[radext] Re: Selfie Attack on TLS-PSK

[Margaret Cullen <[e-mail]>]

> On Jul 25, 2024, at 3:05 PM, Alan DeKok <[e-mail]> wrote:
> On Jul 25, 2024, at 11:23 AM, Margaret Cullen <[e-mail]> wrote:
>> As Stefan points out, copying of a RADIUS/TLS-transmitted RADIUS message on to a local network is different (and less secure) than dumb copying of a message that was transmitted via RADIUS/UDP, because sensitive data in the message transmitted via UDP will still be protected (to some degree) by the RADIUS secret and MD5, while the packet coming from RADIUS/TLS would use a well-known RADIUS secret, “radsec”, essentially equivalent to sending the sensitive parts of the packet in clear text.
> 
>  I think that description is not correct, though.  The RADIUS packets have some kind of transport behavior (TLS, shared secrets, whatever).  That behavior is defined hop by hop.  So when a proxy forwards traffic, it doesn't care what the previous transport is.

As I understood Stefan’s message, he was talking about copying the raw packet as received from the transport, not proxying the packet as you described.  I don’t know why this would be done, nor do I know of anyone who is doing it. I’m assuming Stefan does, because he brought this up as a use case for why binding the TLS and RADIUS layers would be undesirable.

I was attempting to point out that security implications of “dumb copying” a RadSec packet (with a secret of “radsec”) are different than the implications of dumb copying a RADIUS/UDP packet (with a non-constant secret), because in the RadSec case, the contents can be converted to plaintext using the “radsec” secret value, but in the RADIUS/UDP, you need to crack MD5 to see the full contents.

That _is_ a _real_ difference.  Without knowing who is doing “dumb copying” in what situations, we can’t know if it is a significant difference.

Margaret