Re: [saag] RADIUS is deprecating MD5

[Alan DeKok <[e-mail]>]

On Apr 1, 2024, at 9:05 AM, Peter Gutmann <[e-mail]> wrote:
> The devices are already on the network, RADIUS isn't doing any access control,
> or in fact anything at all as far as I can tell.  In fact at least one
> "RADIUS" implementation I've seen used in this situation is nothing more than
> some code to add the necessary wrappers on send and strip them on receive.
> Same with the "EAP" implementation.  The only bit that has any effect is the
> auth inside the TLS tunnel, and whether you get back an "OK" or "not-OK"
> response to that.

  Again, that design is extremely unusual.  You cannot take one limited use-case, and use it as the foundation for an extravagant claim that RADIUS is little more than a dumb transport.

  That limited use-case is not only irrelevant to the more common use-cases of RADIUS, I have to question the competence of anyone who's designed and built it.  As Wolfgang Pauli said, "It's not even wrong".

  I see I can't convince you as to how RADIUS actually works.  So I'll leave well enough alone, and move on to more productive endeavours.

  Alan DeKok.