AuthHound

Microsoft VSA · attr 16 · type octets

MS-MPPE-Send-Key

MS-MPPE-Send-Key is an encrypted-key VSA (vendor 311, attribute 16) paired with MS-MPPE-Recv-Key; together they carry the session keys from the RADIUS server to the access point.

Also searched as: MPPE send key. Defined in RFC 2548 (Microsoft vendor 311).

What it means

MS-MPPE-Send-Key and MS-MPPE-Recv-Key always travel together on a successful EAP Access-Accept. They deliver the encryption keys, protected under the RADIUS shared secret, that the access point uses to secure the client's Wi-Fi session. Neither is meaningful alone, and neither is something an admin sets — they're generated from the EAP exchange.

How it's used

Generated automatically by the EAP server; there's nothing to configure. The only operational concern is ensuring every hop between server and AP preserves vendor attributes and shares the correct secret.

Common gotchas

  • Same failure mode as MS-MPPE-Recv-Key: strip or corrupt the pair in transit and you get a clean auth log with no working Wi-Fi.

Stop guessing which hop has the wrong secret: the open-source authhound-probe cryptographically verifies the shared secret with one test request — a pass proves the secret matches — and reports whether replies carry Message-Authenticator (the BlastRADIUS fix) while it’s at it. 

export AUTHHOUND_RADIUS_SECRET='shared-secret'   # not in argv or shell history
authhound-probe radius test --server radius.corp.com --peap alice

Recipe: check your BlastRADIUS exposure

Related

When a NAS quietly stops honoring an attribute across a fleet, nobody sees it until users complain. AuthHound is building monitoring that tracks the attributes your servers actually return — early access:

No spam, no sharing — one email when it's ready, and you can reply to be removed anytime.