Subject: (radius) Clarification regarding Signature

From: "Darran Potter" <[email-masked]>
Date: Wed, 10 Nov 1999 14:44:07 -0000

version 4 of the extensions draft says:

"When present in an Access-Request packet, Signature is an HMAC-MD5
[7] checksum of the entire Access-Request packet, including Type,
ID, Length and authenticator, using the shared secret as the key,
as follows.

Signature = HMAC-MD5 (Type, Identifier, Length, Request
                                  Authenticator, Attributes)"

Does this mean you replace the authenticator with the shared secret
and then do the hash..... or, append the shared secret after the packet
and do the hash on the combined "chunk".

Thanks
Darran

-
To unsubscribe, email [email-masked]' with
'unsubscribe ietf-radius' in the body of the message.

---

From: Paul Krumviede <[email-masked]>
Date: Wed, 10 Nov 1999 11:25:33 -0500

> and do the hash on the combined "chunk".

if this is hmac (as in RFC 2104), the shared secret is used as the key K,
and thus is used in place of the authenticator or not appended. K is only
referenced in the expansion of HMAC-MD5:
	md5(K xor opad, md5(K xor ipad, text))
where ipad and opad are defined in RFC 2104.

-paul
-