RADIUS is a widely deployed remote authentication protocol. I'm looking here at its use in wireless roaming. The RADIUS protocol allows for proxies and chains of proxies:
|CLIENT|<->|Access Point|<=>|RADIUS server|<=>|RADIUS proxy|<=>|RADIUS Server|<->|LDAP|
where the Client's authentication request is relayed down a chain of RADIUS proxies until it is fulfilled by the client's home server and directory (AD or LDAP). Let's assume that a client is using MSCHAPv2 to authenticate - an unsafe but not uncommon choice. So an access point would use EAP to negotiate MSCHAPv2 authentication for the client, proxying the authentication back to the user's home server. I have questions about the risk of exposure of user credentials at the proxy:
(1) In this scenario, are the client's MS-CHAPv2/EAP credentials protected end-to-end? Or does the RADIUS proxy have unprotected access to the user's credentials and so could mount a Moxie Marlinspike attack against the user's data stream?
The scenario here is that an attacker gains control of the RADIUS proxy server and can then try to crack the authentication streams passing through it. If the authentication streams are protected end-to-end, for example in a encrypted tunnel, then this attack becomes much more difficult.
(2) A related scenario is that a compromised RADIUS proxy is unable to access the protected MS-CHAPv2 bits, but instead can see unprotected user names and harvest them for later offline attacks. Is this possible, or can the RADIUS proxy only see the realm but not the full user name?
I am asking specifically about RADIUS proxies here. Also, an answer like "don't use MSCHAPv2" is not useful since we have a large installed base of devices that don't have an alternative at the present time; I am looking to minimize risk until an alternative is available.
