Good morning. My boss has asked me to add a FIPS feature to FreeRADIUS. It really doesn't amount to much at this point. We think that FIPS mode requires additional two things: 1) Use of HMAC-SHA1 MAC (vendor neutral) 2) AES Key Wrap of the MSK in the Access-Accept (attribute format is vendor specific - but feature could be mostly generic). Is this something that could be supported moving forward? Would someone be willing to direct my efforts? Bill
William Rettig wrote:
My boss has asked me to add a FIPS feature to FreeRADIUS.
OK.
It really doesn’t amount to much at this point. We think that FIPS mode requires additional two things:
1) Use of HMAC-SHA1 MAC (vendor neutral)
For... what? The TLS methods?
2) AES Key Wrap of the MSK in the Access-Accept (attribute format is vendor specific - but feature could be mostly generic).
That won't be supported by most NASes, but OK.
Is this something that could be supported moving forward?
Sure. Submit a patch.
Would someone be willing to direct my efforts?
My suggestion for the AES keywrap is to write a module that takes the existing MSK, creates the keywrapped attributes, and then (possibly) deletes the original MSK. Alan DeKok.
Hi,
2) AES Key Wrap of the MSK in the Access-Accept (attribute format is vendor specific - but feature could be mostly generic).
That won't be supported by most NASes, but OK.
if this is what Cisco mean by AES key wrap then we can validate/verify the updated featureset as the cisco wireless solution (WISM) has an option for AES keywrap when talking to the RADIUS server configured alan
A.L.M.Buxey@lboro.ac.uk wrote:
Hi,
2) AES Key Wrap of the MSK in the Access-Accept (attribute format is vendor specific - but feature could be mostly generic). That won't be supported by most NASes, but OK.
if this is what Cisco mean by AES key wrap then we can validate/verify the updated featureset as the cisco wireless solution (WISM) has an option for AES keywrap when talking to the RADIUS server configured
OK. The keywrap document hasn't been standardized, but it might be within 3-4 years... Alan DeKok.
participants (3)
-
A.L.M.Buxey＠lboro.ac.uk -
Alan DeKok -
William Rettig