From pgut001@cs.auckland.ac.nz Mon Apr 1 00:04:15 2024 Return-Path: X-Original-To: saag@ietfa.amsl.com Delivered-To: saag@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CEA81C14F61C for ; Mon, 1 Apr 2024 00:04:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xiDzJO3ZOGWa for ; Mon, 1 Apr 2024 00:04:13 -0700 (PDT) Received: from au-smtp-delivery-117.mimecast.com (au-smtp-delivery-117.mimecast.com [103.96.23.117]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 37A4FC14F616 for ; Mon, 1 Apr 2024 00:04:12 -0700 (PDT) Received: from AUS01-ME3-obe.outbound.protection.outlook.com (mail-me3aus01lp2233.outbound.protection.outlook.com [104.47.71.233]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id au-mta-54-7w5Uhq0BMxuatgceRAE95g-1; Mon, 01 Apr 2024 18:04:09 +1100 X-MC-Unique: 7w5Uhq0BMxuatgceRAE95g-1 Received: from ME0P300MB0713.AUSP300.PROD.OUTLOOK.COM (2603:10c6:220:229::18) by SY7P300MB0365.AUSP300.PROD.OUTLOOK.COM (2603:10c6:10:28b::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7452.20; Mon, 1 Apr 2024 07:04:07 +0000 Received: from ME0P300MB0713.AUSP300.PROD.OUTLOOK.COM ([fe80::b3cd:2a27:73e1:a974]) by ME0P300MB0713.AUSP300.PROD.OUTLOOK.COM ([fe80::b3cd:2a27:73e1:a974%5]) with mapi id 15.20.7452.019; Mon, 1 Apr 2024 07:04:07 +0000 From: Peter Gutmann To: "saag@ietf.org" Thread-Topic: [saag] RADIUS is deprecating MD5 Thread-Index: AQHafhhYd6Pp6wDrq0CYMT6Bf16QJrFRtYpBgABGhQCAAASugIAABbGAgAAFHYCAAAmYgIAA8+79 Date: Mon, 1 Apr 2024 07:04:06 +0000 Message-ID: References: <755BC73B-B981-4986-B45A-E9796DCC66BC@deployingradius.com> <21309D5A-E824-42C7-8BAB-366AD568E9F4@deployingradius.com> In-Reply-To: Accept-Language: en-NZ, en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: x-ms-publictraffictype: Email x-ms-traffictypediagnostic: ME0P300MB0713:EE_|SY7P300MB0365:EE_ x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0 x-microsoft-antispam-message-info: ykcZz7LMDCf8leK82uxEnQNbPh/LmsYvcCE80ng97A0zhagq9d0yOUKgi81PX4l7PsI0t415sgg95gHDhxMDWDH152WN7wfopF3OX4yv1I7J0BrjO74yn06LlLphM/YwKOryAayHuCE/+zdrDrBBlRit4XAXOOgaC9uF3hGYsejOVtQRFSYcoDrXj+GxqjPtJE+5Pswvxovx2bHdV1UV7DOjhIqwZESff5IrWhsLTi6F3wFTJKg+NXL0nxy7XcL911Y5T9bKLjeTmvs0/DC70GB9TTQKCuvBSM9tVzJBTNmqIMhh2TBs7syFd90eEd4UBoYzGc46mCFK/j7nF7ST7DxAfTjwtKhTcWCRvYmXYmF0GQl2EGP5BXFmDMRCK8FwKRZp+OjMJKuSd44D9/ZeRXjU0VCXQFBZvtqZ07M4rNH22GMljGJ3/r7VOesJML4/ARs04ZZpLE6MhJSmXp/J2UxC7HBs+l9il72A9mtZzOfUzKeMjhpVEqMui6wHNI2xmwwBRazJ4V0FlFX+sMC3iq5smXhb0mmnMbh7GAF10urbT3l2O0edZnoPdkCo4CxdzHtJcAueAAwngweP99SgZgdhxKQ7HAMVvWKPGpEwTMqPf1NhMxlb/naSHhHtSF8x2bbYa2zirwGXG3kWdoeumMVUu/e/E/bpx1GUG17KF6E= x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:ME0P300MB0713.AUSP300.PROD.OUTLOOK.COM; PTR:; CAT:NONE; SFS:(13230031)(366007)(1800799015)(376005); DIR:OUT; SFP:1102 x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?iso-8859-1?Q?HdnBNCFI13XT3E6rBH9W2ZhYjBGf1Q47qHc/bHEriC7R8WzjZC/3bxgrZb?= =?iso-8859-1?Q?gWYNg4P7nU0pRbrQ7fjxpMYfFlEhdkU1DT1sJUnBitJK0f9np+gQUgeIKN?= =?iso-8859-1?Q?zcPRs1Sa6rwHfg/PEBnd6yxDpbS9JBRdnsgwUjxawqWMDLFCzTGXsOT/8v?= =?iso-8859-1?Q?r9WZPO4Rh7qWDAt7m2ekuH8tm8ZXdhds1zwrBhSGQABN0BniLFwBJeolwN?= =?iso-8859-1?Q?jAq3iwzdRDUkzpjcAeCL54gMHie5ihuaZzQBGGvVThuItreVzf+b/zvDkZ?= =?iso-8859-1?Q?a4K7jOnYpPJKQn0dSHwcDAkEB4WBrf9L1i4ol17qev8HAoa0iimZrLFxz+?= =?iso-8859-1?Q?ge/SvZwYqBYeD4Ge48gXAHetCcj4pdd4Bh6isb073CKqV/C7gE8KJkECG8?= =?iso-8859-1?Q?pzal/9LtZGy5lz8AQays+zACwlN9aJv+PRwYWlXozucaiKV8VAMAYCWfkx?= =?iso-8859-1?Q?98fxkcMHyjOzld3FTixAZ5CeE+LyS7f9NLAojOfqwQSauLti4h/VqGYqGi?= =?iso-8859-1?Q?UiMrh4q1IP/qVdUNaUU9x1pqWbwH9Hf4po1S/M2Ecp/Ibx3Gd5Zi/lxthb?= =?iso-8859-1?Q?nAb36N55uTkhXvRZ2H4EFAsKOlPOSTNMxaPMiOP2A9hnASxhlHkKttqy4q?= =?iso-8859-1?Q?jVu27n2q/fY/2df9KhWClwpBG9T49IkEJ/WrREzrAy4wDrVISEvLByT+a+?= =?iso-8859-1?Q?0F9Mxxv041bmK4T9c1sF3POMBAXMxGRRePKx7O6UyoFLNN5SkA+/t9pA7U?= =?iso-8859-1?Q?YUbshlKbgGsUa+L5Jmj1YDIBCZeS/onKskca+0AsGCjXb8N6IKKbqcxbV1?= =?iso-8859-1?Q?1YdU7m0rVK1ycxB3w/F28SQkYcb1aAbqY6wEHy9kvTdfqj5TvUeHczO5yH?= =?iso-8859-1?Q?a/R29HUdj71pYWBdjYs9HlVb2ZO3jl0UhTmvSJ9+W53W6QA8ZLmHeh4gwx?= =?iso-8859-1?Q?+F7vuI1h3o0Ob4TGuSugNQdI25N3ilRsOZMVwDa4hAUQu+jK0k1+gbv/F8?= =?iso-8859-1?Q?5pcp/R2xnyjNghoOnNfXxkM3ocs/IeSqC3jFRMVUfCZMcrA/XI8BwxdBgI?= =?iso-8859-1?Q?6OP7EY8UgazOMMeUgLTAy78zmoOSsQgGyia4hgwFOghrw45jjWUzru9KtW?= =?iso-8859-1?Q?lhGbcqCEcFJYITtCZfxELr0j6EYwyQnLxpNTq7WmdZ9i8LzOtLsksYlyr5?= =?iso-8859-1?Q?Sb/ewcnLhjsyjfA/wefHiBTdjAsqb7yGqZm8u1M79o/BXl5YLXSiuD6eaR?= =?iso-8859-1?Q?xWGZDIOdNYwRkUEYcTPpO1mqS313AQ/UC0YQJilQ2xnPBtwHg4SVTQW0w7?= =?iso-8859-1?Q?CVlVA4ZUPulHlXQH151/ls9rUwSVDV1qeq68RtTA16bxcixECOFJxI900N?= =?iso-8859-1?Q?DpaoOShbg55PyNShMSmWpuMWLdgMGv8Cgr4JPnFsRgQyPhqUlm+m+5UsFa?= =?iso-8859-1?Q?4/asWR9jiv+9DuMEEc4xZwNx/VdKfrjztuCqhRFSkVJpRKPhhRXP0FlFFj?= =?iso-8859-1?Q?oyeReAgNamsCsckwY78Fgz2tshvxZW7gm4yNXvRZPHChlsvJBbieF2R+qz?= =?iso-8859-1?Q?7fymDpIC7jh7sxF7aGMAGOzx9LQGKF6GayxfUQ0ZRojlvHCuUsmXyW+bYV?= =?iso-8859-1?Q?SMKmRbLUlHPEMEpCpDBQi5TlWo0FujvYsTI1kqasOqg6lspLB37j2Zhw?= =?iso-8859-1?Q?=3D=3D?= MIME-Version: 1.0 X-OriginatorOrg: cs.auckland.ac.nz X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: ME0P300MB0713.AUSP300.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-Network-Message-Id: 4802ed47-3545-4b2b-b9aa-08dc5219ec31 X-MS-Exchange-CrossTenant-originalarrivaltime: 01 Apr 2024 07:04:06.9647 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: d1b36e95-0d50-42e9-958f-b63fa906beaa X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: mS/yp2cKwzpgjvuY/xGq2BNv46sEMMgypQJ6o0/BG8X6Mi3fP6eUogdqIMCQjwaNc3GI7mFH6Q3I29OnsdA/xsdB77Z9as//xvPwK41XBlc= X-MS-Exchange-Transport-CrossTenantHeadersStamped: SY7P300MB0365 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: cs.auckland.ac.nz Content-Language: en-NZ Content-Type: text/plain; charset=WINDOWS-1252 Content-Transfer-Encoding: quoted-printable Archived-At: Subject: Re: [saag] RADIUS is deprecating MD5 X-BeenThere: saag@ietf.org X-Mailman-Version: 2.1.39 Precedence: list List-Id: Security Area Advisory Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 01 Apr 2024 07:04:15 -0000 Viktor Dukhovni writes:=0A=0A>Others can speak to = whether or not the deprecation is or isn't overly=0A>disruptive relative to= the benefits.=0A=0AIt depends on whether RADIUS is being used for authenti= cation or as a=0Atransport layer. As I've already pointed out, with RADIUS= -for-transport=0Athere's nothing to fix because RADIUS isn't doing anything= that matters.=0A=0AFor those who aren't familiar with how this works, the = layering is as follows:=0A=0AUDP - Unreliable, and fragments=0ARADIUS - Fra= gments again, but differently to UDP.=0AEAP-over-RADIUS=0AEAP - Fragments y= et again, and differently again.=0AA turtle=0AMore turtles=0AFour elephants= =0ASome form of TLS encapsulation, e.g. EAP-TLS, PEAP, etc=0A*** TLS ***=0A= EAP/DIAMETER/some mess Microsoft invented=0AThe authentication you're using= , often MSCHAPv2 by the time you get here=0A=0AOf all that mess, the only p= arts that matter are the TLS tunnel and the=0Aauthentication run inside it.= Everything before the point marked *** TLS ***=0Ais irrelevant because it= s sole purpose is to comply with a decades-long=0Aaccretion of unnecessary = layering in various RFCs.=0A=0ASo when RADIUS is used this way there's noth= ing to "fix", since the bit that=0Amatters is already being run inside a TL= S tunnel. It's only when the layering=0Ais:=0A=0AUDP=0ARADIUS=0A=0Athat th= ere's something that needs fixing.=0A=0APeter.