title: RADIUS AND EAP calculating the Message-Authenticator
body: <p>I have been reading through RFC 3579 as I am implementing a RADIUS service that supports EAP-MD5 authentication. Unfortunately I am a little unsure how to interpret the RFC, particularly when trying to calculate the Message-Authenticator.</p>
  
  <p>I basically create an HMAC-MD5 object (I am using C#) use the shared secret of the NAS for the key and concatenate Type (one byte) + Identifier (one byte) + Length (two bytes) + Request Authenticator (16 bytes) + All Attributes (Except the Message-Authenticator in the Access-Request) but the calculated value does not match the value in the packet.</p>
  
  <p>Following the RFC this seems correct. Am I interpreting the RFC correctly?</p>
  
  <p>Here is the code:</p>
  
  <pre><code>RadiusPacket packet = Objects.Packet;
  
  byte[] toHMAC;
  toHMAC = new byte[1] { (byte)packet.Code };
  toHMAC = ByteArray.Combine(toHMAC, new byte[1] { packet.Identifier });
  // reversed to match endian of packet
  toHMAC = ByteArray.Combine(toHMAC, ByteArray.Reverse(packet.LengthAsBytes));
  toHMAC = ByteArray.Combine(toHMAC, packet.Authenticator);
  
  for (int i = 0; i &lt; packet.Attributes.Length; i++)
  {
      if (packet.Attributes[i].Type != RadiusAttributeType.MessageAuthenticator)
      {
          toHMAC = ByteArray.Combine(toHMAC, packet.Attributes[i].RawData);
      }
  }
  
  HMACMD5 md5 = new HMACMD5(Encoding.ASCII.GetBytes(Objects.NAS.SharedSecret));
  
  // this DOES NOT match what is in the received packet...
  byte[] hmac = md5.ComputeHash(toHMAC);
  </code></pre>
  
  <p>Any help would be much appreciated.</p>