Larger Packets for RADIUS over TCP
RFC 7930

• Status
• IESG evaluation record
• IESG writeups
• Email expansions
• History

• Versions
• 00
• 01
• 02
• 03
• 04
• 05
• 06
• 07

Internet Engineering Task Force (IETF)                        S. Hartman
Request for Comments: 7930                             Painless Security
Updates: 6613                                                August 2016
Category: Experimental
ISSN: 2070-1721

                   Larger Packets for RADIUS over TCP

Abstract

   The RADIUS-over-TLS experiment described in RFC 6614 has opened
   RADIUS to new use cases where the 4096-octet maximum size limit of a
   RADIUS packet proves problematic.  This specification extends the
   RADIUS-over-TCP experiment (RFC 6613) to permit larger RADIUS
   packets.  This specification compliments other ongoing work to permit
   fragmentation of RADIUS authorization information.  This document
   registers a new RADIUS code, an action that required IESG approval.

Status of This Memo

   This document is not an Internet Standards Track specification; it is
   published for examination, experimental implementation, and
   evaluation.

   This document defines an Experimental Protocol for the Internet
   community.  This document is a product of the Internet Engineering
   Task Force (IETF).  It represents the consensus of the IETF
   community.  It has received public review and has been approved for
   publication by the Internet Engineering Steering Group (IESG).  Not
   all documents approved by the IESG are a candidate for any level of
   Internet Standard; see Section 2 of RFC 7841.

   Information about the current status of this document, any errata,
   and how to provide feedback on it may be obtained at
   http://www.rfc-editor.org/info/rfc7930.

Hartman                       Experimental                      [Page 1]
RFC 7930                  RADIUS Large Packets               August 2016

Copyright Notice

   Copyright (c) 2016 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents
   (http://trustee.ietf.org/license-info) in effect on the date of
   publication of this document.  Please review these documents
   carefully, as they describe your rights and restrictions with respect
   to this document.  Code Components extracted from this document must
   include Simplified BSD License text as described in Section 4.e of
   the Trust Legal Provisions and are provided without warranty as
   described in the Simplified BSD License.

Table of Contents

   1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   3
     1.1.  Requirements Notation . . . . . . . . . . . . . . . . . .   3
   2.  Changes to Packet Processing  . . . . . . . . . . . . . . . .   4
     2.1.  Status-Server Considerations  . . . . . . . . . . . . . .   4
   3.  Forward and Backward Compatibility  . . . . . . . . . . . . .   5
     3.1.  Rationale . . . . . . . . . . . . . . . . . . . . . . . .   6
     3.2.  Discovery . . . . . . . . . . . . . . . . . . . . . . . .   7
   4.  Protocol-Error Code . . . . . . . . . . . . . . . . . . . . .   7
   5.  Too Big Response  . . . . . . . . . . . . . . . . . . . . . .   7
   6.  IANA Considerations . . . . . . . . . . . . . . . . . . . . .   8
   7.  Security Considerations . . . . . . . . . . . . . . . . . . .   9
   8.  References  . . . . . . . . . . . . . . . . . . . . . . . . .   9
     8.1.  Normative References  . . . . . . . . . . . . . . . . . .   9
     8.2.  Informative References  . . . . . . . . . . . . . . . . .  10
   Acknowledgements  . . . . . . . . . . . . . . . . . . . . . . . .  10
   Author's Address  . . . . . . . . . . . . . . . . . . . . . . . .  10

Hartman                       Experimental                      [Page 2]
RFC 7930                  RADIUS Large Packets               August 2016

1.  Introduction

   The experiment with Remote Authentication Dial-In User Service
   (RADIUS) over Transport Layer Security (TLS) [RFC6614] provides
   strong confidentiality and integrity for RADIUS [RFC2865].  This
   enhanced security has opened new opportunities for using RADIUS to
   convey additional authorization information.  As an example,
   [RFC7833] describes a mechanism for using RADIUS to carry Security
   Assertion Markup Language (SAML) messages in RADIUS.  Many attributes
   carried in these SAML messages will require confidentiality or
   integrity such as that provided by TLS.

   These new use cases involve carrying additional information in RADIUS
   packets.  The maximum packet length of 4096 octets is proving
   insufficient for some SAML messages and for other structures that may
   be carried in RADIUS.

   One approach is to fragment a RADIUS message across multiple packets
   at the RADIUS layer.  RADIUS fragmentation [RFC7499] provides a
   mechanism to split authorization information across multiple RADIUS
   messages.  That mechanism is necessary in order to split
   authorization information across existing unmodified proxies.