Re: [saag] RADIUS is deprecating MD5

[Peter Gutmann <[e-mail]>]

Alan DeKok <[e-mail]> writes:

>We will be deprecating the use of RADIUS/UDP, in large part due to it's
>reliance on MD5.  Everyone shipping RADIUS clients should take a serious look
>at moving to TLS immediately.

Maybe I'm missing something here but won't this break pretty much every RADIUS
implementation in existence, in particular stuff that's been around forever
and is unlikely to change?

Also since the cases I'm familiar with just use RADIUS as an extremely awkward
transport mechanism for EAP-xTLS, with user = "anonymous" and password = some
widely-known dummy value at the RADIUS level so there's no security there to
begin with, it seems like the draft should emphasise that this applies to raw
RADIUS, not RADIUS used purely as a transport mechanism for something else.

Also, just to be nitpicky:

>While MD5 has been broken, it is a testament to the design of RADIUS that
>there have been (as yet) no attacks on RADIUS Authenticator signatures which
>are stronger than brute-force.

I'd say that's more a testament to the fact that there's nothing there worth
attacking, meaning that there are far easier and more effective attacks
elsewhere.  Use it to secure BTC transactions or something similar and I'm
sure we'd see attacks turn up fairly quickly.  This is based on experience
with very weak DKIM signing keys, which were breakable without too much effort
but where no-one ever bothered because they weren't protecting anything of
value that wasn't attackable through easier means.

Peter.