What is a use case for implementing RadSec instead of RADIUS?

RadSec (RADIUS over TLS) is defined in RFC 6614 to address the security weaknesses of traditional RADIUS, which sends most of its payload in cleartext over UDP. The primary use case for RadSec is to secure RADIUS communications by tunneling them through a TLS-encrypted TCP connection. This is essential when RADIUS packets must traverse an untrusted network, such as the public internet, between a RADIUS client (e.g., a NAS) and a RADIUS server, ensuring confidentiality and integrity of the entire message.

A. Communication between a client device and a network access server is secured by 802.1X/EAP methods, not RadSec.
B. EAP-TLS is an authentication method; while highly secure, it does not protect the backend RADIUS traffic that RadSec is designed to secure.
D. RadSec significantly strengthens encryption but also increases complexity by requiring TCP transport and certificate management, contrary to the claim.

- RFC 6614, "Transport Layer Security (TLS) Encryption for RADIUS", Section 1, Introduction. It states, "The RADIUS protocol... is vulnerable to a number of security attacks... This document specifies the use of Transport Layer Security (TLS) ... to address these security issues."

- Aruba ClearPass Policy Manager 6.9 User Guide, "RadSec Configuration", Page 535. It notes, "RadSec (RADIUS over TLS) is a protocol that provides a secure communication channel between RADIUS clients and servers by using TLS encryption. This is particularly useful when RADIUS packets are sent over untrusted networks."