Subject: Re: (radius) max radius password

From: Dave Mitton <[email-masked]>
Date: Thu, 24 Sep 1998 11:00:08 -0400

And to your second point...  been there, fixed that.

Yes, we've seen PPP messages somehow get in CLI username/password
prompts.

And we had to fix the code to length check the input before proceeding.

Depending on the implementation situation, you may also want to check for
printable characters. (Since only real users should be coming through
that interface.  Save binary capabilities for the programatic
interfaces)

In the best case, the server may just reject the session because the
garbage doesn't match any username.  But even truncated, a server is
hopefully not adversely sensitive to random binary strings in the
username.

	Dave.

At 03:38 PM 9/24/98 +0100, Darran Potter wrote: 

<excerpt>Good point.

<excerpt> <bold><fontfamily><param>Arial</param><smaller>-----Original
Message-----

From:
</smaller></fontfamily></bold><fontfamily><param>Arial</param><smaller>Dave
Mitton <<<<mailto:[email-masked]>[email-masked]>

<bold>To: </bold>Darran Potter
<<<<mailto:[email-masked]>[email-masked]>;
<<mailto:[email-masked]>[email-masked]
<<<<mailto:[email-masked]>[email-masked]>

<bold>Date: </bold>24 September 1998 14:40

<bold>Subject: </bold>Re: (radius) max radius password

</smaller></fontfamily>Well, maybe in theory, except that Section 5.2
User-Password, page 22 of the RFC says that the password algorithm is
repeated "to no more than 128 characters".

And the next page says: Length: At least 18 and no larger than 130.

Dave.

At 09:16 AM 9/24/98 +0100, Darran Potter wrote: 

<excerpt> I was trying to work out the max possible password length
supported

by radius and I think its 240 characters. I based this on the method

by which >16 char passwords are encrypted in 16char chunks with the

final chunk being padded out to 16 chars.

Hence to be less than the max string allowed of 253 you can only have

15 chunks = 240 chars.

Does this look OK? If it does, do vendors ensure they truncate 
passwords

before encryption to an aaa server?

I dont think anyone would ever enter a long password (unless they were

trying to break the NAS/aaa server software). However I've seen noise

(or PPP stuff) somehow get into a password - with various vendors.
Luckily

its never been long enough to cause the attribute length to wrap.

Darran

</excerpt><<<<<<<<

---------------------------------------------------------------

David Mitton 978-670-8888 Main

Consulting Engineer, Nortel 978-916-4570 Direct

Carrier Packet Networks, I&SP Group 978-916-4789 FAX

Billerica, MA 01821 [email-masked] - To unsubscribe, email
[email-masked]' with 'unsubscribe ietf-radius' in the body of
the message.

</excerpt>

</excerpt><<<<<<<<

---------------------------------------------------------------

David Mitton					978-670-8888 Main

Consulting Engineer, Nortel		978-916-4570 Direct

Carrier Packet Networks, I&SP Group	978-916-4789 FAX

Billerica, MA 01821				[email-masked]
-
To unsubscribe, email [email-masked]' with
'unsubscribe ietf-radius' in the body of the message.

---

From: "Darran Potter" <[email-masked]>
Date: Thu, 24 Sep 1998 15:38:42 +0100

Good point.
    -----Original Message-----
    From: Dave Mitton <[email-masked]>
    To: Darran Potter <[email-masked]>; [email-masked] <[email-masked]>
    Date: 24 September 1998 14:40
    Subject: Re: (radius) max radius password

    Well, maybe in theory, except that Section 5.2 User-Password, page 22 of the RFC says that the password algorithm is repeated "to no more than 128 characters".

    Dave.
    
    At 09:16 AM 9/24/98 +0100, Darran Potter wrote: 
    
        I was trying to work out the max possible password length supported
        by radius and I think its 240 characters. I based this on the method
        by which >16 char passwords are encrypted in 16char chunks with the
        final chunk being padded out to 16 chars.

        Does this look OK? If it does, do vendors ensure they truncate passwords
        before encryption to an aaa server?
        
        I dont think anyone would ever enter a long password (unless they were
        trying to break the NAS/aaa server software). However I've seen noise
        (or PPP stuff) somehow get into a password - with various vendors. Luckily
        its never been long enough to cause the attribute length to wrap.
        
        Darran

    <<<<

    Billerica, MA 01821 [email-masked] - To unsubscribe, email [email-masked]' with 'unsubscribe ietf-radius' in the body of the message.