...
Authentication is accomplished using a federated RADIUS server infrastructure. As an SU user, you must log in with your full email address to identify which RADIUS server in the eduroam infrastructure should handle your authentication attempt.
When you enter your credentials at a participating eduroam institution, the authentication dialogue is encrypted between your client device and SU’s RADIUS servers. Additionally, the authentication method used by SU is a challenge-response mechanism, so your client device never actually sends your password over the network.