Re: [saag] RADIUS is deprecating MD5

[Alan DeKok <[e-mail]>]

On Mar 31, 2024, at 12:29 PM, Viktor Dukhovni <[e-mail]> wrote:
> I'm just trying to better understand the core issue, which seems to be
> UDP more than MD5, best I can tell from the discussion so far.

  It has nothing to do with UDP.

  As Jan-Frederik wrote, there are two issues:

1) privacy - almost all information is sent in clear-text, including PII

2) security - many packets lack all authentication and integrity checks.

  Neither issue is acceptable in 2025.

>  Others
> can speak to whether or not the deprecation is or isn't overly
> disruptive relative to the benefits.

  Again, "deprecation" is an official statement that people shouldn't use it.  Deprecating RADIUS/UDP won't suddenly invalidate ~100M devices.

  As someone who's done RADIUS since 1996, the cost is acceptable.  People using it inside of "trusted" networks are somwhat secure.  People using it outside of trusted networks have known for *decades* that it's insecure.

  I have little sympathy for shipping insecure products for decades, because "meh, whatever".  The IETF has the power to change this, and should.

  Alan DeKok.