radius has been iffy for years. its one of many protocols that should always be ipsec transformed between endpoints if at all possible.

This is the best summary I could come up with:

It has remained the de facto standard for lightweight authentication ever since and is supported in virtually all switches, routers, access points, and VPN concentrators shipped in the past two decades.

Unfortunately, MD5 proved to be based on a weak design: Within a few years, there were signs that the function might be more susceptible than originally thought to attacker-induced collisions, a fatal flaw that allows the attacker to generate two distinct inputs that produce identical outputs.

That is, the adversary freely chooses two distinct input prefixes 𝑃 and 𝑃′ of arbitrary content that, when combined with carefully corresponding suffixes 𝑆 and 𝑆′ that resemble random gibberish, generate the same hash.

To illustrate the practicality and devastating consequences of the attack, Stevens, Lenstra, and de Weger used it to create two cryptographic X.509 certificates that generated the same MD5 signature but different public keys and different Distinguished Name fields.

More than 12 years after Flame’s devastating damage was discovered and two decades after collision susceptibility was confirmed, MD5 has felled yet another widely deployed technology that has resisted common wisdom to move away from the hashing scheme—the RADIUS protocol, which is supported in hardware or software provided by at least 86 distinct vendors.

Many of the bulletins are accompanied by patches implementing short-term fixes, while a working group of engineers across the industry drafts longer-term solutions.

The original article contains 830 words, the summary contains 226 words. Saved 73%. I’m a bot and I’m open source!

The Blast-RADIUS issue is a good reminder that network security should not depend on a single layer of authentication. Along with applying vendor patches and recommended protocol protections, businesses can reduce credential-related risks by requiring a second verification step for network access. Protectimus RADIUS authentication with MFA can add this extra check to existing RADIUS environments, helping secure VPN and other network access while still working with Active Directory or LDAP. This layered approach gives enterprise IT teams stronger control over who can access internal resources.