Radiator 10 performance with EAP-TLSv1.3

With people’s ever-increasing online activity, communication service providers are faced with increasingly growing performance requirements for their networks. And while computing power grows as well, not all software can utilise the resources and scale to meet these increasing performance requirements.

We’ve closely monitored the feedback from our existing and prospective customers, and designed and built a new policy engine, Radiator 10, from ground up to handle the highest performance requirements, setting the bar for what the performance of a modern RADIUS server should look like.

We conducted a case study to showcase how our product excels in EAP-TLS authentication, demonstrating its ability to process an industry-leading number of authentication transactions per second. In this case study, we showcase how our solution not only enhances security but also delivers unparalleled authentication speed, ensuring smooth and secure access for thousands of users simultaneously.

Case study

The performance tests were conducted on standard-sized Google Compute Engine machines using a bash script to repeatedly execute the eapol_test tool for EAP-TLS authentication. The testing was done with two deployments, one for RADIUS/UDP and one for RadSec.

In the RADIUS/UDP deployment, the Client instances sent direct EAP-TLS authentication requests to authenticating Radiator 10 instance. In the RadSec deployment, Client instances sent RADIUS EAP-TLS authentication requests to Radiator 10 proxy instances, which proxied the requests over RadSec to an authenticating Radiator 10 instance.

For more information about the test setups, please see the case study paper here.

Results

The tests concluded that on the test setup, Radiator 10 could process over 4200 RADIUS EAP-TLSv1.3 requests per second. With parallel RadSec connections from four proxy instances, Radiator processed over 9900 EAP-TLSv1.3 authentications per second. With an average EAP-TLS request requiring 8.4 total RADIUS packet exchanges, this means that Radiator 10 exchanged over 83 000 RADIUS packets per second over the 3 500 000 EAP-TLS authentication test set.

For more results and considerations, please see the case study paper here.

If you have questions about the performance testing, or want to discuss how Radiator 10 products, Radiator Policy Server and Radiator Core, could help you scale up your deployment, please do not hesitate to contact sales@radiatorsoftware.com

Radiator supports EAP-TLS 1.3

One of the most used authentication methods for Radiator users is EAP-TLS. It is widely supported among wireless vendors and the support for EAP-TLS is needed for different certifications for wireless authentication. Radiator has supported different versions of EAP-TLS from the start. As we want to be in the forefront of industry standards, we are happy to announce that Radiator now supports EAP-TLS 1.3 - our team has also been involved in the standardisation work for EAP-TLS and other TLS-based EAP methods.

What is new in EAP-TLS 1.3?

The key feature in EAP-TLS 1.3 is increased privacy and security. Like the RFC document says “TLS 1.3 is in large part a complete remodeling of the TLS handshake protocol including a different message flow, different handshake messages, different key schedule, different cipher suites, different resumption mechanism, different privacy protection, and different record padding.” This new remodeled TLS handshake protocol ensures faster TLS connections as well as patches previous security errors TLS 1.2 had.

Especially important in this new version for EAP-TLS is that no information about the underlying peer identity is disclosed. In other words this means that with EAP-TLS 1.3 the certificate of the user is delivered encrypted. In previous versions of EAP-TLS the client certificate was delivered without encryption, providing a possibility of tracking the users. This has been an issue for some users of EAP-TLS discouraging its deployment. To increase the security of your organization, Radiator configuration allows you to enable EAP-TLS 1.3 for devices that support it, while the earlier versions of EAP-TLS are still available for older devices. Radiator AAA Server Software and its modules are actively developed and updated to support state-of-the-art AAA security features. With the most recent Radiator SIM Pack patch, Radiator now supports IMSI Privacy as well - as one of the few AAA software vendors. So, in short, Radiator is committed to stay in the frontlines of all AAA security features at all times.

Would you like to know more?

While the support for TLS v1.3 in some operating systems varies, the Radiator implementation of TLS v1.3 and EAP-TLS is currently available in the testing branch of Radiator, but will be included in the next stable release as well. If ou are interested please test and give us feedback about the implementation.

If you want to know more about Radiator and EAP-TLS 1.3, please do not hesitate to contact our sales team at info(a)radiatorsoftware.com. For full list of Radiator technical features, you can also visit the Radiator AAA Server Software product page.

Radiator version 4.16 released!

We are pleased to announce that Radiator version 4.16 is now released! As always, a new version contains a new set of features. We wish also thank all those active Radiator users who have given us feedback and ideas for new features.

Revision 4.16 includes among others:

• Compatibility update for EAP-based TLS methods for clients that support TLS 1.2. Examples are the future Apple iOS and OS X releases and Android 6 Marshmallow.
• Two important security fixes. OSC recommends all users to review OSC security advisory OSC-SEC-2015-02 
• Radiator now supports new module AddressAllocator DHCPv6 for IPv6 address allocation and prefix delegation

Full history of revisions can also be found from Radiator website

Interested in Radiator?

Please contact our team at sales(a.t.)radiatorsoftware.com for more info.