Re: [saag] RADIUS is deprecating MD5

[Jan-Frederik Rieckers <[e-mail]>]

Hi Peter,

Sorry to jump in here as well and double down on what Alan already 
wrote, but please, try to actually read all of the mails sent, try to 
understand them and look who's writing them and what's their experience 
with RADIUS.
I've tried to write a good explanation, but I don't think you took the 
time to actually read that.

Try also to understand our point of view.
Alan is the main developer of a widely used RADIUS server, so it would 
be safe to assume (and I know it from personal contact) that he knows a 
lot about RADIUS and where it is used!
I'm working for one of the national roaming operators for eduroam, and 
I've been maintaining the eduroam setup at my home university during my 
studies, as well as a related setup which used plain RADIUS with passwords.

And most of us who responded, Alan, Bernard, and I, have tried to tell 
you that there are other use cases of RADIUS out there, and that we are 
thinking of those use cases as well.
So if someone is doing the "Lalala, I'm not listening", then, I'm sorry 
for being this direct, it's you.

You insist that RADIUS is used in this one use case that you have in 
mind and that the other use cases are negligible and/or that people who 
use it that way are dumb.

It's one thing to say "Ok, I don't see it your way" but that's not what 
you are doing. You are completely disregarding every reply.

I'm happy to discuss with you why you think the effort of producing a 
document that deprecates insecure RADIUS practices is a bad idea, but 
for that discussion to be meaningful, you first need to listen and 
understand what use cases we have in mind.
And if you say "Those are not real" or "That's not what RADIUS is used 
for", then please, provide us with the grounds for those statements and 
don't just refuse to accept our statements.
Our statements are based on our experience with this protocol, and just 
because you haven't seen those use cases, that doesn't mean they don't 
exist.

Cheers,
Janfred

On 01.04.24 15:27, Peter Gutmann wrote:
> Alan DeKok <[e-mail]> writes:
> 
>> I see I can't convince you as to how RADIUS actually works.
> 
> I know how RADIUS works, I'm pointing out that it's used in ways other than
> the way you imagine.  You're responding with "lalalalala, I'm not listening,
> I'm not listening, there's only this way, nothing else exists".  This doesn't
> change the fact that it's used in other ways than you imagine.
> 
> As for judging the competence of the people who built this stuff, what it's
> being used with predates RADIUS by many years and it's still going so I'd say
> they were pretty competent.
> 
> (OK, it's actually kinda messy, but it's kept the lights on so at least it
> works).
> 
> Peter.
>