RE: call for discussion on draft-heinanen-radius-pe-discovery-03. txt

Bernard Aboba <[email protected]> Thu, 29 May 2003 10:08:17 -0700 (PDT)
Newsgroups gmane.ietf.ppvpn
Message-ID <[email protected]>
> my opinion is that security is improved when pe must know both
> the name and password of the ce also in the case when they are
> configured in the pe rather than learned from the ce.

Not necessarily.  The KDC model is to keep the secrets in a single well guarded
place.  Storing passwords on PEs around the network may  not be the best
way to guard against compromise.