commoncriteria / commoncriteria/authserver
FCS_RADSEC_EXT.1 consistency issues
Nobody has claimed this yet.
- Dominant language
- Makefile
- Stars
- 0
- Forks
- 0
- PR merge metrics
- No merged PRs in 30d
Description
The updated copy of FCS_RADSEC_EXT.1 defers to the NDcPP for the (D)TLS implementation. However, one issue with this is that FCS_RADSEC_EXT.1.2 allows PSKs instead of X.509 certificates for authentication. The NDcPP (D)TLS requirements only define ciphersuites that use X.509 for authentication and so there is no coverage of the PSK case, e.g. TLS_PSK_WITH_AES_128_CBC_SHA as defined in the previous version of the SFR.
Need to resolve what happens to the (D)TLS claims in the event that RadSec is claimed but only PSK is used for authentication, unless the solution is to mandate X.509 for this.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Review the updated FCS_RADSEC_EXT.1 text alongside the NDcPP (D)TLS requirements and the previous SFR version. Determine how claims should handle RadSec using PSK authentication, including whether X.509 must be mandated; the issue is done when the requirements state an unambiguous resolution.
Written by the indexing model from the issue text.
Assessment
- Domain
- security
- Issue type
- Documentation
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100