Subject: Re: (radius) Username/User-Password attributes

From: [email-masked] (Patrice Calhoun)
Date: Wed, 28 Oct 1998 05:17:36 -0800

I agree with Barney.

You have 128 bits to play with. Even if all of these bits were in ascii I really
don't see the issue. If a manufacturer's default password is inadequate, change
it (I am sure this is an option, as I recall from my experience building NASes
they have plenty of options).

PatC
>Oh, nonsense.  The attacker can always sign up briefly.
>Or, if you like, the attack can be done without knowledge of the user's
>password just be looking for an all-ascii result after decryption, on
>a few captured access-requests.
>But even 8 lower-case letters gives 200 billion possibilities, and
>mixed case or extending to 12 char puts it out of current technological
>reach.  A properly-chosen shared secret is longer than 12 and mixed
>case, digits and specials.  Anybody wants to brute-force that, go
>right ahead and try.
>
>The best algorithm in the world won't help if you choose "maintenance" as
>your password or post-it on the monitor.
>Barney
>
>> Who says the hacker is hacking his own ISP? Besides, we want to try to avoid
>> giving hackers clues/exploits, no matter how trivial.
>-
>To unsubscribe, email [email-masked]' with
>'unsubscribe ietf-radius' in the body of the message.

-
To unsubscribe, email [email-masked]' with
'unsubscribe ietf-radius' in the body of the message.

---

From: Murtaza Chiba <[email-masked]>
Date: Wed, 28 Oct 1998 11:56:46 -0500

> don't see the issue. 

128 bits is pretty safe.  Also, some vendors do allow hexadecimal strings
for shared secrets which further increases the entropy.

>If a manufacturer's default password is inadequate, change

I do not quite understand this.  This is a typical RADIUS problem where
the distinction between the shared secret and password is often lost.  
The issue here is that the password used for Pre-Auth is a known value. 
This cannot be changed as they are usually hard coded values.  Unless a
vedor allows them to be configurable, which I dont think anybody does.  
Given enough number of plaintext/ciphertext combinations through sniffing
packets, it would be pretty easy to derive the key (shared secret).  Plus
it is made easier which Access-Requests to look for, since we know the
username would look like a telephone number.
Although,  a 128 bit shared secret should make things pretty secure even
under known plaintext attacks. 

But who said anything about RADIUS being a very secure protocol??

Murtaza
-- 
**************************************************************
Name: Murtaza S. Chiba		Company:Bay Networks
Tel No. : (978)916-4689		Fax: (978)916-4789
Interests: Bicycling, chess and the outdoors
Home Page: http://lynx.neu.edu/m/mchiba
-
To unsubscribe, email [email-masked]' with
'unsubscribe ietf-radius' in the body of the message.