[radext] Re: Selfie Attack on TLS-PSK

[[e-mail]]

Margaret wrote:
> Speaking as an individual…
> 
> I am not talking about trying to establish any sort of cryptographic end-to-end
> trust in a multi-hop RADIUS fabric.  I agree that we don’t have that today, and
> it is not our goal to change that.  I am talking about the security properties of a
> single RADIUS hop. I am also talking about how those properties feed into the
> security models of multi-hop deployments.

Ah, ok, sorry for the misrepresentation...

> As Stefan points out, copying of a RADIUS/TLS-transmitted RADIUS message
> on to a local network is different (and less secure) than dumb copying of a
> message that was transmitted via RADIUS/UDP, because sensitive data in the
> message transmitted via UDP will still be protected (to some degree) by the
> RADIUS secret and MD5, while the packet coming from RADIUS/TLS would use
> a well-known RADIUS secret, “radsec”, essentially equivalent to sending the
> sensitive parts of the packet in clear text.

The entity doing Stefan's "copying" is not a classic RADIUS entity. It sounds like a proxy that operates purely at the transport layer (and not the application layer). A RADIUS proxy translating TLS to UDP must mint a new request using the secret shared with the downstream server.

There is a problem if Stefan's entity existed, but it isn't a mode of operation supported the RFCs and I don't know of any products doing this.

> My point is that we should make sure that moving away from the solution we
> are deprecating (RADIUS/UDP) and moving to any if the solutions we are
> recommending (any one of the RadSec variants) does not result in security
> regressions, and that any security model changes are well-documented.

+1

Josh