Radius/UDP. How legacy protocols need to keep up with modern cryptography

https://blog.cloudflare.com/radius-udp-vulnerable-md5-attack

by emot • 2 years ago

36 7 2 years ago

blog.cloudflare.com

rcarmo2• 2 years ago

Huh. Most people who care have already moved to Diameter (this is not a joke, that’s the actual name of the new protocol).

royce2• 2 years ago

The paper https://www.blastradius.fail/pdf/radius.pdf) explicitly states DIAMETER "never replaced RADIUS for many common use cases" and "the protocol itself offers no security when used over TCP". So unless the DIAMETER traffic is isolated or tunneled, it's arguably less secure than RADIUS/TLS.

rcarmo2• 2 years ago

That paper is completely outdated (newest references are from 2016) or just badly researched.

3GPP references several RFCs for Diameter security (including TLS), and every single 5G network on the planet uses it (I work in telco).

Even Wikipedia is more accurate: https://en.wikipedia.org/wiki/Diameter_(protocol)

mbalyuzi• 2 years ago

Not in the Enterprise WiFi space they haven’t, it’s ubiquitous there. Though that tends to be over trusted networks or Radsec if you’re doing it right.

kjs3• 2 years ago

No we haven't. Maybe on the planet you live on all of your vendors have GA'ed enterprise grade Diameter support, but our folks still support dozens of products that haven't.

mm-mbs• 2 years ago

There is a typo in the document. It should read "RADIUS over TLS or DTLS" not "RADIUS over TLS or DLTS" (above the second image). The "DLTS" is wrong.

Radius/UDP. How legacy protocols need to keep up with modern cryptography

Related Stories