Remote Authentication Protocol

Remote Authentication is like presenting a passport.

The full name of the Remote Authentication Protocol is the Remote Authentication Dial In User Service Protocol. This long name is abbreviated to RADIUS. It was designed as a method to authenticate access to a network but became particularly used by Internet Service Providers (ISPs) to manage dial-up Internet access.

Function

Remote Authentication Servers centralize access authentication tasks in a separate machine. The RADIUS protocol also includes account management functions which were particularly useful for ISPs. The end user does not communicate directly with the RADIUS server, but logs in to the Network Access Server (NAS). It is the NAS that communicates with the RADIUS server to authenticate the accessing user.

Features

Security during the transaction to authenticate a user is carried out by a "shared secret" system. That means that passwords do not need to be sent across the network. Both the NAS and RADIUS server modify a challenge phrase with a formula which incorporates the password.

Development

The use of RADIUS servers for Internet access was killed by Broadband. With broadband, the user's service is always available and does not require a log-in to the network.

References

• Untruth: An Analysis of the RADIUS Authentication Protocol
• Internet Engineering Task Force: Request for Comments 2865
• Internet Engineering Task Force: Request for Comments 2866