Re: [saag] RADIUS is deprecating MD5

[Peter Gutmann <[e-mail]>]

Jan-Frederik Rieckers <[e-mail]> writes:

>Alan is the main developer of a widely used RADIUS server

I know who Alan is (I've been on the FreeRADIUS mailing list for years, it'd
be hard not to know :-), and I know he most likely knows more about RADIUS et
al than everyone else on here combined.  I also know how RADIUS et al are
supposed to work, nothing like Alan's level of knowledge but at least what the
RFCs and texts say, i.e. how it's *supposed* to work.

>You insist that RADIUS is used in this one use case that you have in mind and
>that the other use cases are negligible and/or that people who use it that way
>are dumb.

Uhh... I never said anything like that.  I mean there's nothing remotely like
that in the feedback I sent, just "some people use it this other way, have you
considered that?".  The point I've been trying to make is that like other
universal-hammer tools like TLS that get used in ways the designers never
intended, RADIUS gets used in ways other than what the textbook says.  My
concern is that creating an RFC that assumes it'll only be used in the
textbook manner won't accommodate uses in an other-than-textbook manner, of
which I gave one example that I'd encountered.

And to Alan: Apologies for the personal comment, I just felt like I was
beating my head against a wall trying to provide feedback on the draft that
wasn't feeding back anywhere.

Peter.