Green Rocket Security has added RadSec to the supported protocols. RadSec is a secure extension of RADIUS that uses TCP and TLS to encrypt all RADIUS communications, providing stronger protection over untrusted networks.
Overview of RADIUS
RADIUS is a widely used protocol for authentication, authorization, and accounting (AAA) in networks. It primarily operates over UDP, transmitting attribute-value pairs (AVPs) to verify user credentials and authorize network access.
Overview of RadSec
RadSec (RADIUS over TLS) is an enhancement of RADIUS designed to secure communications over untrusted networks. It uses TCP for reliable transport and TLS for encryption, ensuring that all RADIUS messages carried over the TLS connection—including authentication requests, accounting messages, and control messages—are fully encrypted. RadSec employs mutual TLS authentication, where both client and server verify each other’s certificates, help to prevent man-in-the-middle attacks and protect privacy. It is particularly useful in roaming environments where RADIUS traffic traverses multiple administrative domains or the public internet.
Key Differences
| Feature | RADIUS | RadSec |
| Transport Protocol | UDP | TCP |
| Encryption | MD5-based shared secret | TLS (full encryption of all data in the communication) |
| Security | Shared-secret-based protection, with message integrity verification when Message-Authenticator is enforced | Strong protection against privacy and security breaches |
| Use Case | Trusted internal networks | Untrusted networks, roaming |
| Performance | Fast, lightweight traffic | Higher overhead due to TCP and TLS |
| Complexity | Simple to deploy | Requires TLS certificate management and additional setup |
When to Use Each
RADIUS is suitable for internal networks with appropriate network security controls and where compatibility with legacy devices is important.
RadSec is recommended when RADIUS traffic must traverse untrusted networks, such as public internet, cloud environments, or roaming scenarios, due to its robust encryption and privacy protection.
Even if using EAP-TLS or EAP-TTLS, which encrypts client-server communication, RadSec adds an extra layer by encrypting the entire RADIUS channel, including all control and accounting messages.
Summary:
GreenRADIUS adding the RadSec protocol enhances the security of the transport layer, making it the preferred choice for modern, distributed, or high-security network environments, while GreenRADIUS classic RADIUS remains available and is a simpler option for trusted, internal deployments.
