Internet access and telco usage patterns

Date: Mon, 8 Jul 1996 13:30:28 -0700 (PDT)
From: Michael Dillon <>

> So, the only "secrets" that are shared are the md5 digest keys used
> between the RADIUS server and TS.

Not quite. The user must "share" their password with the first RADIUS
client in order for it to be encrypted via MD5 in the first place. There
is a hole here. But there is a solution as well.

Not true with CHAP. Nothing knows the user's secret but the user
and the eventual auth server.

Barney Wolff <>