[radext] Re: Lack of Channel Bindings in RADIUS/(D)TLS

[Fabian Mauchle <[e-mail]>]

Trying to follow the discussion and understand the issue...

On 24.07.2024 19:50, Margaret Cullen wrote:
> When you have two peers A and C, with an authorized proxy, B, you have two RADIUS sessions A -> B and B -> C.  This only works if A has a shared secret with B and B has a shared secret with C.  So, B is part of the trusted set of peers.  Using RadSec, a MITM (Z) could have no trust relationship with A or B, but be receiving traffic from A on one TLS connection, and forwarding it to C on a second TLS connection, while both A and B think that they are directly connected to each other.  Z is not part of the trusted peer group, Z is a MITM attacker.  This is quite different than that forwarding through an authorized proxy.

If Z has no trust relationship with A, it can't be receiving traffic 
from A. As a MITM, Z would need to present a certificate (or other 
identity) to A that A accepts as trustworthy to establish the TLS 
connection A-Z, at which point the trust relationship between A and Z is 
established.

As Alan already pointed out, RADIUS proxies are inherently MITM by 
design. That is why (in roaming scenarios where A,B and C belong to 
different parties) we use EAP as the actual AAA within RADIUS.

-- 
Fabian Mauchle
Network
NOC:    [phone]
Direct: [phone]

Switch
Werdstrasse 2, P.O. Box, 8021 Zurich, Switzerland