I am considering the implementation of a 2 Factor Authentication server and I am concerned that the RADIUS authentication via Shared Secret is not secure enough as for example an attacker could at least steal the usernames. I am wondering if the following communication could be un-encrypted easily: enter image description here

  • Usernames are not typically considered secret. I'm not seeing anything in the screenshot that is encrypted (or anything that is supposed to be). So, I'm not sure what your question is. – schroeder Mar 6 '17 at 12:47
  • Things will also depend on your RADIUS provider and how they secure things on their service. If you are asking about the security of RADIUS in general, we can help, but we won't perform a secure review of a particular product. – schroeder Mar 6 '17 at 12:49
  • is that RADIUS client software really 14 years old? – schroeder Mar 6 '17 at 12:49
  • NTRadping rocks! – cornelinux Mar 6 '17 at 13:46
  • Yes, an attacker could steal the username. An attacker could also steal the username by shoulder surfing. The password in encrypted using the shared secret. Which you might not consifer state of the art. As you are transmitting a one time password, this might not be that criticial if an attacker is able to decrypt this. But nevertheless: If possible I would recommend having a "trusted" network or encryption (like VPN) between the RADIUS client and the RADIUS server. – cornelinux Mar 6 '17 at 13:48

The way most 2FA services for RADIUS work is by acting as a server hosted locally or in the cloud that authenticates RADIUS requests from agents, and then sends the request to their own servers using their own protocols (disclosure: I work for such a company and have studied and built such services).

That means the data flows like so:

[You] => [VPN|router|service|etc] => [agent] => [2FA RADIUS server] => [2FA service]

There are a number of places to attack:

  • between you and the VPN-thing: one would hope this is protected through other means. This would likely require a man-in-the-middle attack.
  • between the VPN-thing and the agent: they're usually the same thing, so it's either an in-memory attack, or an IPC attack. This means you'd need to be on the same box with elevated privileges.
  • between the agent the 2FA RADIUS server: I suspect this is your biggest concern. It's the RADIUS protocol, which means it's dependent on what auth mechanism it's using for the user. Most use PAP, which uses a shared key to "encrypt" and "decrypt" just the password (quotes meaning it's a bit iffy). This would likely require a man-in-the-middle attack.
  • Between the 2FA RADIUS server and the 2FA web services: one would also hope this is protected through other means. This would likely require a man-in-the-middle attack.

So what does this mean? Yes, someone can read everything but the password in your RADIUS requests if they get between the agent and the server. This is somewhat trivial if the server is in the cloud. It's a little more difficult if the RADIUS server is on the same closed network as the agent. It's debatable whether an attacker can decrypt the password, as it's dependent on the strength of the shared secret, and how many packets they can steal.

Additionally, you have the shared secret if you're communicating directly with the RADIUS server. If everyone has the same shared secret then anyone can decrypt anyone's password.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.