Re: [saag] RADIUS is deprecating MD5

[Alan DeKok <[e-mail]>]

On Apr 1, 2024, at 9:27 AM, Peter Gutmann <[e-mail]> wrote:
> I know how RADIUS works, I'm pointing out that it's used in ways other than
> the way you imagine.  You're responding with "lalalalala, I'm not listening,
> I'm not listening, there's only this way, nothing else exists".  This doesn't
> change the fact that it's used in other ways than you imagine.

  That's rather unnecessarily personal.

  I understand perfectly well the use-case you're describing.  My issue is *why* someone has designed that system.

  RADIUS is used as a gate-keeper for network access.  If people are using it when a system already has network access, then it's the wrong protocol to use.

  The underlying issue here is that I've done RADIUS for well over two decades.  I've never seen a system designed like you say, and I would never recommend that anyone do it.

  I understand that you respect the competence of the people who've designed this system.  That's you're choice.

  I'm asking that you not apply that use-case to how everyone else on the planet uses RADIUS.  I'm asking that you not make misleading and incorrect statements that RADIUS isn't used for much, or that it's nothing more than a transport layer for EAP-*TLS.

  It's not.  Jan-Frederik, Bernard, and I have explained in detail why that position is false.  If multiple decades of experience and detailed explanations don't convince you, and instead result in personal attacks, then I'm done.

  Alan DeKok.