On Oct 3, 2012, at 3:58 PM, Sam Hartman wrote: Sam,
> So, I'm a bit confused why we're discussing whether hop-by-hop integrity > is good enough. > That's been how RADIUS handles integrity for authorization attributes > all along. > Why does describing authorization in terms of XML make that different > than authorization described in native RADIUS attributes? > > No confidentiality and too many proxies is posing a problem for some > usecases that we're looking at deploying. I'm looking to RADSEC as a > solution to that for my clients. SAML signatures would not help with the > confidentiality issues. Also, since most of what I'd like to make > confidential is in RADIUS attributes not SAML, xml encryption wouldn't > help either. I think Stephen raises a valid point. Just pointing to the RADIUS hop-by-hop protection is a bit weak, after all there is potentially a lot more authorization data going over the wire compared to the simple network access case. I think it is fine to call out the hop-by-hop behaviour and, as you mention above, state that if you want direct peer to peer connections you'll have to do RadSec. Don't you think that that would decrease the likelihood of ill thought through deployments? I have seen a couple of weird uses of the eduroam trust fabric (not looking at you Josh ;-), so a bit of discussion around this topic would help. Klaas _______________________________________________ abfab mailing list [email protected] https://www.ietf.org/mailman/listinfo/abfab
