Saint Blast-RADIUS, Who Blew Up MD5

Patron of protocols from the nineties, MD5 signatures, and network admins who say "it's internal anyway".

Life

On 9 July 2024 a group of cryptographers from universities and companies, including Nadia Heninger and Marc Stevens, showed that RADIUS, the protocol that authenticates users of VPNs, Wi-Fi and network gear, still trusted a signature built on MD5. With a chosen-prefix collision, an attacker in the middle could turn an "access denied" into an "access granted". The blast radius: every corporate network on Earth.

Prayer

O Saint Blast-RADIUS, who turns a no into a yes, let our servers demand a Message-Authenticator on every packet. Amen.

How to celebrate

Celebrated by updating RADIUS servers and clients, making Message-Authenticator mandatory and, where possible, wrapping everything in TLS.

Sign with MD5 and you sign in the sand.