Re: [saag] RADIUS is deprecating MD5

[Viktor Dukhovni <[e-mail]>]

On Sun, Mar 31, 2024 at 10:49:53AM +0000, Peter Gutmann wrote:

> >We will be deprecating the use of RADIUS/UDP, in large part due to it's
> >reliance on MD5.  Everyone shipping RADIUS clients should take a serious look
> >at moving to TLS immediately.

I am not aware of published attacks on MD5 that are relevant to RADIUS.
While MD5 is no long collision-resistant, that does not appear to be
needed here.  Instead, it is first pre-image resistance that is needed
here, to protect the presumably strong shared secret (low entropty
shared secrets are just as easily brute forced in dictionary attacks
with SHA2-256 as with MD5).

I appreciate and agree that new protocols should not use MD5, but it is
not clear that there's a pressing case to deprecate its long-standing
use in RADIUS.  What attack is that guarding against?

-- 
    Viktor.