-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathrfc7360.html
1673 lines (1167 loc) · 81.6 KB
/
rfc7360.html
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<meta name="robots" content="index,follow" />
<meta name="creator" content="rfchandler version 0.2" />
<meta name="citation_author" content="A. DeKok"/>
<meta name="citation_publication_date" content="September, 2014"/>
<meta name="citation_title" content="Datagram Transport Layer Security (DTLS) as a Transport Layer for RADIUS"/>
<meta name="citation_doi" content="10.17487/RFC7360"/>
<meta name="citation_issn" content="2070-1721"/>
<meta name="citation_technical_report_number" content="rfc7360"/>
<meta name="citation_pdf_url" content="https://www.rfc-editor.org/rfc/pdfrfc/rfc7360.txt.pdf"/>
<title>RFC 7360: Datagram Transport Layer Security (DTLS) as a Transport Layer for RADIUS</title>
<style type="text/css">
@media only screen
and (min-width: 992px)
and (max-width: 1199px) {
body { font-size: 14pt; }
div.content { width: 96ex; margin: 0 auto; }
}
@media only screen
and (min-width: 768px)
and (max-width: 991px) {
body { font-size: 14pt; }
div.content { width: 96ex; margin: 0 auto; }
}
@media only screen
and (min-width: 480px)
and (max-width: 767px) {
body { font-size: 11pt; }
div.content { width: 96ex; margin: 0 auto; }
}
@media only screen
and (max-width: 479px) {
body { font-size: 8pt; }
div.content { width: 96ex; margin: 0 auto; }
}
@media only screen
and (min-device-width : 375px)
and (max-device-width : 667px) {
body { font-size: 9.5pt; }
div.content { width: 96ex; margin: 0; }
}
@media only screen
and (min-device-width: 1200px) {
body { font-size: 10pt; margin: 0 4em; }
div.content { width: 96ex; margin: 0; }
}
h1, h2, h3, h4, h5, h6, .h1, .h2, .h3, .h4, .h5, .h6 {
font-weight: bold;
/* line-height: 0pt; */
display: inline;
white-space: pre;
font-family: monospace;
font-size: 1em;
font-weight: bold;
}
pre {
font-size: 1em;
margin-top: 0px;
margin-bottom: 0px;
}
.pre {
white-space: pre;
font-family: monospace;
}
.header{
font-weight: bold;
}
.newpage {
page-break-before: always;
}
.invisible {
text-decoration: none;
color: white;
}
a.selflink {
color: black;
text-decoration: none;
}
@media print {
body {
font-family: monospace;
font-size: 10.5pt;
}
h1, h2, h3, h4, h5, h6 {
font-size: 1em;
}
a:link, a:visited {
color: inherit;
text-decoration: none;
}
.noprint {
display: none;
}
}
@media screen {
.grey, .grey a:link, .grey a:visited {
color: #777;
}
.docinfo {
background-color: #EEE;
}
.top {
border-top: 7px solid #EEE;
}
.bgwhite { background-color: white; }
.bgred { background-color: #F44; }
.bggrey { background-color: #666; }
.bgbrown { background-color: #840; }
.bgorange { background-color: #FA0; }
.bgyellow { background-color: #EE0; }
.bgmagenta{ background-color: #F4F; }
.bgblue { background-color: #66F; }
.bgcyan { background-color: #4DD; }
.bggreen { background-color: #4F4; }
.legend { font-size: 90%; }
.cplate { font-size: 70%; border: solid grey 1px; }
}
</style>
<!--[if IE]>
<style>
body {
font-size: 13px;
margin: 10px 10px;
}
</style>
<![endif]--> <script type="text/javascript"><!--
function addHeaderTags() {
var spans = document.getElementsByTagName("span");
for (var i=0; i < spans.length; i++) {
var elem = spans[i];
if (elem) {
var level = elem.getAttribute("class");
if (level == "h1" || level == "h2" || level == "h3" || level == "h4" || level == "h5" || level == "h6") {
elem.innerHTML = "<"+level+">"+elem.innerHTML+"</"+level+">";
}
}
}
}
var legend_html = "Colour legend:<br /> <table> <tr><td>Unknown:</td> <td><span class='cplate bgwhite'> </span></td></tr> <tr><td>Draft:</td> <td><span class='cplate bgred'> </span></td></tr> <tr><td>Informational:</td> <td><span class='cplate bgorange'> </span></td></tr> <tr><td>Experimental:</td> <td><span class='cplate bgyellow'> </span></td></tr> <tr><td>Best Common Practice:</td> <td><span class='cplate bgmagenta'> </span></td></tr> <tr><td>Proposed Standard:</td> <td><span class='cplate bgblue'> </span></td></tr> <tr><td>Draft Standard (old designation):</td> <td><span class='cplate bgcyan'> </span></td></tr> <tr><td>Internet Standard:</td> <td><span class='cplate bggreen'> </span></td></tr> <tr><td>Historic:</td> <td><span class='cplate bggrey'> </span></td></tr> <tr><td>Obsolete:</td> <td><span class='cplate bgbrown'> </span></td></tr> </table>";
function showElem(id) {
var elem = document.getElementById(id);
elem.innerHTML = eval(id+"_html");
elem.style.visibility='visible';
}
function hideElem(id) {
var elem = document.getElementById(id);
elem.style.visibility='hidden';
elem.innerHTML = "";
}
// -->
</script></head>
<body>
<span class="pre noprint docinfo">[<a href="https://www.rfc-editor.org" title="RFC Editor">RFC Home</a>] [<a href="/rfc/rfc7360.txt">TEXT</a>|<a href="/rfc/pdfrfc/rfc7360.txt.pdf">PDF</a>|<a href="/rfc/rfc7360.html">HTML</a>] [<a href='https://datatracker.ietf.org/doc/rfc7360' title='IETF Datatracker information for this document'>Tracker</a>] [<a href="https://datatracker.ietf.org/ipr/search/?rfc=7360&submit=rfc" title="IPR disclosures related to this document">IPR</a>] [<a href='https://www.rfc-editor.org/info/rfc7360' title='Info page'>Info page</a>] </span><br/><span class="pre noprint docinfo"> </span><br /><span class="pre noprint docinfo"> EXPERIMENTAL</span><br /><span class="pre noprint docinfo"> </span><pre>Internet Engineering Task Force (IETF) A. DeKok
Request for Comments: 7360 FreeRADIUS
Category: Experimental September 2014
ISSN: 2070-1721
<span class="h1">Datagram Transport Layer Security (DTLS)</span>
<span class="h1">as a Transport Layer for RADIUS</span>
Abstract
The RADIUS protocol defined in <a href="./rfc2865">RFC 2865</a> has limited support for
authentication and encryption of RADIUS packets. The protocol
transports data in the clear, although some parts of the packets can
have obfuscated content. Packets may be replayed verbatim by an
attacker, and client-server authentication is based on fixed shared
secrets. This document specifies how the Datagram Transport Layer
Security (DTLS) protocol may be used as a fix for these problems. It
also describes how implementations of this proposal can coexist with
current RADIUS systems.
Status of This Memo
This document is not an Internet Standards Track specification; it is
published for examination, experimental implementation, and
evaluation.
This document defines an Experimental Protocol for the Internet
community. This document is a product of the Internet Engineering
Task Force (IETF). It represents the consensus of the IETF
community. It has received public review and has been approved for
publication by the Internet Engineering Steering Group (IESG). Not
all documents approved by the IESG are a candidate for any level of
Internet Standard; see <a href="./rfc5741#section-2">Section 2 of RFC 5741</a>.
Information about the current status of this document, any errata,
and how to provide feedback on it may be obtained at
<a href="https://www.rfc-editor.org/info/rfc7360">http://www.rfc-editor.org/info/rfc7360</a>.
<span class="grey">DeKok Experimental [Page 1]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-2" ></span>
<span class="grey"><a href="./rfc7360">RFC 7360</a> DTLS as a Transport Layer for RADIUS September 2014</span>
Copyright Notice
Copyright (c) 2014 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to <a href="https://www.rfc-editor.org/bcp/bcp78">BCP 78</a> and the IETF Trust's Legal
Provisions Relating to IETF Documents
(<a href="http://trustee.ietf.org/license-info">http://trustee.ietf.org/license-info</a>) in effect on the date of
publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must
include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License.
<span class="grey">DeKok Experimental [Page 2]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-3" ></span>
<span class="grey"><a href="./rfc7360">RFC 7360</a> DTLS as a Transport Layer for RADIUS September 2014</span>
Table of Contents
<a href="#section-1">1</a>. Introduction ....................................................<a href="#page-4">4</a>
<a href="#section-1.1">1.1</a>. Terminology ................................................<a href="#page-5">5</a>
<a href="#section-1.2">1.2</a>. Requirements Language ......................................<a href="#page-5">5</a>
<a href="#section-1.3">1.3</a>. Document Status ............................................<a href="#page-5">5</a>
<a href="#section-2">2</a>. Building on Existing Foundations ................................<a href="#page-6">6</a>
<a href="#section-2.1">2.1</a>. Changes to RADIUS ..........................................<a href="#page-7">7</a>
<a href="#section-2.2">2.2</a>. Similarities with RADIUS/TLS ...............................<a href="#page-8">8</a>
<a href="#section-2.2.1">2.2.1</a>. Changes from RADIUS/TLS to RADIUS/DTLS ..............<a href="#page-8">8</a>
<a href="#section-3">3</a>. Interaction with RADIUS/UDP .....................................<a href="#page-9">9</a>
<a href="#section-3.1">3.1</a>. DTLS Port and Packet Types ................................<a href="#page-10">10</a>
<a href="#section-3.2">3.2</a>. Server Behavior ...........................................<a href="#page-10">10</a>
<a href="#section-4">4</a>. Client Behavior ................................................<a href="#page-11">11</a>
<a href="#section-5">5</a>. Session Management .............................................<a href="#page-12">12</a>
<a href="#section-5.1">5.1</a>. Server Session Management .................................<a href="#page-12">12</a>
<a href="#section-5.1.1">5.1.1</a>. Session Opening and Closing ........................<a href="#page-13">13</a>
<a href="#section-5.2">5.2</a>. Client Session Management .................................<a href="#page-15">15</a>
<a href="#section-6">6</a>. Implementation Guidelines ......................................<a href="#page-16">16</a>
<a href="#section-6.1">6.1</a>. Client Implementations ....................................<a href="#page-17">17</a>
<a href="#section-6.2">6.2</a>. Server Implementations ....................................<a href="#page-18">18</a>
<a href="#section-7">7</a>. Diameter Considerations ........................................<a href="#page-18">18</a>
<a href="#section-8">8</a>. IANA Considerations ............................................<a href="#page-18">18</a>
<a href="#section-9">9</a>. Implementation Status ..........................................<a href="#page-18">18</a>
<a href="#section-9.1">9.1</a>. Radsecproxy ...............................................<a href="#page-19">19</a>
<a href="#section-9.2">9.2</a>. jradius ...................................................<a href="#page-19">19</a>
<a href="#section-10">10</a>. Security Considerations .......................................<a href="#page-19">19</a>
<a href="#section-10.1">10.1</a>. Crypto-Agility ...........................................<a href="#page-20">20</a>
<a href="#section-10.2">10.2</a>. Legacy RADIUS Security ...................................<a href="#page-21">21</a>
<a href="#section-10.3">10.3</a>. Resource Exhaustion ......................................<a href="#page-22">22</a>
<a href="#section-10.4">10.4</a>. Client-Server Authentication with DTLS ...................<a href="#page-22">22</a>
<a href="#section-10.5">10.5</a>. Network Address Translation ..............................<a href="#page-24">24</a>
<a href="#section-10.6">10.6</a>. Wildcard Clients .........................................<a href="#page-24">24</a>
<a href="#section-10.7">10.7</a>. Session Closing ..........................................<a href="#page-25">25</a>
<a href="#section-10.8">10.8</a>. Client Subsystems ........................................<a href="#page-25">25</a>
<a href="#section-11">11</a>. References ....................................................<a href="#page-26">26</a>
<a href="#section-11.1">11.1</a>. Normative References .....................................<a href="#page-26">26</a>
<a href="#section-11.2">11.2</a>. Informative References ...................................<a href="#page-27">27</a>
Acknowledgments ...................................................<a href="#page-27">27</a>
<span class="grey">DeKok Experimental [Page 3]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-4" ></span>
<span class="grey"><a href="./rfc7360">RFC 7360</a> DTLS as a Transport Layer for RADIUS September 2014</span>
<span class="h2"><a class="selflink" id="section-1" href="#section-1">1</a>. Introduction</span>
The RADIUS protocol as described in [<a href="./rfc2865" title=""Remote Authentication Dial In User Service (RADIUS)"">RFC2865</a>], [<a href="./rfc2866" title=""RADIUS Accounting"">RFC2866</a>], [<a href="./rfc5176" title=""Dynamic Authorization Extensions to Remote Authentication Dial In User Service (RADIUS)"">RFC5176</a>],
and others has traditionally used methods based on MD5 [<a href="./rfc1321" title=""The MD5 Message-Digest Algorithm"">RFC1321</a>] for
per-packet authentication and integrity checks. However, the MD5
algorithm has known weaknesses such as [<a href="#ref-MD5Attack" title=""The Status of MD5 After a Recent Attack"">MD5Attack</a>] and [<a href="#ref-MD5Break" title=""How to Break MD5 and Other Hash Functions"">MD5Break</a>].
As a result, some specifications, such as [<a href="./rfc5176" title=""Dynamic Authorization Extensions to Remote Authentication Dial In User Service (RADIUS)"">RFC5176</a>], have recommended
using IPsec to secure RADIUS traffic.
While RADIUS over IPsec has been widely deployed, there are
difficulties with this approach. The simplest point against IPsec is
that there is no straightforward way for an application to control or
monitor the network security policies. That is, the requirement that
the RADIUS traffic be encrypted and/or authenticated is implicit in
the network configuration, and it cannot be enforced by the RADIUS
application.
This specification takes a different approach. We define a method
for using DTLS [<a href="./rfc6347" title=""Datagram Transport Layer Security Version 1.2"">RFC6347</a>] as a RADIUS transport protocol. This
approach has the benefit that the RADIUS application can directly
monitor and control the security policies associated with the traffic
that it processes.
Another benefit is that RADIUS over DTLS continues to be a UDP-based
protocol. The change from RADIUS/UDP is largely to add DTLS support,
and make any necessary related changes to RADIUS. This allows
implementations to remain UDP based, without changing to a TCP
architecture.
This specification does not, however, solve all of the problems
associated with RADIUS/UDP. The DTLS protocol does not add reliable
or in-order transport to RADIUS. DTLS also does not support
fragmentation of application-layer messages, or of the DTLS messages
themselves. This specification therefore shares with traditional
RADIUS the issues of order, reliability, and fragmentation. These
issues are dealt with in RADIUS/TCP [<a href="./rfc6613" title=""RADIUS over TCP"">RFC6613</a>] and RADIUS/TLS
[<a href="./rfc6614" title=""Transport Layer Security (TLS) Encryption for RADIUS"">RFC6614</a>].
<span class="grey">DeKok Experimental [Page 4]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-5" ></span>
<span class="grey"><a href="./rfc7360">RFC 7360</a> DTLS as a Transport Layer for RADIUS September 2014</span>
<span class="h3"><a class="selflink" id="section-1.1" href="#section-1.1">1.1</a>. Terminology</span>
This document uses the following terms:
RADIUS/DTLS
This term is a shorthand for "RADIUS over DTLS".
RADIUS/DTLS client
This term refers both to RADIUS clients as defined in [<a href="./rfc2865" title=""Remote Authentication Dial In User Service (RADIUS)"">RFC2865</a>]
and to Dynamic Authorization clients as defined in [<a href="./rfc5176" title=""Dynamic Authorization Extensions to Remote Authentication Dial In User Service (RADIUS)"">RFC5176</a>] that
implement RADIUS/DTLS.
RADIUS/DTLS server
This term refers both to RADIUS servers as defined in [<a href="./rfc2865" title=""Remote Authentication Dial In User Service (RADIUS)"">RFC2865</a>]
and to Dynamic Authorization servers as defined in [<a href="./rfc5176" title=""Dynamic Authorization Extensions to Remote Authentication Dial In User Service (RADIUS)"">RFC5176</a>] that
implement RADIUS/DTLS.
RADIUS/UDP
RADIUS over UDP, as defined in [<a href="./rfc2865" title=""Remote Authentication Dial In User Service (RADIUS)"">RFC2865</a>].
RADIUS/TLS
RADIUS over TLS, as defined in [<a href="./rfc6614" title=""Transport Layer Security (TLS) Encryption for RADIUS"">RFC6614</a>].
silently discard
This means that the implementation discards the packet without
further processing.
<span class="h3"><a class="selflink" id="section-1.2" href="#section-1.2">1.2</a>. Requirements Language</span>
In this document, several words are used to signify the requirements
of the specification. The key words "MUST", "MUST NOT", "REQUIRED",
"SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT
RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be
interpreted as described in [<a href="./rfc2119" title=""Key words for use in RFCs to Indicate Requirement Levels"">RFC2119</a>].
<span class="h3"><a class="selflink" id="section-1.3" href="#section-1.3">1.3</a>. Document Status</span>
This document is an Experimental RFC.
It contains one of several approaches to address known cryptographic
weaknesses of the RADIUS protocol, such as described in [<a href="./rfc6614" title=""Transport Layer Security (TLS) Encryption for RADIUS"">RFC6614</a>].
This specification does not fulfill all recommendations for an
Authentication, Authorization, and Accounting (AAA) transport profile
as per [<a href="./rfc3539" title=""Authentication, Authorization and Accounting (AAA) Transport Profile"">RFC3539</a>]; however, unlike [<a href="./rfc6614" title=""Transport Layer Security (TLS) Encryption for RADIUS"">RFC6614</a>], it is based on UDP and
therefore does not have head-of-line blocking issues.
<span class="grey">DeKok Experimental [Page 5]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-6" ></span>
<span class="grey"><a href="./rfc7360">RFC 7360</a> DTLS as a Transport Layer for RADIUS September 2014</span>
If this specification is indeed selected for advancement to Standards
Track, certificate verification options (<a href="./rfc6614#section-2.3">[RFC6614], Section 2.3</a>,
point 2) will need to be refined.
Another experimental characteristic of this specification is the
question of key management between RADIUS/DTLS peers. RADIUS/UDP
only allowed for manual key management, i.e., distribution of a
shared secret between a client and a server. RADIUS/DTLS allows
manual distribution of long-term proofs of peer identity, by using
TLS-PSK ciphersuites. RADIUS/DTLS also allows the use of X.509
certificates in a PKIX infrastructure. It remains to be seen if one
of these methods will prevail or if both will find their place in
real-life deployments. The authors can imagine pre-shared keys
(PSKs) to be popular in small-scale deployments (Small Office, Home
Office (SOHO) or isolated enterprise deployments) where scalability
is not an issue and the deployment of a Certification Authority (CA)
is considered too much of a hassle; however, the authors can also
imagine large roaming consortia to make use of PKIX. Readers of this
specification are encouraged to read the discussion of key management
issues within [<a href="./rfc6421" title=""Crypto-Agility Requirements for Remote Authentication Dial-In User Service (RADIUS)"">RFC6421</a>] as well as [<a href="./rfc4107" title=""Guidelines for Cryptographic Key Management"">RFC4107</a>].
It has yet to be decided whether this approach is to be chosen for
Standards Track. One key aspect to judge whether the approach is
usable on a large scale is by observing the uptake, usability, and
operational behavior of the protocol in large-scale, real-life
deployments.
<span class="h2"><a class="selflink" id="section-2" href="#section-2">2</a>. Building on Existing Foundations</span>
Adding DTLS as a RADIUS transport protocol requires a number of
changes to systems implementing standard RADIUS. This section
outlines those changes, and defines new behaviors necessary to
implement DTLS.
<span class="grey">DeKok Experimental [Page 6]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-7" ></span>
<span class="grey"><a href="./rfc7360">RFC 7360</a> DTLS as a Transport Layer for RADIUS September 2014</span>
<span class="h3"><a class="selflink" id="section-2.1" href="#section-2.1">2.1</a>. Changes to RADIUS</span>
The RADIUS packet format is unchanged from [<a href="./rfc2865" title=""Remote Authentication Dial In User Service (RADIUS)"">RFC2865</a>], [<a href="./rfc2866" title=""RADIUS Accounting"">RFC2866</a>], and
[<a href="./rfc5176" title=""Dynamic Authorization Extensions to Remote Authentication Dial In User Service (RADIUS)"">RFC5176</a>]. Specifically, all of the following portions of RADIUS
MUST be unchanged when using RADIUS/DTLS:
* Packet format
* Permitted codes
* Request Authenticator calculation
* Response Authenticator calculation
* Minimum packet length
* Maximum packet length
* Attribute format
* Vendor-Specific Attribute (VSA) format
* Permitted data types
* Calculations of dynamic attributes such as CHAP-Challenge, or
Message-Authenticator.
* Calculation of "obfuscated" attributes such as User-Password and
Tunnel-Password.
In short, the application creates a RADIUS packet via the usual
methods, and then instead of sending it over a UDP socket, sends the
packet to a DTLS layer for encapsulation. DTLS then acts as a
transport layer for RADIUS: hence, the names "RADIUS/UDP" and
"RADIUS/DTLS".
The requirement that RADIUS remain largely unchanged ensures the
simplest possible implementation and widest interoperability of this
specification.
We note that the DTLS encapsulation of RADIUS means that RADIUS
packets have an additional overhead due to DTLS. Implementations
MUST support sending and receiving encapsulated RADIUS packets of
4096 octets in length, with a corresponding increase in the maximum
size of the encapsulated DTLS packets. This larger packet size may
cause the packet to be larger than the Path MTU (PMTU), where a
RADIUS/UDP packet may be smaller. See <a href="#section-5.2">Section 5.2</a>, below, for more
discussion.
<span class="grey">DeKok Experimental [Page 7]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-8" ></span>
<span class="grey"><a href="./rfc7360">RFC 7360</a> DTLS as a Transport Layer for RADIUS September 2014</span>
The only changes made from RADIUS/UDP to RADIUS/DTLS are the
following two items:
(1) The Length checks defined in <a href="./rfc2865#section-3">[RFC2865], Section 3</a>, MUST use the
length of the decrypted DTLS data instead of the UDP packet
length. They MUST treat any decrypted DTLS data octets outside
the range of the Length field as padding and ignore it on
reception.
(2) The shared secret used to compute the MD5 integrity checks and
the attribute encryption MUST be "radius/dtls".
All other aspects of RADIUS are unchanged.
<span class="h3"><a class="selflink" id="section-2.2" href="#section-2.2">2.2</a>. Similarities with RADIUS/TLS</span>
While this specification can be thought of as RADIUS/TLS over UDP
instead of the Transmission Control Protocol (TCP), there are some
differences between the two methods. The bulk of [<a href="./rfc6614" title=""Transport Layer Security (TLS) Encryption for RADIUS"">RFC6614</a>] applies
to this specification, so we do not repeat it here.
This section explains the differences between RADIUS/TLS and
RADIUS/DTLS, as semantic "patches" to [<a href="./rfc6614" title=""Transport Layer Security (TLS) Encryption for RADIUS"">RFC6614</a>]. The changes are as
follows:
* We replace references to "TCP" with "UDP"
* We replace references to "RADIUS/TLS" with "RADIUS/DTLS"
* We replace references to "TLS" with "DTLS"
Those changes are sufficient to cover the majority of the differences
between the two specifications. The next section reviews some more
detailed changes from [<a href="./rfc6614" title=""Transport Layer Security (TLS) Encryption for RADIUS"">RFC6614</a>], giving additional commentary only
where necessary.
<span class="h4"><a class="selflink" id="section-2.2.1" href="#section-2.2.1">2.2.1</a>. Changes from RADIUS/TLS to RADIUS/DTLS</span>
This section describes how particular sections of [<a href="./rfc6614" title=""Transport Layer Security (TLS) Encryption for RADIUS"">RFC6614</a>] apply to
RADIUS/DTLS.
<a href="#section-2.1">Section 2.1</a> applies to RADIUS/DTLS, with the exception that the
RADIUS/DTLS port is UDP/2083.
<a href="#section-2.2">Section 2.2</a> applies to RADIUS/DTLS. Servers and clients need to be
pre-configured to use RADIUS/DTLS for a given endpoint.
<span class="grey">DeKok Experimental [Page 8]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-9" ></span>
<span class="grey"><a href="./rfc7360">RFC 7360</a> DTLS as a Transport Layer for RADIUS September 2014</span>
Most of <a href="#section-2.3">Section 2.3</a> applies also to RADIUS/DTLS. Item (1) should be
interpreted as applying to DTLS session initiation, instead of TCP
connection establishment. Item (2) applies, except for the
recommendation that implementations "SHOULD" support
TLS_RSA_WITH_RC4_128_SHA. This recommendation is a historical
artifact of RADIUS/TLS, and it does not apply to RADIUS/DTLS. Item
(3) applies to RADIUS/DTLS. Item (4) applies, except that the fixed
shared secret is "radius/dtls", as described above.
<a href="#section-2.4">Section 2.4</a> applies to RADIUS/DTLS. Client identities SHOULD be
determined from DTLS parameters, instead of relying solely on the
source IP address of the packet.
<a href="#section-2.5">Section 2.5</a> does not apply to RADIUS/DTLS. The relationship between
RADIUS packet codes and UDP ports in RADIUS/DTLS is unchanged from
RADIUS/UDP.
Sections <a href="#section-3.1">3.1</a>, <a href="#section-3.2">3.2</a>, and <a href="#section-3.3">3.3</a> apply to RADIUS/DTLS.
<a href="#section-3.4">Section 3.4</a> item (1) does not apply to RADIUS/DTLS. Each RADIUS
packet is encapsulated in one DTLS packet, and there is no "stream"
of RADIUS packets inside of a TLS session. Implementors MUST enforce
the requirements of <a href="./rfc2865#section-3">[RFC2865], Section 3</a>, for the RADIUS Length
field, using the length of the decrypted DTLS data for the checks.
This check replaces the RADIUS method of using the Length field from
the UDP packet.
<a href="#section-3.4">Section 3.4</a> items (2), (3), (4), and (5) apply to RADIUS/DTLS.
<a href="#section-4">Section 4</a> does not apply to RADIUS/DTLS. Protocol compatibility
considerations are defined in this document.
<a href="#section-6">Section 6</a> applies to RADIUS/DTLS.
<span class="h2"><a class="selflink" id="section-3" href="#section-3">3</a>. Interaction with RADIUS/UDP</span>
Transitioning to DTLS is a process that needs to be done carefully.
A poorly handled transition is complex for administrators and
potentially subject to security downgrade attacks. It is not
sufficient to just disable RADIUS/UDP and enable RADIUS/DTLS. RADIUS
has no provisions for protocol negotiation, so simply disabling
RADIUS/UDP would result in timeouts, lost traffic, and network
instabilities.
The end result of this specification is that nearly all RADIUS/UDP
implementations should transition to using a secure alternative. In
some cases, RADIUS/UDP may remain where IPsec is used as a transport,
or where implementation and/or business reasons preclude a change.
<span class="grey">DeKok Experimental [Page 9]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-10" ></span>
<span class="grey"><a href="./rfc7360">RFC 7360</a> DTLS as a Transport Layer for RADIUS September 2014</span>
However, we do not recommend long-term use of RADIUS/UDP outside of
isolated and secure networks.
This section describes how clients and servers should use
RADIUS/DTLS, and how it interacts with RADIUS/UDP.
<span class="h3"><a class="selflink" id="section-3.1" href="#section-3.1">3.1</a>. DTLS Port and Packet Types</span>
The default destination port number for RADIUS/DTLS is UDP/2083.
There are no separate ports for authentication, accounting, and
dynamic authorization changes. The source port is arbitrary. The
text in <a href="./rfc6614#section-3.4">[RFC6614], Section 3.4</a>, describes issues surrounding the use
of one port for multiple packet types. We recognize that
implementations may allow the use of RADIUS/DTLS over non-standard
ports. In that case, the references to UDP/2083 in this document
should be read as applying to any port used for transport of
RADIUS/DTLS traffic.
<span class="h3"><a class="selflink" id="section-3.2" href="#section-3.2">3.2</a>. Server Behavior</span>
When a server receives packets on UDP/2083, all packets MUST be
treated as being DTLS. RADIUS/UDP packets MUST NOT be accepted on
this port.
Servers MUST NOT accept DTLS packets on the old RADIUS/UDP ports.
Early versions of this specification permitted this behavior. It is
forbidden here, as it depended on behavior in DTLS that may change
without notice.
Servers MUST authenticate clients. RADIUS is designed to be used by
mutually trusted systems. Allowing anonymous clients would ensure
privacy for RADIUS/DTLS traffic, but would negate all other security
aspects of the protocol.
As RADIUS has no provisions for capability signaling, there is no way
for a server to indicate to a client that it should transition to
using DTLS. This action has to be taken by the administrators of the
two systems, using a method other than RADIUS. This method will
likely be out of band, or manual configuration will need to be used.
Some servers maintain a list of allowed clients per destination port.
Others maintain a global list of clients that are permitted to send
packets to any port. Where a client can send packets to multiple
ports, the server MUST maintain a "DTLS Required" flag per client.
This flag indicates whether or not the client is required to use
DTLS. When set, the flag indicates that the only traffic accepted
from the client is over UDP/2083. When packets are received from a
<span class="grey">DeKok Experimental [Page 10]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-11" ></span>
<span class="grey"><a href="./rfc7360">RFC 7360</a> DTLS as a Transport Layer for RADIUS September 2014</span>
client on non-DTLS ports, for which DTLS is required, the server MUST
silently discard these packets, as there is no RADIUS/UDP shared
secret available.
This flag will often be set by an administrator. However, if a
server receives DTLS traffic from a client, it SHOULD notify the
administrator that DTLS is available for that client. It MAY mark
the client as "DTLS Required".
It is RECOMMENDED that servers support the following Perfect Forward
Secrecy (PFS) ciphersuites:
o TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
o TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
Allowing RADIUS/UDP and RADIUS/DTLS from the same client exposes the
traffic to downbidding attacks and is NOT RECOMMENDED.
<span class="h2"><a class="selflink" id="section-4" href="#section-4">4</a>. Client Behavior</span>
When a client sends packets to the assigned RADIUS/DTLS port, all
packets MUST be DTLS. RADIUS/UDP packets MUST NOT be sent to this
port.
Clients MUST authenticate themselves to servers via credentials that
are unique to each client.
It is RECOMMENDED that clients support the following PFS
ciphersuites:
o TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
o TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
RADIUS/DTLS clients SHOULD NOT probe servers to see if they support
DTLS transport. Instead, clients SHOULD use DTLS as a transport
layer only when administratively configured. If a client is
configured to use DTLS and the server appears to be unresponsive, the
client MUST NOT fall back to using RADIUS/UDP. Instead, the client
should treat the server as being down.
RADIUS clients often had multiple independent RADIUS implementations
and/or processes that originate packets. This practice was simple to
implement, but the result is that each independent subsystem must
independently discover network issues or server failures. It is
therefore RECOMMENDED that clients with multiple internal RADIUS
sources use a local proxy as described in <a href="#section-6.1">Section 6.1</a>, below.
<span class="grey">DeKok Experimental [Page 11]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-12" ></span>
<span class="grey"><a href="./rfc7360">RFC 7360</a> DTLS as a Transport Layer for RADIUS September 2014</span>
Clients may implement "pools" of servers for fail-over or load-
balancing. These pools SHOULD NOT mix RADIUS/UDP and RADIUS/DTLS
servers.
<span class="h2"><a class="selflink" id="section-5" href="#section-5">5</a>. Session Management</span>
Where [<a href="./rfc6614" title=""Transport Layer Security (TLS) Encryption for RADIUS"">RFC6614</a>] can rely on the TCP state machine to perform session
tracking, this specification cannot. As a result, implementations of
this specification may need to perform session management of the DTLS
session in the application layer. This section describes logically
how this tracking is done. Implementations may choose to use the
method described here, or another, equivalent method.
We note that <a href="./rfc5080#section-2.2.2">[RFC5080], Section 2.2.2</a>, already mandates a duplicate
detection cache. The session tracking described below can be seen as
an extension of that cache, where entries contain DTLS sessions
instead of RADIUS/UDP packets.
<a href="./rfc5080#section-2.2.2">[RFC5080], Section 2.2.2</a>, describes how duplicate RADIUS/UDP requests
result in the retransmission of a previously cached RADIUS/UDP
response. Due to DTLS sequence window requirements, a server MUST
NOT retransmit a previously sent DTLS packet. Instead, it should
cache the RADIUS response packet, and re-process it through DTLS to
create a new RADIUS/DTLS packet, every time it is necessary to
retransmit a RADIUS response.
<span class="h3"><a class="selflink" id="section-5.1" href="#section-5.1">5.1</a>. Server Session Management</span>
A RADIUS/DTLS server MUST track ongoing DTLS sessions for each, based
on the following 4-tuple:
* source IP address
* source port
* destination IP address
* destination port
Note that this 4-tuple is independent of IP address version (IPv4 or
IPv6).
<span class="grey">DeKok Experimental [Page 12]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-13" ></span>
<span class="grey"><a href="./rfc7360">RFC 7360</a> DTLS as a Transport Layer for RADIUS September 2014</span>
Each 4-tuple points to a unique session entry, which usually contains
the following information:
DTLS Session
Any information required to maintain and manage the DTLS session.
Last Traffic
A variable containing a timestamp that indicates when this session
last received valid traffic. If "Last Traffic" is not used, this
variable may not exist.
DTLS Data
An implementation-specific variable that may contain information
about the active DTLS session. This variable may be empty or
nonexistent.
This data will typically contain information such as idle
timeouts, session lifetimes, and other implementation-specific
data.
<span class="h4"><a class="selflink" id="section-5.1.1" href="#section-5.1.1">5.1.1</a>. Session Opening and Closing</span>
Session tracking is subject to Denial-of-Service (DoS) attacks due to
the ability of an attacker to forge UDP traffic. RADIUS/DTLS servers
SHOULD use the stateless cookie tracking technique described in
<a href="./rfc6347#section-4.2.1">[RFC6347], Section 4.2.1</a>. DTLS sessions SHOULD NOT be tracked until
a ClientHello packet has been received with an appropriate Cookie
value. Server implementation SHOULD have a way of tracking DTLS
sessions that are partially set up. Servers MUST limit both the
number and impact on resources of partial sessions.
Sessions (both 4-tuple and entry) MUST be deleted when a TLS Closure
Alert (<a href="./rfc5246#section-7.2.1">[RFC5246], Section 7.2.1</a>) or a fatal TLS Error Alert
(<a href="./rfc5246#section-7.2.2">[RFC5246], Section 7.2.2</a>) is received. When a session is deleted
due to it failing security requirements, the DTLS session MUST be
closed, any TLS session resumption parameters for that session MUST
be discarded, and all tracking information MUST be deleted.
Sessions MUST also be deleted when a RADIUS packet fails validation
due to a packet being malformed, or when it has an invalid Message-
Authenticator or invalid Request Authenticator. There are other
cases when the specifications require that a packet received via a
DTLS session be "silently discarded". In those cases,
implementations MAY delete the underlying session as described above.
There are few reasons to communicate with a Network Access Server
(NAS) that is not implementing RADIUS.
<span class="grey">DeKok Experimental [Page 13]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-14" ></span>
<span class="grey"><a href="./rfc7360">RFC 7360</a> DTLS as a Transport Layer for RADIUS September 2014</span>
A session MUST be deleted when non-RADIUS traffic is received over
it. This specification is for RADIUS, and there is no reason to
allow non-RADIUS traffic over a RADIUS/DTLS session. A session MUST
be deleted when RADIUS traffic fails to pass security checks. There
is no reason to permit insecure networks. A session SHOULD NOT be
deleted when a well-formed, but "unexpected", RADIUS packet is
received over it. Future specifications may extend RADIUS/DTLS, and
we do not want to forbid those specifications.
The goal of the above requirements is to ensure security, while
maintaining flexibility. Any security-related issue causes the
connection to be closed. After the security restrictions have been
applied, any unexpected traffic may be safely ignored, as it cannot
cause a security issue. There is no need to close the session for
unexpected but valid traffic, and the session can safely remain open.
Once a DTLS session is established, a RADIUS/DTLS server SHOULD use
DTLS Heartbeats [<a href="./rfc6520" title=""Transport Layer Security (TLS) and Datagram Transport Layer Security (DTLS) Heartbeat Extension"">RFC6520</a>] to determine connectivity between the two
servers. A server SHOULD also use watchdog packets from the client
to determine that the session is still active.
As UDP does not guarantee delivery of messages, RADIUS/DTLS servers
that do not implement an application-layer watchdog MUST also
maintain a "Last Traffic" timestamp per DTLS session. The
granularity of this timestamp is not critical and could be limited to
one-second intervals. The timestamp SHOULD be updated on reception
of a valid RADIUS/DTLS packet, or a DTLS Heartbeat, but no more than
once per interval. The timestamp MUST NOT be updated in other
situations.
When a session has not received a packet for a period of time, it is
labeled "idle". The server SHOULD delete idle DTLS sessions after an
"idle timeout". The server MAY cache the TLS session parameters, in
order to provide for fast session resumption.
This session "idle timeout" SHOULD be exposed to the administrator as
a configurable setting. It SHOULD NOT be set to less than 60 seconds
and SHOULD NOT be set to more than 600 seconds (10 minutes). The
minimum useful value for this timer is determined by the application-
layer watchdog mechanism defined in the following section.
RADIUS/DTLS servers SHOULD also monitor the total number of open
sessions. They SHOULD have a "maximum sessions" setting exposed to
administrators as a configurable parameter. When this maximum is
reached and a new session is started, the server MUST either drop an
old session in order to open the new one or not create a new session.
<span class="grey">DeKok Experimental [Page 14]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-15" ></span>
<span class="grey"><a href="./rfc7360">RFC 7360</a> DTLS as a Transport Layer for RADIUS September 2014</span>
RADIUS/DTLS servers SHOULD implement session resumption, preferably
stateless session resumption as given in [<a href="./rfc5077" title=""Transport Layer Security (TLS) Session Resumption without Server-Side State"">RFC5077</a>]. This practice
lowers the time and effort required to start a DTLS session with a
client and increases network responsiveness.
Since UDP is stateless, the potential exists for the client to
initiate a new DTLS session using a particular 4-tuple, before the
server has closed the old session. For security reasons, the server
MUST keep the old session active until either it has received secure
notification from the client that the session is closed or the server
decides to close the session based on idle timeouts. Taking any
other action would permit unauthenticated clients to perform a DoS
attack, by reusing a 4-tuple and thus causing the server to close an
active (and authenticated) DTLS session.
As a result, servers MUST ignore any attempts to reuse an existing
4-tuple from an active session. This requirement can likely be
reached by simply processing the packet through the existing session,
as with any other packet received via that 4-tuple. Non-compliant,
or unexpected packets will be ignored by the DTLS layer.
The above requirement is mitigated by the suggestion in <a href="#section-6.1">Section 6.1</a>,
below, that the client use a local proxy for all RADIUS traffic.
That proxy can then track the ports that it uses and ensure that
reuse of 4-tuples is avoided. The exact process by which this
tracking is done is outside of the scope of this document.
<span class="h3"><a class="selflink" id="section-5.2" href="#section-5.2">5.2</a>. Client Session Management</span>
Clients SHOULD use PMTU discovery [<a href="./rfc6520" title=""Transport Layer Security (TLS) and Datagram Transport Layer Security (DTLS) Heartbeat Extension"">RFC6520</a>] to determine the PMTU
between the client and server, prior to sending any RADIUS traffic.
Once a DTLS session is established, a RADIUS/DTLS client SHOULD use
DTLS Heartbeats [<a href="./rfc6520" title=""Transport Layer Security (TLS) and Datagram Transport Layer Security (DTLS) Heartbeat Extension"">RFC6520</a>] to determine connectivity between the two
systems. RADIUS/DTLS clients SHOULD also use the application-layer
watchdog algorithm defined in [<a href="./rfc3539" title=""Authentication, Authorization and Accounting (AAA) Transport Profile"">RFC3539</a>] to determine server
responsiveness. The Status-Server packet defined in [<a href="./rfc5997" title=""Use of Status-Server Packets in the Remote Authentication Dial In User Service (RADIUS) Protocol"">RFC5997</a>] SHOULD
be used as the "watchdog packet" in any application-layer watchdog
algorithm.
RADIUS/DTLS clients SHOULD proactively close sessions when they have
been idle for a period of time. Clients SHOULD close a session when
the DTLS Heartbeat algorithm indicates that the session is no longer
active. Clients SHOULD close a session when no traffic other than
watchdog packets and (possibly) watchdog responses has been sent for
three watchdog timeouts. This behavior ensures that clients do not
waste resources on the server by causing it to track idle sessions.
<span class="grey">DeKok Experimental [Page 15]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-16" ></span>
<span class="grey"><a href="./rfc7360">RFC 7360</a> DTLS as a Transport Layer for RADIUS September 2014</span>