Re: [saag] RADIUS is deprecating MD5

[Peter Gutmann <[e-mail]>]

Alan DeKok <[e-mail]> writes:

>The use-case you keep mentioning of "RADIUS is useless. EAP-*TLS transports
>well-known passwords" is so rare as to be non-existent.  I've been doing
>RADIUS since 1996, and I can't recall ever seeing people do that.

That's the only use I've ever seen of it, but then I'm coming from the TLS
side not the RADIUS side where TLS is the main protocol and RADIUS is the
clunky transport mechanism so it's kinda natural that I'd see it from there.

>I have to question the experience and knowledge of anyone who would build
>such a system.

They're not doing RADIUS anything, there's no time-based limits, VLANs,
summaries of their traffic (time, data transferred, etc.), RADIUS accounting
packets, no muffins, no toast, no teacakes, no buns, baps, baguettes or
bagels, no croissants, no crumpets, no pancakes, no potato cakes, there's just
a TLS-tunneled MSCHAPv2 (or whatever) challenge and an MSCHAPv2 response.

This isn't being used for Internet access or whatever, it's just to
authenticate a remote device.

Peter.