From pgut001@cs.auckland.ac.nz Mon Apr 1 06:05:17 2024 Return-Path: X-Original-To: saag@ietfa.amsl.com Delivered-To: saag@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 46EEAC14F6F7 for ; Mon, 1 Apr 2024 06:05:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XGoS5UCQZETV for ; Mon, 1 Apr 2024 06:05:16 -0700 (PDT) Received: from au-smtp-delivery-117.mimecast.com (au-smtp-delivery-117.mimecast.com [103.96.23.117]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 818CCC14F6F6 for ; Mon, 1 Apr 2024 06:05:14 -0700 (PDT) Received: from AUS01-ME3-obe.outbound.protection.outlook.com (mail-me3aus01lp2233.outbound.protection.outlook.com [104.47.71.233]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id au-mta-104-zAiEHiNZPMK5WfSQ7JmBeg-1; Tue, 02 Apr 2024 00:05:11 +1100 X-MC-Unique: zAiEHiNZPMK5WfSQ7JmBeg-1 Received: from ME0P300MB0713.AUSP300.PROD.OUTLOOK.COM (2603:10c6:220:229::18) by SY8P300MB0308.AUSP300.PROD.OUTLOOK.COM (2603:10c6:10:260::6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7452.24; Mon, 1 Apr 2024 13:05:09 +0000 Received: from ME0P300MB0713.AUSP300.PROD.OUTLOOK.COM ([fe80::b3cd:2a27:73e1:a974]) by ME0P300MB0713.AUSP300.PROD.OUTLOOK.COM ([fe80::b3cd:2a27:73e1:a974%5]) with mapi id 15.20.7452.019; Mon, 1 Apr 2024 13:05:09 +0000 From: Peter Gutmann To: Alan DeKok CC: "saag@ietf.org" Thread-Topic: [saag] RADIUS is deprecating MD5 Thread-Index: AQHafhhYd6Pp6wDrq0CYMT6Bf16QJrFRtYpBgABGhQCAAASugIAABbGAgAAFHYCAAAmYgIAA8+79gABYsACAAAN3w4AAAZAAgAAGxBs= Date: Mon, 1 Apr 2024 13:05:09 +0000 Message-ID: References: <755BC73B-B981-4986-B45A-E9796DCC66BC@deployingradius.com> <21309D5A-E824-42C7-8BAB-366AD568E9F4@deployingradius.com> In-Reply-To: Accept-Language: en-NZ, en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: x-ms-publictraffictype: Email x-ms-traffictypediagnostic: ME0P300MB0713:EE_|SY8P300MB0308:EE_ x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0 x-microsoft-antispam-message-info: 5/8noaZCHAfIvYAR6tVOl+/Rh5ap1xf990pRi5KuNUoKcZEVganM1R1mmoWWFBzRWbU0HhJU/0U23cg3NXJz9kF+KgPi2YOY4JUG+lTl/F5UImKSGfkz4D64w0p7OqZXyk8PWodXgheZE+TlvQpbg+5v2gyT4A5b9drOhwqcGQkTBfX6X8ZObXK9GwlcGFYGrm8a7PF2bzFLKsmOZE3g7CtJ2R8uKvUeM13YwTXePYwVSfivMvIG2XuqWtIGrD6XAvi0YhQ5faGuf/lmBR6ZKMYSU9WUmfVRNxw8wVeUb0iqJP6oSw2cLomaG3ytLLe3IQUE/4xyr5S5MHc1667W9bKS5QD5zILdluYwSmxXiRGnHAifz2awTYMnZ57nWFZDrOVRoK+qeVK35yd7T+fqMnVOsQd8TF5s47Wds9iKjT6DA8xktbA8qsZPblJ27UlPYXaKwwGcAl7KrkdmvlUg7QSlBVQlbgBS/zAzg0UKG7OX8EapTXgWgs2C1DTpOrhui1vkENeiLtv45aUVRYeHjDtqbdokpX0rv46RQsudS3JEagSyof+YT/cWi2xdf4z1XPQvuxz02U4AeaXUNwKMyo/xL5MKHh49/LcKKNlOVRaWgKfYfV8NtiQT7SuatGEn/u/qCxapUnVrodC0xH4zfe0j0vhQnpPQC52Hg084oPM= x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:ME0P300MB0713.AUSP300.PROD.OUTLOOK.COM; PTR:; CAT:NONE; SFS:(13230031)(376005)(366007)(1800799015); DIR:OUT; SFP:1102 x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?iso-8859-1?Q?Kbae1ce2d6VhJ+/KciHmmiQrCTztywaIysg0GbbkkV+Va8INnXlTYwErxm?= =?iso-8859-1?Q?R55Y1EjNKgU2A29JoEU+vTwk2hJyedBODt2ma7ac8ZKQ6s2IHU8cTGFsMe?= =?iso-8859-1?Q?jYUwUdmwgcaKQx84ltXkmfyqdpDfYqtvemp5ON1CZOeHFYvERs/hxx0vZY?= =?iso-8859-1?Q?e9IlUEAvQGBTYCOi26vWnlTRQMrKQ/rVhvwuxVWif7U/g+gXF8wiAndeHQ?= =?iso-8859-1?Q?VGKJ+VfAI1SVWrk9m/P3DE1YVJ9r0fUma18TVxwMiu7qRpO9EF6Dm2QMK2?= =?iso-8859-1?Q?j2Rac+6eEZeJ9/wHjoCI79UfIjUpYdkCwxtvPhIwZTptQ8rhDmGi8kJ8mc?= =?iso-8859-1?Q?tjD7/LsvF+jqj4SWweQ767qKhjBE+ILFhdNiCPzbYP7EMdIJtuN124jbB+?= =?iso-8859-1?Q?R3SjZAsRaYCmpqUmxf7CbpyHlAqa9xXY72yDhl4kSuXSHCfgSB1EsYWre2?= =?iso-8859-1?Q?GBwR8PHuV970LBbKU0HAa0jEY4Usr4NMEbryJzm9xkbpT1n+dN3K3aa6LU?= =?iso-8859-1?Q?i+mzurLW+TRXDsDE8sFfi9+yvTKtkAP721TUKXRmuPbFRuJe5f3azFl5yk?= =?iso-8859-1?Q?davPLR5MtYrX9bzh1OcOWG+WBYx/6lavY1+k7Gb+hwgC+BNUIdgos1BFa5?= =?iso-8859-1?Q?Ib3kkKmJfLHQiKSA31AvG7/VBoheVsrIuyYhiE4bfHXi2P6vb11j/1gc2h?= =?iso-8859-1?Q?6GJsRUh01XJp29SkoGySxzCLuADObUyUkZgMVrmBx4+KYZ9lAlYapzORNX?= =?iso-8859-1?Q?Hc4epyKpW4Gv3v0xeMAqQW6tam3aMscWrr570bO0Uv/lLObgMeDzAZcEHF?= =?iso-8859-1?Q?ubkBAn40tiz9EYN2Ew66XfjJt5sR9i/lt3bRlli0lLJyGn15Y6qnW4fhz2?= =?iso-8859-1?Q?5MxavZa/LvOQcda3STVfk2bcUvIFQQEgM3RE/3BUBptOV2wM+6lpwkZxQd?= =?iso-8859-1?Q?RSVHay0Se8FeY6B1AM/yciD6HfwLFVFqUuSR2Ds1JYyRA2TvhbdC+lf1e6?= =?iso-8859-1?Q?fUhvuQitS1qc9fPX67Icib6zvosjlhcr0WRPXBPGKxUovdSqUhGXBD9J9N?= =?iso-8859-1?Q?EoDxIeWQAfsGzkinGhm56KnMkcmBkRsdEZzOO7b1P/U6Ggf04wXcd9+tmH?= =?iso-8859-1?Q?cE0pZo/PBJLKXo/RCXprZaRwjeGZFf+W8bYAiBduVY70C2QHh4ihHBcbbw?= =?iso-8859-1?Q?I5nqTWBwDJt/CqD/bjIXiJCpqvVVY8cIhKsHX78k4s+BZQfgFY5F1p1Ixi?= =?iso-8859-1?Q?7VTpxJdtB4kjm7txP5Z/LwigzW2Zlm98reJpuYRIa0J2tpuDUsqf7r5eFQ?= =?iso-8859-1?Q?bjR2QkXfYPpP2LgvR2+E0RrmS+AjABlOp6raNMis8nQm49aG7Ik1yCIjGk?= =?iso-8859-1?Q?he7OtDX3F2OEFcTPv+ifIVBFwFLGTaq3Mqj+gkH0uGz3EeY29NdHvjXV3D?= =?iso-8859-1?Q?oyqHi2Ze2sGzNCl6omb/z22HKD3kyOht0hxLAcuRPhTVfhTQ7k+FmwduxP?= =?iso-8859-1?Q?xjjvlCwgEcsiCj12DgLBpPdjuR4nHjLN88rqpU7IP3q6sdTgyRHQrTV1xv?= =?iso-8859-1?Q?/sAOoFCuVo0KoktPT+M3z5W5eJABM1A0deFcCkI6la3KDZKFzPbdjUPJJz?= =?iso-8859-1?Q?FFhDx8Xw7k2BcKDv78lqI7aH4b5X19uzbgBk4xuyI/R9B2ISe1nF9WGA?= =?iso-8859-1?Q?=3D=3D?= MIME-Version: 1.0 X-OriginatorOrg: cs.auckland.ac.nz X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: ME0P300MB0713.AUSP300.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-Network-Message-Id: 3468e120-d06d-47ae-958a-08dc524c5bd5 X-MS-Exchange-CrossTenant-originalarrivaltime: 01 Apr 2024 13:05:09.0914 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: d1b36e95-0d50-42e9-958f-b63fa906beaa X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: 9znsaQmNSno9puySaSeQGTG7jeTqA22X9pthRMW7GP/0lZlw84k2fhlbKrBp0FKei6d992sWE0fShA7lsPpI7mj143PeDs2nADQxuvl5nI0= X-MS-Exchange-Transport-CrossTenantHeadersStamped: SY8P300MB0308 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: cs.auckland.ac.nz Content-Language: en-NZ Content-Type: text/plain; charset=WINDOWS-1252 Content-Transfer-Encoding: quoted-printable Archived-At: Subject: Re: [saag] RADIUS is deprecating MD5 X-BeenThere: saag@ietf.org X-Mailman-Version: 2.1.39 Precedence: list List-Id: Security Area Advisory Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 01 Apr 2024 13:05:17 -0000 Alan DeKok writes:=0A=0A>It *is* being used to = control network access. Unauthenticated devices can't=0A>get network acces= s until the RADIUS client lets them onto the network. i.e.=0A>switch, acce= ss point, VPN concentrator, etc.=0A=0AThe devices are already on the networ= k, RADIUS isn't doing any access control,=0Aor in fact anything at all as f= ar as I can tell. In fact at least one=0A"RADIUS" implementation I've seen= used in this situation is nothing more than=0Asome code to add the necessa= ry wrappers on send and strip them on receive.=0ASame with the "EAP" implem= entation. The only bit that has any effect is the=0Aauth inside the TLS tu= nnel, and whether you get back an "OK" or "not-OK"=0Aresponse to that.=0A= =0APeter.