28 Apr
2009
28 Apr
'09
12:29 p.m.
William Rettig wrote:
My boss has asked me to add a FIPS feature to FreeRADIUS.
OK.
It really doesn’t amount to much at this point. We think that FIPS mode requires additional two things:
1) Use of HMAC-SHA1 MAC (vendor neutral)
For... what? The TLS methods?
2) AES Key Wrap of the MSK in the Access-Accept (attribute format is vendor specific - but feature could be mostly generic).
That won't be supported by most NASes, but OK.
Is this something that could be supported moving forward?
Sure. Submit a patch.
Would someone be willing to direct my efforts?
My suggestion for the AES keywrap is to write a module that takes the existing MSK, creates the keywrapped attributes, and then (possibly) deletes the original MSK. Alan DeKok.