Re: [saag] RADIUS is deprecating MD5

[Jan-Frederik Rieckers <[e-mail]>]

I think those issues are not necessarily linked, but we can tackle them 
together.

Issue one is the missing integrity protection for requests and the weak 
integrity protection (because solely based on MD5) for responses.
For EAP messages, the usage of Message-Authenticator is required, which 
adds an integrity check for requests and improves the integrity check 
for responses.
It's still based on MD5 (and unfortunately has no mechanism to update 
it, so we are fixed on HMAC-MD5 for that), but at least it gives some 
security.

Issue two is privacy, and that one we can't really tackle easily if we 
keep the protocol as-is, we need actual encryption for that.

In both cases, the existing implementations would have to be updated.

If we define a new integrity check attribute with a negotiable 
algorithm, I fear most appliances would just ignore it, because 
requiring it would break compatibility with everyone who didn't 
implement it yet and if nobody uses it, why should it be implemented?

But we already have a solution ready, that solves our integrity and our 
privacy problems which is RADIUS/(D)TLS.
The TLS layer takes care of confidentiality and integrity, so we don't 
need to do that on RADIUS level any more.

So with the deprecation of RADIUS/UDP, we solve the problem of relying 
on MD5 for security AND the issue of privacy of additional attributes 
that would otherwise have been sent in clear.

Cheers,
Janfred

On 31.03.24 18:29, Viktor Dukhovni wrote:
> On Sun, Mar 31, 2024 at 11:55:35AM -0400, Alan DeKok wrote:
>> On Mar 31, 2024, at 11:37 AM, Viktor Dukhovni <[e-mail]> wrote:
>>> This does not sound like an MD5 issue, rather this is about metadata
>>> leakage from RADIUS/UDP, and MD5 is mostly just collateral damage or
>>> a distraction from the core issue?
>>
>>    We know that MD5 is insecure.  We know that many Access-Request packets lack all integrity checks.  I've been trying to fix this issue since 2005 or so.
>>
>>    Why can't we just say "yes, 1993-era protocols are bad.  Wrap them in TLS.  Move on".
>>
>>    I am more than a bit surprised that there is any resistance to this effort.
> 
> I'm just trying to better understand the core issue, which seems to be
> UDP more than MD5, best I can tell from the discussion so far.  Others
> can speak to whether or not the deprecation is or isn't overly
> disruptive relative to the benefits.
>