Subject: (radius) Security Considerations text

From: Carl Rigney <[email-masked]>
Date: Wed, 5 Jan 2000 04:02:01 -0800 (PST)

Here's the text I plan to put into Security Considerations of the new
RADIUS draft.  The authors for the RADIUS Tunneling draft should insert
similar language (for Tunnel-Password instead of Password) and also
insert an IANA Considerations section into their draft (feel free to
borrow the one from my latest RADIUS draft).  Please make these changes
and submit the update to the Internet-Drafts directory by this Friday
1/7 so things can move along.  I'll have the new RADIUS draft submitted
Wednesday.

  The User-Password hiding mechanism described in Section 5.2 has not
  been subjected to significant amounts of cryptanalysis in the published
  literature.  Some in the IETF community are concerned that this method
  might not provide sufficient confidentiality protection [14] to
  passwords transmitted using RADIUS.  Users should evaluate their threat
  environment and consider whether additional security mechanisms should
  be employed.

[14] Dobbertin, H., "The Status of MD5 After a Recent Attack."
CryptoBytes Vol.2 No.2, Summer 1996.

Suggestions for wordsmithing the language to be more useful are gratefully
accepted, if you send them Wednesday.

--
Carl Rigney
RADIUS WG Chair
[email-masked]

"It doesn't have to finish but it has to end."
-
To unsubscribe, email [email-masked]' with
'unsubscribe ietf-radius' in the body of the message.