Re: [radext] WGLC #2 for draft-ietf-radext-dtls-04

[Sam Hartman <[e-mail]>]

>What having a dedicated DTLS port gets you, is the ability to mandate that between network boundaries only encrypted RADIUS traffic may pass. This would otherwise be difficult to enforce without DPI. 

True.
no objection to dedicated dtls port.


>As an aside, were still working under the assumption that it's non-trivial to recover the shared secret from unecrypted RADIUS packets, correct?

I don't know.  Enumerating through I think 96^11 md4s is apparently
trivial given reasonably-priced hardware for cracking.  So probably $10k
investment.  See recent discussions of hash cracking on GPUs.  However,
md5 is a bit slower, and 11 is less than 16.  I think I'd say that I
would be unsurprised if someone broke RADIUS secrets entirely, and would
be entirely unsurprised if brute forcing the secrets anyone is actually
using in practice was easy.
On the other hand I would not commit to being able to brute force a
particular RADIUS secret without more research.