Subject: Re: (radius) tunnel-password language

From: Barney Wolff <[email-masked]>
Date: Mon, 13 Dec 1999 21:58 EST

Ignacio, you are now the second person to claim (the first privately)
that RADIUS (and equivalently, L2TP) hiding is not serious encryption.
But nobody has come forward with any attack on the encryption mechanism
in either protocol.  Until someone does, and the attack looks credible,
this amounts to FUD with no visible basis.

If I know someone is sniffing RADIUS, I'd much rather use PAP than CHAP,
because at least with PAP the "hiding" of the user password depends on a
shared secret under my control.  With CHAP, a sniffed Access-Request
allows a dictionary attack on the user's password, which may not be
well-chosen.  And that dictionary attack will be far faster than the
traditional one on /etc/passwd, because MD5 is so much faster than
crypt().

Regards,
Barney

> Date: Mon, 13 Dec 1999 18:24:35 -0800
> From: Ignacio Goyret <[email-masked]>
> 
> Pat, Barney,
> I think the important part of Pat's problem may be with the use of the
> word 'key' in the L2TP context. There is no L2TP key. It is just a password,
> and it is no different than a regular user password. If you allow a RADIUS
> to server to send a user password to a NAS, there is nothing wrong with
> allowing that same RADIUS server to tell the NAS the password it must use
> to access a particular L2TP server.
> 
> The L2TP control channel has a mechanism to 'hide' AVPs. This mechanism is
> not stronger than CHAP. Customers that choose to 'hide' AVPs know (or should
> be told) that hiding is not encrypting. Hiding is intended to limit the
> amount of stuff that humans can read directly off a network trace, and nothing
> more. It is not intended to provide encryption nor full security.
-
To unsubscribe, email [email-masked]' with
'unsubscribe ietf-radius' in the body of the message.

---

From: Ran Atkinson <[email-masked]>
Date: Tue, 14 Dec 1999 09:32:56 -0500

% Ignacio, you are now the second person to claim (the first privately)
% that RADIUS (and equivalently, L2TP) hiding is not serious encryption.
% But nobody has come forward with any attack on the encryption mechanism
% in either protocol.  Until someone does, and the attack looks credible,
% this amounts to FUD with no visible basis.

Barney,

	It would be irresponsible to publish the attack in a
full-documentation manner at this point.  Step one of working 
within the system is the effort that several folks are making here 
to get the risks more clearly and crisply documented.  An average reader 
of the current RADIUS RFCs and I-Ds will not come away with the grasp
that the system is fundamentally a "scrambler" rather than a real
"security" mechanism.

	The claim that RADIUS does not provide effective privacy
is not new and has been made repeatedly in public IETF fora 
-- in the context of proposals to use RADIUS for IPsec key management,
to give one example of many.

	If an attack were published today, then every RADIUS server in
operational use becomes vulnerable.  Thus, it is not responsible
behaviour (IMHO) to publish an attack in this kind of situation;
it is most decidedly NOT FUD.

	Your turning a reasonable technical point that Ignacio (and
others) have tried to make into an ad hominem comment about
FUD was disappointing.

Yours,

Ran
[email-masked]

-