Subject: Re: (radius) CHAP and Shared Secret

From: Alan DeKok <[email-masked]>
Date: Mon, 23 Nov 1998 16:00:13 -0500

From draft-ietf-radius-ext-02.txt:

------------
5.14.  Signature

   Description

      This attribute MAY be used to sign Access-Requests to prevent
      dictionary attacks on CHAP, ARAP or EAP authentication methods.
      ...
------------

  Yes, CHAP is subject to dictionary attacks without a packet Signature
(based on the shared secret).

  Alan DeKok.
-
To unsubscribe, email [email-masked]' with
'unsubscribe ietf-radius' in the body of the message.

---

From: "Dmitry G. Goncharenko" <[email-masked]>
Date: Mon, 23 Nov 1998 12:56:13 -0800

OK, then, RFC says:
"      Transactions between the client and RADIUS server are
      authenticated through the use of a shared secret, which is never
      sent over the network.  In addition, any user passwords are sent
      encrypted between the client and RADIUS server, to eliminate the
      possibility that someone snooping on an unsecure network could
      determine a user's password."

So in the case of using CHAP the "transaction between the client and RADIUS
server" cannot be authenticated. And as a result of it I continue to process
request, successfully authenticate a user and write to log message about
permitted request. But, I think, I have to have a way to find out whether
that request was from the client that knows correct shared secret or not to
be able to deny the request.
So how I can perform that "integrity check and a form of authentication of
the sender to
the recipient of any particular message" when CHAP is used?

Dmitry.

-----Original Message-----
From: Paul Krumviede <[email-masked]>
To: Dmitry G. Goncharenko <[email-masked]>
Cc: [email-masked] <[email-masked]>
Date: Monday, November 23, 1998 12:30 PM
Subject: Re: (radius) CHAP and Shared Secret

You're missing something. The secret shared between the NAS and the
RADIUS server is used to compute an authenticator for communications
between the RADIUS server and the NAS (think of it as a form of
integrity check and a form of authentication of the sender to
the recipient of any particular message). But this has nothing
to do with how a server validates a user.

-paul

-

---

From: "Dmitry G. Goncharenko" <[email-masked]>
Date: Mon, 23 Nov 1998 13:19:57 -0800

Thanx, now it's clear.

-----Original Message-----
From: Alan DeKok <[email-masked]>
To: [email-masked] <[email-masked]>
Date: Monday, November 23, 1998 12:55 PM
Subject: Re: (radius) CHAP and Shared Secret

-