jan 2014 06:41:46 -0800 (PST)
Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 3C5021A0253; Fri, 24 Jan 2014 06:41:46 -0800 (PST)
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
From: internet-drafts@ietf.org
To: i-d-announce@ietf.org
X-Test-IDTracker: no
X-IETF-IDTracker: 4.90.p2
Auto-Submitted: auto-generated
Precedence: bulk
Message-ID: <20140124144146.32682.39208.idtracker@ietfa.amsl.com>
Date: Fri, 24 Jan 2014 06:41:46 -0800
Cc: radext@ietf.org
Subject: [radext] I-D Action: draft-ietf-radext-dtls-08.txt
X-BeenThere: radext@ietf.org
X-Mailman-Version: 2.1.15
List-Id: RADIUS EXTensions working group discussion list <radext.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/radext>, <mailto:radext-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/radext/>
List-Post: <mailto:radext@ietf.org>
List-Help: <mailto:radext-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/radext>, <mailto:radext-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 24 Jan 2014 14:41:47 -0000

A New Internet-Draft is available from the on-line Internet-Drafts director=
ies.
 This draft is a work item of the RADIUS EXTensions Working Group of the IE=
TF.

        Title           : DTLS as a Transport Layer for RADIUS
        Author          : Alan DeKok
	Filename        : draft-ietf-radext-dtls-08.txt
	Pages           : 24
	Date            : 2014-01-24

Abstract:
   The RADIUS protocol defined in RFC 2865 has limited support for
   authentication and encryption of RADIUS packets.  The protocol
   transports data in the clear, although some parts of the packets can
   have obfuscated content.  Packets may be replayed verbatim by an
   attacker, and client-server authentication is based on fixed shared
   secrets.  This document specifies how the Datagram Transport Layer
   Security (DTLS) protocol may be used as a fix for these problems.  It
   also describes how implementations of this proposal can co-exist with
   current RADIUS systems.


The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-radext-dtls/

There's also a htmlized version available at:
http://tools.ietf.org/html/draft-ietf-radext-dtls-08

A diff from the previous version is available at:
http://www.ietf.org/rfcdiff?url2=3Ddraft-ietf-radext-dtls-08


Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/


From ben@nostrum.com  Thu Jan 30 14:51:13 2014
Return-Path: <ben@nostrum.com>
X-Original-To: radext@ietfa.amsl.com
Delivered-To: radext@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0068A1A04DD; Thu, 30 Jan 2014 14:51:13 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.036
X-Spam-Level: 
X-Spam-Status: No, score=-1.036 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HELO_MISMATCH_COM=0.553, HOST_MISMATCH_NET=0.311] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id D_wL9pIoEz_W; Thu, 30 Jan 2014 14:51:09 -0800 (PST)
Received: from shaman.nostrum.com (nostrum-pt.tunnel.tserv2.fmt.ipv6.he.net [IPv6:2001:470:1f03:267::2]) by ietfa.amsl.com (Postfix) with ESMTP id 873541A0513; Thu, 30 Jan 2014 14:51:09 -0800 (PST)
Received: from [10.0.1.29] (cpe-173-172-146-58.tx.res.rr.com [173.172.146.58]) (authenticated bits=0) by shaman.nostrum.com (8.14.3/8.14.3) with ESMTP id s0UMoxwd096662 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NO); Thu, 30 Jan 2014 16:51:02 -0600 (CST) (envelope-from ben@nostrum.com)
Content-Type: text/plain; charset=us-ascii
Mime-Version: 1.0 (Mac OS X Mail 7.1 \(1827\))
From: Ben Campbell <ben@nostrum.com>
In-Reply-To: <52E16808.3070308@deployingradius.com>
Date: Thu, 30 Jan 2014 16:50:58 -0600
Content-Transfer-Encoding: quoted-printable
Message-Id: <807D4BB4-7C1C-4668-8F31-85CD1B080EE6@nostrum.com>
References: <C3DF6E99-2B7E-4606-A8F6-5D76C338B265@nostrum.com> <52E16808.3070308@deployingradius.com>
To: Alan DeKok <aland@deployingradius.com>
X-Mailer: Apple Mail (2.1827)
Received-SPF: pass (shaman.nostrum.com: 173.172.146.58 is authenticated by a trusted mechanism)
X-Mailman-Approved-At: Thu, 30 Jan 2014 17:53:03 -0800
Cc: radext@ietf.org, draft-ietf-radext-dtls.all@tools.ietf.org, "gen-art@ietf.org Team \(gen-art@ietf.org\)" <gen-art@ietf.org>
Subject: Re: [radext] [Gen-art] Gen-Art Early Review of draft-ietf-radext-dtls-07
X-BeenThere: radext@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: RADIUS EXTensions working group discussion list <radext.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/radext>, <mailto:radext-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/radext/>
List-Post: <mailto:radext@ietf.org>
List-Help: <mailto:radext-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/radext>, <mailto:radext-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 30 Jan 2014 22:51:13 -0000

Jouni poked me to review 08. In the process of doing that, I found your =
email that I had somehow missed. Apologies for the late response. I've =
removed sections that do not seem to require further discussion or =
comment.

Thanks!

Ben.

On Jan 23, 2014, at 1:05 PM, Alan DeKok <aland@deployingradius.com> =
wrote:

> Ben Campbell wrote:
>> *** Major issues:

[...]

>> -- section 3, 2nd paragraph:  "... long-term use of RADIUS/UDP is NOT =
RECOMMENDED."=20
>>=20
>> While I agree with the sentiment, that's not an appropriate assertion =
for an experimental RFC. It would either need to go into an =
standards-track update to the RADIUS spec, or a BCP.
>=20
>  OK.

Version 08 partially addresses this by changing "NOT RECOMMENDED" to =
lower case. I don't think that's sufficient; it's not a good idea to =
rely on case alone to distinguish normative from non-normative text. I =
propose changing the sense of the statement to something along the lines =
of "The author recommends...".=20

(Unlike some reviewers, I will not go so far as to say the word "should" =
should never be used non-normatively, since the resulting text tends to =
be awkward. But I think the NOT RECOMMENDED/not recommended difference =
can be handled with more clearly non-normative text without introducing =
the same awkwardness.)

>=20
>> (Also applies to the reiteration in 10.1)
>=20
>  I'm less sure of that.  10.1 doesn't re-iterate the point above.  It
> makes a security recommendation.  i.e. allowing secure and insecure
> traffic from the same client is bad.
>=20
>  This imposes no change on existing RADIUS/UDP clients, as they will
> only be sending RADIUS/UDP.  It does impose security requirements on
> RADIUS/DTLS clients and servers, which is the intent of the section.
>=20

The text to which I refer says "It is RECOMMENDED that all RADIUS =
clients and servers implement this specification, or [RFC6614]." That =
seems to to apply a new normative statement to all RADIUS clients and =
servers, and does not in any way seem scoped to "RADIUS/DTLS clients and =
servers".


>> *** Minor issues:
>>=20
>> -- General:  It might be worth some text on why this is experimental =
rather than informational. Is there any plan to evaluate the =
implementation results? Is there an expectation that a future =
RADIUS/DTLS spec could become standards-track? Is there any plan to =
evaluate the outcome of this document?
>=20
>  It's probably easiest to reference Section 1.3 of RFC 6614.  The
> issues are the same.

I don't think that's the best approach. That discussion is specific to =
6614. Referencing it would leave the reader to infer how that discussion =
would apply to this draft. I think it would be better to include a =
similar discussion here.

>=20
>> -- Section 1, 2nd paragraph:
>>=20
>> Isn't this true for almost any use of IPSec? Is there some specific =
reason this is worse for RADIUS than for other protocols?
>=20
>  It's true for most protocols.

It's worth mentioning that.

[...]

>> The firewall rule recommendations in the 3rd sentence seems odd, =
since it seems like any protocol over DTLS would pass. Also, does this =
imply a recommendation that firewalls with DPI be used in the first =
place, since the absence of such a firewall has the same effect as =
having one that doesn't enforce the protocol? (Is there a reason a =
protocol spec should recommend firewall rules in the first place, other =
than to mention places where certain firewall rules might prevent =
interfere with operation?)
>=20
>  I'll clarify it, and move it to the Security Considerations section.

The clarification added at the end of  section 10 in version 08 mostly =
addresses this. But I assume that the point is to make sure no one sends =
non-protected RADIUS over that port, but it doesn't prevent someone from =
sending some other protocol over DTLS over the same port, correct? If =
so, I think that's worth a mention.

[...]

>> -- 2.2 and children:
>>=20
>> I find this section confusing as to where to find the authoritative =
text. Some, but not all, of the material from 6614 is repeated as =
normative text in later sections.  The description of this draft as =
applying 'semantic "patches"' to 6614 seems to imply you mean the 6114 =
text, with these patches applied, to be normative, which creates some =
potential conflicts. If, on the other hand, 2.2 (.x) is intended more as =
a informative description of the differences, please say so.
>=20
>  What conflicts occur?  The intent is show this specification as a
> revision / patch from 6614.

On a quick re-review, I have not found a specific example of conflicting =
or redundant normative text in version 08. I thought I had run into some =
around peer authentication before, but either I was mistaken or the 08 =
updates corrected it.

[...]

>=20
>> If so, it might make more sense to refer to the port by role rather =
than number when discussing port related behavior. (I note that 6614 =
only mentions the port number in the initial assignment, the IANA =
considerations, and the appendix.)
>=20
>  Maybe.  That makes the text a bit more awkward.  "UDP/2083" would get
> replaced by "that or any other port you happen to use".
>=20

It doesn't need to be that hard. One can start by saying something like =
the RADIUS/DTLS port is UDP/2083 by default, but administrators can =
assign other, non-standard values. Then all future mentions refer to =
"the RADIUS/DTLS port" rather than UDP/2023. But in any case, this is =
only a mild suggestion; with the addition of the disclaimer to section =
3.1 of version 08, the future UDP/2083 references are less troublesome.


>> -- 3.2, last paragraph:
>>=20
>> Can you elaborate on the bid down attack? Given that the use of dtls =
is configured, rather than negotiated, how would an attacker bid it =
down?
>=20
>  When secure and insecure packets are allowed from the same client, a
> malicious or broken client can choose the insecure one.  That's bad,
> when the intent is to use DTLS.

One assumes a "malicious or broken" client already has access to the =
cleartext messages. Are we talking about a MiTM "client"? Are there =
attacks where a third party can induce the client or server to send =
unprotected packets, even with no signaled negotiation? I can imagine =
one for the specific case where a node falls back to clear text if DTLS =
packets fail; an attacker could induce failures for DTLS packets. (Thus =
the next comment.)

>=20
>> -- 4, 2nd paragraph:
>>=20
>> Seems like an (or maybe even the) important point would be that a =
client should not fall back to cleartext if a server appears to not =
support it.
>=20
>  That's reasonable.
>=20
>> -4, 3rd paragraph:
>>=20
>> Is the recommendation to use a local proxy for all clients, or just =
those implemented as multiple processes?
>=20
>  Only ones with multiple processes.

The text seems to say something to the effect of " Some RADIUS clients =
have historically been implemented as multiple independent processes, =
therefore [all] RADIUS clients should use a local proxy".  I think you =
mean to say something more like "Some RADIUS clients have historically =
been implemented as multiple independent processes; clients that are =
implemented that way should use a local proxy."=20

>=20
>> -- 5.1.1, third paragraph: "In those cases, the implementation MAY =
delete the underlying session"
>>=20
>> Can you elaborate on why that's a MAY and not a SHOULD or MUST?
>=20
>  There was a long discussion about this on the RADEXT list.  In short,
> the session MUST be closed when there are security issues, or when the
> tunneled data isn't RADIUS.
>=20
>  When security is OK and the tunneled data is RADIUS, it's OK to
> silently drop the unexpected RADIUS packets.  Doing so doesn't cause =
any
> problems.

It would be helpful to add a couple of sentences to that effect.=20


>=20
>=20

>> -- 5.1.1, 4th paragraph:
>>=20
>> This paragraph rephrases 2119 normative language with more normative =
language. That creates confusion about which text is authoritative. I =
suggest either keeping the second paragraph and deleting the first, or =
make the second non-normative.
>=20
>  I'm not sure what you mean here.  The two paragraphs discuss =
different
> things, so deleting one isn't possible.

The opening sentence of the second paragraph says, "The above paragraph =
can be rephrased more generically", then appears to go on to do so. That =
makes it sound like the second paragraph asserting effectively the same =
normative requirements in more general terms. If you intend each =
paragraph to stand alone, then I suggest deleting that sentence.

>=20
>> -- 5.1.1, 6th paragraph: "The timestamp SHOULD be updated ..."
>>=20
>> Why not MUST?
>=20
>  The granularity could be 1 second, with packets being received 1000's
> of times per second.
>=20

It would be helpful to elaborate on that in the text. Your comment makes =
me thing it would be also worth having some guidance on a reasonable =
resolution for the time stamp.

If you really expect 1 second resolutions, then it might be better to =
say something like "The timestamp MUST be updated if a valid message or =
heartbeat is received during the last time interval."

[...]

>=20
>> -- 6, 1st paragraph:
>>=20
>> You mention that these are implementation guidelines, and not part of =
the protocol. But the section contains 2119 style normative =
requirements. in general, that's not appropriate unless non-compliance =
impact interoperability or create some other Bad Thing, such as insecure =
behavior, excessive bandwidth usage, congestion, etc. Implementation =
guidance for behavior that is not externally observable should use =
non-normative.
>=20
>  OK.
>=20
>> -- 6, 2nd and 3rd paragraph:
>>=20
>> The RECOMMENDation to allow administrative entry of keys and to =
derive keys from a PRNG seem contradictory.
>=20
>  The idea is that admins shouldn't be entering "0xabababab" as a key.
> Instead, they get secure keys from a secure location.  People are
> notoriously bad at creating randomness.
>=20

So paragraph 3 is a requirement on the administrator, rather than on the =
implementor? Or do you mean to say the implementation should provide =
tools for random key generation?

[...]


>> -- 9
>>=20
>> Why not choose a new port? Is there absolute certainty this won't =
conflict with the previous usage? I do note that 6414 made the same =
choice, so I guess consistency with radius/TLS has some value. But that =
draft talks about compatibility between radsec and radius/tls, which is =
not mentioned here.
>=20
>  No one is using UDP/2083 for anything.  Re-using it is OK.

Does that mean that RadSec is not used at all by anyone? or that this =
draft is compatible with it?

[...]

>> -- 10.1, 3rd paragraph:
>>=20
>> It would be helpful to have guidance on how to match a certificate to =
a client or server identity,
>=20
>  I'll add a note to see RFC 6614 Section 2.5.

I see you added that to section 10.3, 3rd paragraph. But does that =
contradict the statement in 2.2.1 that 6614 section 2.5 does not apply =
to RADIUS/DTLS?

[...]


>> -- 10.2, 2nd paragraph:
>>=20
>> This is redundant with previous normative requirements. (Also =
contradictory, since the previous text said "SHOULD", and contradictory =
guidance on what to do when the limit is exceeded.)
>=20
>  I've fixed the text to be consistent.

The paragraph is still redundant with the new text in 5.1.1 (which says =
you MUST either drop old sessions or limit creation of new ones.)


>=20
>> -- 10.3, 4th paragraph:
>>=20
>> Does this need to be as strong as SHOULD? Is this likely to conflict =
with dynamic discovery, should it ever exist?
>=20
>  RADIUS is a critical piece of infrastructure.  Exposing your RADIUS
> server to the entire IPv4 range is a bad idea.

That's true of many protocols that don't have normative requirements =
about IP filtering. This is more an operational issue than an =
implementation one, and it may not be the best choice for all (or even =
most) deployments. There may be some advantage in filtering packets =
before they get to the DTLS layer, but IP filtering is trivial to =
defeat, and it has real administrative costs. For example, any peer =
network renumbering has to be coordinated across all of your RADIUS =
nodes.

I agree it makes sense to point out that IP filtering might be helpful. =
But I think a normative SHOULD is excessive.

>=20
>  The recommendation is a SHOULD so that it does not conflict with
> dynamic discovery.
>=20

If it stays normative, It would be worth mentioning that as an example =
of why it's a SHOULD rather than a MUST.

>> -- 10.3, 5th and 6th paragraphs:
>>=20
>> Paragraph 5 says credentials should be statically configured. To me, =
"credentials" means "the certificate" in this case. That seems to =
disallow things like statically configuring a name that must match a =
certificate (perhaps signed by a CA.)
>=20
>  Credentials for the client should be statically configured.  It could
> be a PSK, or a certificate.
>=20
>  I'm not sure what "name" would match a certificate.  The document
> doesn't refer to names, and doesn't use names for anything.

The whole point of a certificate is to bind a key pair to an identity =
(often, a name.)

Example: I enter the name "trusted-peer.example.com" in a table. If a =
(perhaps dynamically discovered) peer presents certificate with a CN or =
SAN that matches "trusted-peer.example.com", and that certificate is =
issued by a CA that I trust, then I trust that peer.=20

>=20
>> Paragraph 6 seems to entirely contradict paragraph 5 by recommending =
private CAs, and accepting any peer that presents a cert signed by that =
CA. That's pretty much the opposite of statically configured =
credentials. (Paragraph 8 also seems to contradict the static =
configuration part.)
>=20
>  Both client and server still need to be configured with the private
> CA.  The alternative is to allow anyone to connect with any =
credentials,
> which seems odd.
>=20

That's static configuration of your trusted CA(s). That's not the same =
thing as static configuration of peer credentials, and it doesn't imply =
the static relationship between clients and servers mentioned in =
paragraph 5.

[...]

>=20
>> -- 10.4:
>>=20
>> The guidance in the last paragraph does not make sense. The section =
seems to say that NATs will break radius/dtls, so you should use dtls =
when behind a NAT.
>=20
>  RADIUS/UDP clients should not be behind a NAT.  I'll clarify.

Do you mean RADIUS/UDP or RADIUS/DTLS? If the former, then that brings =
back the problem of making normative statements about the base protocol. =
Also, I'm still confused by the fact the the 2nd sentence of the last =
paragraph says "If clients are located behind a NAT gateway, then a =
secure transport such as DTLS MUST be used." Given that the previous =
paragraph seems to say that RADIUS/DTLS has issues over NAT, I'm =
surprised to see it listed as mitigating NATs.

>=20
>> -- 10.6, last paragraph:
>>=20
>> Can you elaborate on this? Why would an unauthorized 3rd party be =
able to get packets past the DTLS layer? OTOH, If an authorized client =
is sending invalid radius packets, wouldn't  you want to terminate the =
session?
>=20
>  That was a *long* discussion on the RADEXT list.
>=20
>  A server may be at protocol rev X, and a client may be at protocol =
rev
> X+1.  If the client sends packets allowed by X+1, the server should
> ignore them, as it does today with RADIUS/UDP.  Closing the connection
> is not necessary.

I think your previous answer about sending packets with the same 4-tuple =
answers this as well.

>=20
>> -- 10.7
>>=20
>> Redundant normative requirements (This is at least the third time the =
separate process issue and local proxy guidance has been described.)
>=20
>  It's a security considerations section, and needs to mention this.  =
It
> refers to Section 6.1, and adds new text explaining the security
> benefits of the approach.

I agree it should be reiterated, but not _normatively_. In generally, =
you don't want to have the same normative requirement stated more than =
once. It makes sense for the security consideration section to say =
something like "Section XX recommends that clients use a local proxy"  =
But it's best to avoid any language that obscures which bit of text is =
authoritative for a given normative requirement. (There can be only =
one...)

I also notice the language here also fails to account for the fact that =
the requirement only applies to clients implemented as multiple =
independent instances. This could be fixed by something really simple =
like saying "... such clients ..." instead of "... clients... " in the =
second paragraph.

>=20
>>=20
>>=20
>> *** Nits/editorial comments:
>>=20
>> -- IDNits reports some issues; please check.
>=20
>  They're fine.
>=20
>> -- Abstract:
>> Please avoid citations in the abstract. Please consider removing the =
"scare quotes".
>=20
>  OK.
>=20
>> -- Section 1, 5th paragraph:
>>=20
>> it seems like the RADIUS problems that this does not solve are in =
generally solved by RADIUS/TLS. If so, it would probably be worth a =
mention.
>=20
>  OK.
>=20
>> -- section 2.1, 4th paragraph from end:=20
>>=20
>> Seems like there are other changes as well. For example, you don't =
include "Use DTLS" as one of the changes in RADIUS/DTLS from RADIUS/USP.
>=20
>  OK.
>=20
>> -- 2.2 and children:
>>=20
>> In my strictly personal opinion, the approach of patching 6614 =
transfers a lot of effort from the author to the reader. A reader will =
basically need to keep both docs open side by side to understand this.  =
I understand the desire to avoid duplicating normative text, but I think =
that the balance here has swung too far away from readability.  (OTOH, =
see my related comment under "minor issues).
>=20
>  I think re-doing the document is a non-starter at this point.
>=20
>  Having done this myself, the bulk of the implementation work in doing
> DTLS is the UDP layer.  Most everything else can be re-used directly
> from RADIUS/TLS.
>=20

[...]

>> -- 5.1.1, 2nd paragraph:
>>=20
>> What is an "entry" session?
>=20
>  The 4-tuple is logically a table tracking (4-tuple) -> (session =
data).
> Each one is an entry.
>=20
>  I'll try to clarify the text.
>=20

I don't see a change in version 08. In particular, I'm confused by =
"Sessions (both 4-tuple and entry) ..." That sounds like you have two =
kinds of sessions, 4-tuple sessions and entry sessions. I think you mean =
something more like "Both the 4-tuple and the session table entry for a =
session ...." right?

>=20
>> -- 7:
>>=20
>> Only the first paragraph seems to be about implementation experience.
>=20
>  OK.

No change in version 08.
>=20

[...]

