[{"author": "Alan DeKok", "text": "

Apologies to Christopher to making him look at 1993 era technology :(

", "time": "2026-03-19T08:31:12.000Z"}, {"author": "Paul Wouters", "text": "

tacaccs?

", "time": "2026-03-19T08:31:43.000Z"}, {"author": "Alexander Clouter", "text": "

could be worse, could be from 2026 :)

", "time": "2026-03-19T08:31:47.000Z"}, {"author": "Alan DeKok", "text": "

tacacs is 1997. so a new comer!

", "time": "2026-03-19T08:32:00.000Z"}, {"author": "Margaret Cullen", "text": "

RADIUS: 30 years old and still going strong!

", "time": "2026-03-19T08:32:08.000Z"}, {"author": "Alan DeKok", "text": "

if there's controversy, it's more important to get the document published than to address 30 year-old issues. Just a sentence on \"PMTU is hard, be aware of it\"

", "time": "2026-03-19T08:46:26.000Z"}, {"author": "Paul Wouters", "text": "

hard to hear you valery

", "time": "2026-03-19T08:47:13.000Z"}, {"author": "Paul Wouters", "text": "

yeah i dont think that is needed

", "time": "2026-03-19T08:48:35.000Z"}, {"author": "Paul Wouters", "text": "

yes what margaret says

", "time": "2026-03-19T08:49:38.000Z"}, {"author": "Valery Smyslov", "text": "

@Paul: Should I speak loudly?

", "time": "2026-03-19T08:52:03.000Z"}, {"author": "Margaret Cullen", "text": "

I agree with Chris and Paul. There is no need for any changes that would invalidate existing implementions or change anything that is sent over the \"wire\".

", "time": "2026-03-19T08:52:28.000Z"}, {"author": "Margaret Cullen", "text": "

Should we talk to the EMU group about deprecathing EAP-PAP and EAP-MSCHAP?

", "time": "2026-03-19T09:03:26.000Z"}, {"author": "Alan DeKok", "text": "

EAP-MSCHAP is an expired I-D. :(

\n

CHAP and MS-CHAP are safe when used inside of a tunnel, e.g. TTLS or PEAP. TTLS is informational, and PEAP is an expired I-D.

", "time": "2026-03-19T09:04:22.000Z"}, {"author": "Margaret Cullen", "text": "

PEAP is an expired ID, but it is also (by far) the most widely used EAP method in US eduroam... :0(

", "time": "2026-03-19T09:06:35.000Z"}, {"author": "Heikki Vatiainen", "text": "

A document that says the various CHAPs shouldn't be used would also be useful because CHAP especially doesn't allow password hashes on the authentication server side.

", "time": "2026-03-19T09:06:37.000Z"}, {"author": "Margaret Cullen", "text": "

I wonder if we should formally deprecate using MS-CHAP and PAP outside of seure EAP tunnels? Specifically because we don't want anyone to decide they would be safe to use in RadSec?

", "time": "2026-03-19T09:08:13.000Z"}, {"author": "Christian Giese", "text": "

I like more the statement to consider CHAP as insecure as plaintext, but it will continued to be used for CPE interoperability. So would not say depreciated or should not be used.

", "time": "2026-03-19T09:09:14.000Z"}, {"author": "Christopher Inacio", "text": "

he hasn't

\n

but he knows Paul's contact info

", "time": "2026-03-19T09:09:14.000Z"}, {"author": "Paul Wouters", "text": "

yes Chris will need to continue the recharter process

", "time": "2026-03-19T09:09:50.000Z"}, {"author": "Paul Wouters", "text": "

Deb and I will help him pressing the right buttons

", "time": "2026-03-19T09:10:33.000Z"}, {"author": "Alan DeKok", "text": "

@christian - I think the security reviews will raise a red flag if we don't deprecate something which sends clear-text passwords across the internet

", "time": "2026-03-19T09:17:35.000Z"}, {"author": "Alan DeKok", "text": "

so the document really needs to deprecate CHAP. CPEs can still use it for historical reasons, of course. a \"deprecation\" statement does not forbid people from continuing with existing practices

", "time": "2026-03-19T09:18:29.000Z"}, {"author": "Christian Giese", "text": "

I'm just looking from a point of view from maybe hundreds of millions of PPPoE based CPE devices for broadband access using PAP and CHAP.

", "time": "2026-03-19T09:18:53.000Z"}, {"author": "Paul Wouters", "text": "

thanks for the meeting. i will go sleep now :)

", "time": "2026-03-19T09:21:39.000Z"}, {"author": "Paul Wouters", "text": "

also lack of sleep :)

", "time": "2026-03-19T09:21:48.000Z"}, {"author": "Alan DeKok", "text": "

yes. Like the BlastRADIUS issue, a lot of people went \"meh, we'll eventually address that\".

\n

The goal of the document is really to highlight the security issues, and to encourage people to move to secure practices

", "time": "2026-03-19T09:21:58.000Z"}, {"author": "Heikki Vatiainen", "text": "

The CHAP variants don't allow storing strong password hashes. A document that points out this too would be useful

", "time": "2026-03-19T09:23:10.000Z"}, {"author": "Alan DeKok", "text": "

the \"review RADIUS\" document has a long section about data storage and CHAP vs PAP

", "time": "2026-03-19T09:23:38.000Z"}, {"author": "Heikki Vatiainen", "text": "

That's good

", "time": "2026-03-19T09:24:05.000Z"}, {"author": "Alan DeKok", "text": "

in part to address the many, many, nonsensical pages on the net which claim \"CHAP is more secure than PAP\". which are all based in the same ~1997 era article

", "time": "2026-03-19T09:26:40.000Z"}, {"author": "Margaret Cullen", "text": "

Thank you, everyone!

", "time": "2026-03-19T09:29:34.000Z"}, {"author": "Paul Wouters", "text": "

thanks and goodnight!

", "time": "2026-03-19T09:29:37.000Z"}, {"author": "Alan DeKok", "text": "

thanks everyone

", "time": "2026-03-19T09:30:45.000Z"}, {"author": "Margaret Cullen", "text": "

Inside RadSec isn't secure unless you have a closed network and know it won't be tunnelled to RADIUS/UDP

", "time": "2026-03-19T09:30:54.000Z"}, {"author": "Alan DeKok", "text": "

yup. :(

", "time": "2026-03-19T09:31:03.000Z"}, {"author": "Joey Padden", "text": "

thanks everyone. my first radext meeting. Very productive.

", "time": "2026-03-19T09:31:14.000Z"}, {"author": "Margaret Cullen", "text": "

Welcome, Joey!

", "time": "2026-03-19T09:31:26.000Z"}, {"author": "Heikki Vatiainen", "text": "

Hello Joey, thanks!

", "time": "2026-03-19T09:31:31.000Z"}]