Radius/UDP. How legacy protocols need to keep up with modern cryptography(blog.cloudflare.com)
blog.cloudflare.com
Radius/UDP. How legacy protocols need to keep up with modern cryptography
https://blog.cloudflare.com/radius-udp-vulnerable-md5-attack
2 comments
There is a typo in the document. It should read "RADIUS over TLS or DTLS" not "RADIUS over TLS or DLTS" (above the second image). The "DLTS" is wrong.
Huh. Most people who care have already moved to Diameter (this is not a joke, that’s the actual name of the new protocol).
The paper https://www.blastradius.fail/pdf/radius.pdf) explicitly states DIAMETER "never replaced RADIUS for many common use cases" and "the protocol itself offers no security when used over TCP". So unless the DIAMETER traffic is isolated or tunneled, it's arguably less secure than RADIUS/TLS.
That paper is completely outdated (newest references are from 2016) or just badly researched.
3GPP references several RFCs for Diameter security (including TLS), and every single 5G network on the planet uses it (I work in telco).
Even Wikipedia is more accurate: https://en.wikipedia.org/wiki/Diameter_(protocol)
3GPP references several RFCs for Diameter security (including TLS), and every single 5G network on the planet uses it (I work in telco).
Even Wikipedia is more accurate: https://en.wikipedia.org/wiki/Diameter_(protocol)
I work in telco, too - by my read, they're not disagreeing:
"5G completely replaced DIAMETER with signaling over HTTP/2. DIAMETER is only used in legacy systems that has not yet been updated. Early 5G can be deployed as Non-standalone (NSA) or standalone (SA). NSA means a 4G core with 5G radio while SA means both 5G core and 5G radio. NSA has a lot of severe limitations. Many networks are already SA and the rest are working on rolling out SA."
Although Diameter was intended to replace RADIUS, the
protocol itself offers no security when used over TCP. As a
result, RFC 6733 suggests that Diameter messages should
be secured using TLS or DTLS; 5G has replaced Diameter
with signaling over HTTP/2 [30].
"5G completely replaced DIAMETER with signaling over HTTP/2. DIAMETER is only used in legacy systems that has not yet been updated. Early 5G can be deployed as Non-standalone (NSA) or standalone (SA). NSA means a 4G core with 5G radio while SA means both 5G core and 5G radio. NSA has a lot of severe limitations. Many networks are already SA and the rest are working on rolling out SA."
Not in the Enterprise WiFi space they haven’t, it’s ubiquitous there. Though that tends to be over trusted networks or Radsec if you’re doing it right.
No we haven't. Maybe on the planet you live on all of your vendors have GA'ed enterprise grade Diameter support, but our folks still support dozens of products that haven't.