Subject: [radext] #86: MD5 Stream Cipher Weaknesses

From: "radext issue tracker" <[email-masked]>
Date: Sat, 05 Mar 2011 22:25:02 -0000

#86: MD5 Stream Cipher Weaknesses

 Section 3 states:

 RADIUS packets, as defined in [RFC2865], are protected by an MD5
 message integrity check (MIC), within the Authenticator field of
 RADIUS packets other than Access-Request.  The Message-Authenticator
 Attribute utilizes HMAC-MD5 to authenticate and integrity protect
 RADIUS packets.  Various RADIUS attributes support encrypted
 (also known as "hidden") values,
 including: User-Password, Tunnel-Password, and various Vendor-
 Specific Attributes.  Generally speaking, the hiding mechanism uses a
 stream cipher based on a key stream from an MD5 digest.

 Recent work on MD5 collisions does not immediately compromise any of
 these methods, absent knowledge of the RADIUS shared secret.
 However, the progress toward compromise of MD5's basic cryptographic
 assumptions has resulted in the deprecation of MD5 usage in a variety
 of applications.

 The weaknesses of MD5 stream ciphers is independent of MD5 collision
 issues and therefore it is not accurate to state that there is no
 compromise absent knowledge of the shared secret.  For example, were the
 RADIUS authenticator to repeat, a known plaintext attack on hidden
 attributes such as User-Password is possible.

-- 
---------------------------------------+------------------------------------
 Reporter:  bernard_aboba@…            |       Owner:            
     Type:  defect                     |      Status:  new       
 Priority:  major                      |   Milestone:  milestone1
Component:  Crypto-Agility             |     Version:  1.0       
 Severity:  Active WG Document         |    Keywords:            
---------------------------------------+------------------------------------

Ticket URL: <http://trac.tools.ietf.org/wg/radext/trac/ticket/86>
radext <http://tools.ietf.org/radext/>

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://psg.com/lists/radiusext/>

---

From: "radext issue tracker" <[email-masked]>
Date: Sat, 12 Mar 2011 22:21:36 -0000

Changes (by bernard_aboba@…):

  * status:  new => closed
  * resolution:  => fixed

Comment:

 Note that the Access-Request isn't the only RADIUS packet not protected by
 a MIC in the Authenticator field;  Status-Server also isn't protected that
 way.

 The proposed resolution is to change Section 3 to the following:

 3.  The Current State of RADIUS Security

    RADIUS packets, as defined in [RFC2865], are protected by an MD5
    message integrity check (MIC), within the Authenticator field of
    RADIUS packets other than Access-Request [RFC2865] and Status-Server
    [RFC5997].  The Message-Authenticator Attribute utilizes HMAC-MD5 to
    authenticate and integrity protect RADIUS packets.

    While RADIUS does not support confidentiality of entire packets,
    various RADIUS attributes support encrypted (also known as "hidden")
    values, including: User-Password [RFC2865, section 5.2], Tunnel-
    Password [RFC2868, section 3.5], and various Vendor-Specific
    Attributes, such as the MS-MPPE-Send-Key and MS-MPPE-Recv-Key
    attributes defined in [RFC2548, section 2.4].  Generally speaking,
    the hiding mechanism uses a stream cipher based on a key stream from
    an MD5 digest.  Attacks against this mechanism are described in
    [RFC3579] Section 4.3.4.

    Recent work on MD5 collisions does not immediately compromise these
    functions absent knowledge of the RADIUS shared secret.  However, the
    progress toward compromise of MD5's basic cryptographic assumptions
    has resulted in the deprecation of MD5 usage in a variety of
    applications.

 Add the following references to Section 8:

 [RFC2548]  Zorn, G., "Microsoft Vendor-specific RADIUS Attributes", RFC
            2548, March 1999.

 [RFC2868]  Zorn, G., Leifer, D., Rubens, A., Shriver, J., Holdrege, M.
            and I. Goyret, "RADIUS Attributes for Tunnel Protocol
            Support", RFC 2868, June 2000.

 [RFC5997]  DeKok, A., "Use of Status-Server Packets in the Remote
            Authentication Dialin User Service (RADIUS) Protocol", RFC
            5997, August 2011.

-- 
---------------------------------------+------------------------------------
 Reporter:  bernard_aboba@…            |        Owner:            
     Type:  defect                     |       Status:  closed    
 Priority:  major                      |    Milestone:  milestone1
Component:  Crypto-Agility             |      Version:  1.0       
 Severity:  Active WG Document         |   Resolution:  fixed     
 Keywords:                             |  
---------------------------------------+------------------------------------

Ticket URL: <http://trac.tools.ietf.org/wg/radext/trac/ticket/86#comment:1>
radext <http://tools.ietf.org/radext/>