RFC 2865
Remote Authentication Dial In User Service (RADIUS)
Standards Track Obsoletes: RFC 2138 June 2000
Abstract: RADIUS is a client/server protocol for carrying authentication, authorization, and configuration information between a NAS and a shared authentication server. While Diameter has largely replaced RADIUS in 3GPP core, RADIUS remains in use for enterprise Wi-Fi, WLAN offload, and interworking.
Canonical source: https://www.rfc-editor.org/rfc/rfc2865
| IETF Datatracker
1. Introduction
▶RADIUS provides a simple, UDP-based AAA protocol. A NAS client sends Access-Request packets to a RADIUS server, which responds with Access-Accept, Access-Reject, or Access-Challenge.
In 3GPP context, RADIUS is used for WLAN access authentication (SWa interface for untrusted WLAN) and for interworking with enterprise AAA infrastructure. Diameter-to-RADIUS translation agents bridge the two protocols.
2. RADIUS Packet Types
▶| Code | Name | Description |
|---|---|---|
| 1 | Access-Request | Client requests authentication/authorization |
| 2 | Access-Accept | Server grants access with authorization attributes |
| 3 | Access-Reject | Server denies access |
| 11 | Access-Challenge | Server requests additional credentials (EAP) |
| 4 | Accounting-Request | Client sends usage data |
| 5 | Accounting-Response | Server acknowledges accounting |
3. RADIUS vs Diameter
▶| Feature | RADIUS | Diameter |
|---|---|---|
| Transport | UDP (unreliable) | TCP/SCTP (reliable) |
| Max message size | 4096 bytes | 16 MB+ |
| Security | Shared secret MD5 | TLS/IPsec |
| Peer discovery | Static configuration | DNS SRV + capability exchange |
| Server-initiated | Not supported (workaround via CoA) | RAR, ASR (native) |
| Failover | Implementation-specific | Protocol-level (DWR/DWA) |
| Extensibility | Vendor-Specific Attributes | Grouped AVPs, applications |
4. Security Considerations
▶- RADIUS shared secret + MD5 is cryptographically weak — not suitable for high-security environments
- User-Password attribute uses reversible MD5 encryption — vulnerable to offline attacks
- RADIUS over UDP has no transport-level security — IPsec SHOULD be used
- RADIUS-to-Diameter translation must preserve security properties carefully
Deprecation Note: RADIUS is being superseded by Diameter in 3GPP deployments. New deployments should use Diameter for AAA signaling. RADIUS remains relevant for legacy interworking and enterprise WLAN integration.