Subject: (radius) max radius password

From: "Darran Potter" <[email-masked]>
Date: Thu, 24 Sep 1998 09:16:49 +0100

I was trying to work out the max possible password length supported
by radius and I think its 240 characters. I based this on the method
by which >16 char passwords are encrypted in 16char chunks with the
final chunk being padded out to 16 chars.

Hence to be less than the max string allowed of 253 you can only have
15 chunks = 240 chars.

Does this look OK? If it does, do vendors ensure they truncate passwords
before encryption to an aaa server?

I dont think anyone would ever enter a long password (unless they were
trying to break the NAS/aaa server software). However I've seen noise
(or PPP stuff) somehow get into a password - with various vendors. Luckily
its never been long enough to cause the attribute length to wrap.

Darran

---

From: Dave Mitton <[email-masked]>
Date: Thu, 24 Sep 1998 09:39:33 -0400

Well, maybe in theory, except that Section 5.2 User-Password, page 22 of
the RFC says that the password algorithm is repeated "to no more than 128
characters".

And the next page says: Length: At least 18 and no larger than 130.

	Dave.

At 09:16 AM 9/24/98 +0100, Darran Potter wrote: 

<excerpt>I was trying to work out the max possible password length
supported

15 chunks = 240 chars.

Does this look OK? If it does, do vendors ensure they truncate 
passwords

(or PPP stuff) somehow get into a password - with various vendors.
Luckily

Darran

</excerpt><<<<<<<<

---------------------------------------------------------------

David Mitton					978-670-8888 Main

Consulting Engineer, Nortel		978-916-4570 Direct

Carrier Packet Networks, I&SP Group	978-916-4789 FAX

Billerica, MA 01821				[email-masked]
-
To unsubscribe, email [email-masked]' with
'unsubscribe ietf-radius' in the body of the message.

---

From: "Dale E. Reed Jr." <[email-masked]>
Date: Thu, 24 Sep 1998 23:57:50 -0700

> Darran Potter wrote:
> passwords before encryption to an aaa server?

This *IS* specified in the RFC in section 5.2:

----------------------------
   Type

      2 for User-Password.

   Length

      At least 18 and no larger than 130.

   String

      The String field is between 16 and 128 octets long, inclusive.
----------------------------

So 128 would be the definitive answer.

-- 
Dale E. Reed Jr.  ([email-masked])
_________________________________________________________________
       IEA Software, Inc.      |  RadiusNT, Emerald, and NT FAQs
 Internet Solutions for Today  |   http://www.iea-software.com
-
To unsubscribe, email [email-masked]' with
'unsubscribe ietf-radius' in the body of the message.

---

From: "ITRANS Support" <[email-masked]>
Date: Mon, 28 Sep 1998 10:46:50 -0500

> final chunk being padded out to 16 chars.

I haven't checked it lately, but about 2 years ago we did some tests 
with Ascend and they did NOT recalculate the MD5 hash after every 16 
octets, rather the original hash was used for the entire password.

As I recall at least one other vendor we tested with did the same 
thing, but I can't say for sure.

Anybody checked this out lately???

Martin
-------------------------------------------------------------------------
Internet Transaction Services, Inc.   http://www.itrans.com
mailto:[email-masked]             mailto:[email-masked]
-------------------------------------------------------------------------
-
To unsubscribe, email [email-masked]' with
'unsubscribe ietf-radius' in the body of the message.