Re: digest-auth negotiation issue

["Alan DeKok" <aland@ox.org>]

Henrik Nordstrom <henrik@henriknordstrom.net> wrote:
> Additionally the strength of the Digest hashing as such is also partly a 
> property of the how well the RADIUS client chooses it's nonces in this 
> mode of operation.. If the client is really poorly implemented and only 
> selects between a small set of nonces it could make Digest open to replay 
> attacks, no matter how good the RADIUS server implementation is. But the 
> opposite is also true in that in scenario 2 the client can not choose 
> stronger nonces if it is found the RADIUS server is poorly implemented...

  There are an order of magnitude or two fewer RADIUS server
implementations than clients.  For that alone, I would worry more
about poor client implementations than server implementations.

  Alan DeKok.

--
to unsubscribe send a message to radiusext-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://psg.com/lists/radiusext/>