Improved hash and transmission method for larger packets in the RADIUS protocol

Abstract

Remote Authentication Dial-In User Service (RADIUS) is a popular protocol for authenticating users. If the size of the request packet sent by a client is larger than a specific size, the current RADIUS protocol silently discards the request. However, request packets that use an Extensible Markup Language scheme, which contain security-related attributes, are also available. These packets are classified as larger packets, which we define as being larger than 4096 bytes. Accordingly, a packet may result in an authentication failure on account of the large packet size. In this paper, TCP is used as a transport layer protocol for the RADIUS protocol. We propose a hash and transmission method to reduce the problem of the authentication failure when the packet exceeds 4096 bytes. Through an experimental evaluation, we prove that attaching a nonce value to the user-password field with an SHA-1, and sending this information to the server, guarantees more security than the conventional RADIUS protocol.