We have a Sonicwall SRA server configured to authenticate users using RADIUS to a Windows NPS Server running on Windows Server 2012 R2.

It all works fine EXCEPT when passwords contain the "£" character.

According to the RADIUS spec on page 24 the password field

contains UTF-8 encoded 10646 characters and String contains 8-bit binary data

I found a website that defines the pound sign as

0xC2 0xA3 (c2a3)

I hacked together a fairly ugly perl script to implement the RADIUS password encryption for short passwords (<= 16 octets) using simple MD5 hashing and XORing (I'm no perl expert so I know its not pretty!)

#! /usr/bin/perl -w
use 5.010;
use Digest::MD5 qw(md5 md5_hex md5_base64);
use MIME::Base64;
use Carp qw/croak/;
use List::Util qw/max/;

$secret = "verysecret";
$authenticator = '5354ff6a10cec708f2da74a8b268b98d';
$pwd = "££££££££";
$pwdhex = $pwd;

# Convert password to a Hex string
$pwdhex =~ s/(.)/sprintf("%02x",ord($1))/eg;

print "Password in HEX = " .$pwdhex . "\n";
print "Password in ASCII " .$pwd . "\n";

# Convert RA from Hex string into bytes
$authenticator =~ s/([a-fA-F0-9][a-fA-F0-9])/chr(hex($1))/eg;

# Concatenante the secret and authenticator then MD5 them
$md5input = $secret . $authenticator;
$md5 = md5($md5input);
$md5hex = $md5;
$md5hex =~ s/(.)/sprintf("%02x",ord($1))/eg;
print "Secret + RA (MD5)             " . $md5hex . "\n";

state $encryptedpassword = $md5 ^ $pwd;

$encryptedpassword =~ s/(.)/sprintf("%02x",ord($1))/eg;

print "Computed Encrypted Password = " . $encryptedpassword . "\n";

Using a network trace of the RADIUS traffic I was able to show that the password was being correctly encrypted using c2a3 for each pound sign.

I was going to raise a ticket with Microsoft next as it looks like a problem in their Radius server implementation in NPS but thought I'd post this rather interesting puzzle here first in case anyone had seen anything similar.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.