Re: [radext] Extended IDs

[Peter Deacon <[e-mail]>]

On Fri, 1 Dec 2017, Jakob Heitz (jheitz) wrote:

> What if the quantum computers turn out to live up to their promises? 
> Then we can throw out all this authentication stuff and decide to not 
> share our Ethernets with the attackers instead. No more request 
> authenticator.

RADIUS security already lost cause no matter what :(

Best practice for many years - use a secure transport and or RADIUS over 
(D)TLS.  Regardless of selected security option in all cases operation of 
authenticator is maintained.

> The request authenticator is already overloaded. It may be used for the 
> CHAP challenge. Now, you want another overload?

Authenticator currently also used for at least following:

Tunnel Passwords
Message-Authenticator
PAP
CHAP
MPPE Keys

Clearly no possibility of authenticator ever changing in RADIUS protocol 
without creation of an incompatible replacement.  In event of an 
incompatible replacement there would be no need for either of these two 
drafts.

I am aware of no practical downside to "Overloading".

regards,
Peter