Theft of password.

[Tahseen Hussain]

Hello Everybody,

We are dealing with secuirty problems of Radius in proxy chaining setup
whre end-to-end security is missing. According to RFC 2607 (Proxy Chaining
and Policy Implementation in Roaming) follwing are the security threats :

 Message editing
 Attribute editing
 Theft of passwords
 Theft and modification of accounting data
 Replay attacks
 Connection hijacking
 Fraudulent accounting

We are particulary intrested to solve the problem of Theft of password.
Our idea is based on the assumtion each remote or home Radius server will
have its own key pair (public and private key). whenever a user is in some
other domain, then the user will sends it's passwrod encrypted with the
public key of its home radius sever and send to NAS of visting domain,
which will further encrypt and send to its Radius server which will
forward to the Remote Radius server.

Upon receving Access-request remote radius server as a first step decrypt
the  password field  with the shared secret between itself and proxy
radius server  residing a hop before remote server. And finally the remote
server decrypt the passwod field with its private key. Now the password is
in clear text for authenticaiton. The advantage of this scheme is proxy
radius server  cannot see password in clear text.

We are planning to implement this feature. I would like to hear feedback
and comments on this scheme. Is there any other way to overcome theft of
password threat?

Thanks in advance.

Tahseen