Subject: (radius) Any CHAP-Challenge Attribute (#60) implementations

From: Herb Morris <[email-masked]>
Date: Tue, 10 Nov 1998 14:52:40 -0800

Have any vendors implemented RADIUS clients or servers that support CHAP-Challenge 
attributes with a length of 32 bytes?

From reading the RFC, I would expect the server to pass the CHAP ID octet, 
the user's password, and the 32-byte CHAP challenge to the MD5 code and 
then do a 16-byte comparison of the MD5 results against the 16 byte CHAP 
response contained in the CHAP-Password attribute (#3). 

In looking at the Merit's RADIUS server source code, version 3.6B, available at:
	ftp://ftp.merit.edu/radius/releases/

I find that Merit's server computes the MD5 digest based on the CHAP ID octet,
the user's password, and ONLY the first 16 bytes of the 32 byte CHAP-Challenge 
attribute. The MD5 results are then compared against the 16 byte CHAP 
response contained in the CHAP-Password attribute. There are several
comments in the Merit code that question the validity of the implementation. 
[This code is located in the funcs.c file, routine get_pass()]

Any insight from vendors on how they have implemented 32 byte CHAP-Challenge attributes in
their products would be helpful.

As an aside, I remember a while back some posts that indicated that a RADIUS test suite
was available. Could the owner(s) of this test suite provide information on it's availability
(and possibly it's location)?

Herb Morris
Senior Software Engineer
Cisco Systems Inc 

-
To unsubscribe, email [email-masked]' with
'unsubscribe ietf-radius' in the body of the message.

---

From: "Dale E. Reed Jr." <[email-masked]>
Date: Tue, 10 Nov 1998 15:39:38 -0800

> their products would be helpful.

RadiusNT supports any length (>= 5) CHAP-Challenge in attribute #60 to
override the Challenge in the vector.  It is computed exactly how
you specify above, and not restricted or limited to 16 bytes.
 
> (and possibly it's location)?

What are you trying to test?  RadiusNT includes Radlogin, which can send 
auth and accouting (start/stop) requests as well as do stress simulation 
(multi-thread).  Anyone could use it to test a server.  I just recently
added the ability to send a request based on a binary capture of the
request.  Very useful for playback. :)

-- 
Dale E. Reed Jr.  ([email-masked])
_________________________________________________________________
       IEA Software, Inc.      |  RadiusNT, Emerald, and NT FAQs
 Internet Solutions for Today  |   http://www.iea-software.com
-
To unsubscribe, email [email-masked]' with
'unsubscribe ietf-radius' in the body of the message.