Subject: Re: [saag] RADIUS is deprecating MD5

From: Peter Gutmann <[email-masked]>
Date: Mon, 1 Apr 2024 13:05:09 +0000

Alan DeKok <[email-masked]> writes:

>It *is* being used to control network access.  Unauthenticated devices can't
>get network access until the RADIUS client lets them onto the network.  i.e.
>switch, access point, VPN concentrator, etc.

The devices are already on the network, RADIUS isn't doing any access control,
or in fact anything at all as far as I can tell.  In fact at least one
"RADIUS" implementation I've seen used in this situation is nothing more than
some code to add the necessary wrappers on send and strip them on receive.
Same with the "EAP" implementation.  The only bit that has any effect is the
auth inside the TLS tunnel, and whether you get back an "OK" or "not-OK"
response to that.

Peter.