Subject: (radius) CHAP and Shared Secret

From: "Dmitry G. Goncharenko" <[email-masked]>
Date: Mon, 23 Nov 1998 11:59:36 -0800

RFC 2138 says:
"   The RADIUS server looks up a password based on the User-Name,
   encrypts the challenge using MD5 on the CHAP ID octet, that password,
   and the CHAP challenge (from the CHAP-Challenge attribute if present,
   otherwise from the Request Authenticator), and compares that result
   to the CHAP-Password.  If they match, the server sends back an
   Access-Accept, otherwise it sends back an Access-Reject."

So it looks like shared secret is not used for CHAP authentication and
RADIUS server will send "Access-Accept" response to a NAS for CHAP request
without regard to shared secret configured between the NAS and RADIUS
server.
Is that right or I'm missing anything?

Dmitry.

-
To unsubscribe, email [email-masked]' with
'unsubscribe ietf-radius' in the body of the message.

---

From: Paul Krumviede <[email-masked]>
Date: Mon, 23 Nov 1998 12:29:01 -0500

You're missing something. The secret shared between the NAS and the
RADIUS server is used to compute an authenticator for communications
between the RADIUS server and the NAS (think of it as a form of
integrity check and a form of authentication of the sender to
the recipient of any particular message). But this has nothing
to do with how a server validates a user.

-paul 

-