October 2002
Intermediate to advanced
206 pages
8h 30m
English
Content preview from RADIUSBecome an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
Authenticator
The authenticator region, often 16 octets long, is the field in which the integrity of the message’s payload is inspected and verified. In this field, the most important octet is transmitted before any other—the value used to authenticate replies from the RADIUS server. This value is also used in the mechanism to conceal passwords.
There are two specific types of authenticator values: the request and
response values. Request authenticators
are
used
with
Access-Request and
Accounting-Request packets. In the request value,
the field is 16 octets long and is generated on a completely random
basis so as to thwart any attacks. While RADIUS
doesn’t make a provision for protecting
communication against wiretapping and packet capture, random values
coupled with a strong password make attacking and snooping difficult.
The response authenticator is used in
Access-Accept, Access-Reject,
and Access-Challenge packets. The value is
calculated using a one-way MD5 hash generated from the values of the
code, identifier, length, and request-authenticator regions of the
packet header, followed by the packet payload and the shared secret.
(I’ll cover shared secrets in detail later in this
chapter.) Example 2-1
shows an equation to
represent how this
hash is computed.
Example 2-1. From RFC 2865, the MD5 hash for the response authenticator header field
ResponseAuth = MD5(Code+ID+Length+RequestAuth+Attributes+Secret)
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.