The Wi-Fi you’re using right now might be secured by a protocol from the age of dial-up modems. It’s called RADIUS, and its design, born of necessity in 1991, is a masterclass in pragmatic engineering that explains its incredible longevity.
A World of Squealing Modems and Scarce Resources
To understand
RADIUS, you have to picture the internet of the early 1990s. This was the era of dial-up, where users connected to Internet Service Providers (ISPs) through screeching modems. A company called Livingston Enterprises was building hardware called a Network Access Server (NAS) that handled thousands of these incoming calls. They faced a huge problem: how do you check the username and password for every user without overwhelming the NAS, which had severely limited processing power and memory? Storing a huge database of users on every NAS was inefficient and a security nightmare. They needed a way to centralize authentication.
The AAA Philosophy: Keep It Simple, Server
Livingston's solution, RADIUS (Remote Authentication Dial-In User Service), was built on a simple and robust 'AAA' framework: Authentication, Authorization, and Accounting. The NAS (the 'client') didn't need to be smart. It just needed to package up a user's credentials and ask a central, more powerful RADIUS server for permission. The server would then check the credentials and send back one of three simple responses: 'Access-Accept,' 'Access-Reject,' or 'Access-Challenge.' This distributed model kept the hardware on the front lines dumb and cheap, while the central server did the heavy lifting. Once a user was authenticated and authorized, the server would then simply account for their session time and data usage.
The UDP Choice: A Bet on Speed Over Certainty
One of the most crucial, and often misunderstood, design choices was using UDP (User Datagram Protocol) instead of the more reliable TCP. TCP establishes a formal connection and guarantees every packet arrives in order, but that requires memory and processing power to maintain the connection's state. UDP is 'fire-and-forget'; it just sends the packet. For the low-powered NAS devices of the 90s, this was a perfect tradeoff. A failed login attempt wasn't catastrophic; the user would just try again. The protocol's designers correctly gambled that a user would rather have a fast response (or re-try a failed one) than wait for a slow, resource-intensive TCP handshake to complete. The RADIUS application itself would handle retransmissions to a backup server if the primary was down, making TCP's reliability features redundant.
A Future-Proof Stroke of Genius: Vendor_Specific Attributes
Perhaps the most brilliant aspect of RADIUS's design was its extensibility. The protocol used a system of attributes to carry information. While there were standard attributes, the specification included a special one called the Vendor_Specific Attribute, or VSA. This allowed hardware makers like Cisco, and later countless others, to add their own custom functionality without breaking the core protocol. A vendor could use a VSA to pass along information for a proprietary feature, like what speed a user's connection should be or which IP address pool they should use. This flexibility was key to its widespread adoption, as it let the entire industry innovate on top of a single, stable standard.
