Protected Extensible Authentication Protocol: Difference between revisions

Revision as of 04:32, 27 January 2008

Revision as of 20:04, 27 January 2008

Line 19:

PEAPv1/EAP-GTC was created by Cisco to provide interoperability with existing token card and directory based authentication systems via a protected channel. Even though Microsoft co-invented the PEAP standard, Microsoft never added support for PEAPv1 in general, which means PEAPv1/EAP-GTC has no native [[Microsoft Windows|Windows]] OS support. Since Cisco has always favored the use of its own less secure proprietary [[Lightweight_Extensible_Authentication_Protocol|LEAP]] and [[EAP-FAST]] protocols over PEAP and markets them as simpler certificate-less solutions, standardized PEAP is rarely promoted by Cisco. Cisco stands to gain a monopoly in the access point market if LEAP or EAP-FAST is universally adopted. As a result, most Cisco customers run Cisco's proprietary LEAP or EAP-FAST authentication protocols due to their promotion by Cisco. With no interest from Microsoft to support PEAPv1 and little interest from Cisco to promote PEAP in general, PEAPv1 authentication is rarely used. There is no native [[operating system]] support for this EAP protocol.

'''Note''': The PEAP standard was created by Microsoft, Cisco, and RSA after EAP-TTLS had already come on the market. Even with its late start, Microsoft’s and Cisco’s size allowed them to quickly overtake EAP-TTLS in the market. Microsoft and Cisco parted ways when Microsoft only supported the PEAPv0 standard while Cisco supported both PEAPv0 and PEAPv1.

PEAPv0 and PEAPv1 both refer to the outer authentication method and isare the mechanismmechanisms that createscreate the secure TLS tunnel to protect subsequent authentication transactions. while EAP-MSCHAPv2, EAP-GTC, and EAP-SIM refer to the inner authentication methodmethods which facilitatesprovide user or device authentication. From Cisco’s perspective, PEAPv0 supports inner EAP methods EAP-MSCHAPv2 and EAP-SIM while PEAPv1 supports inner EAP methods EAP-GTC and EAP-SIM. Since Microsoft only supports PEAPv0 and doesn’t support PEAPv1, Microsoft simply calls PEAPv0 PEAP without the v0 or v1 designator. Another difference between Microsoft and Cisco is that Microsoft only supports only PEAPv0/EAP-MSCHAPv2 mode butand not PEAPv0/EAP-SIM mode.

However, Microsoft supports another form of PEAPv0 (which Microsoft calls PEAP-EAP-TLS) that Cisco and other third-party server and client software don’t support. PEAP-EAP-TLS does requirerequires client installation of a [[client-side]] [[digital certificate]] located on the client’s hard drive or a more secure smartcard. PEAP-EAP-TLS is very similar in operation to the original EAP-TLS but provides slightly more protection due to the fact that portions of the client certificate that are unencrypted in EAP-TLS are encrypted in PEAP-EAP-TLS. Since few third-party clients and servers support PEAP-EAP-TLS, users should probably avoid it unless they only intend to use Microsoft desktop clients and servers. Ultimately, PEAPv0/EAP-MSCHAPv2 is by far the onlymost formprevalent implementation of PEAP, thatdue mostto peoplethe willintegration everof knowPEAPv0 into Windows XP and Windows Vista (via a supplied supplicant program).

PEAP ishas been so successful in the market place that even Funk Software, the inventor and backer of [[EAP-TTLS]], had no choice but to support PEAP in their server and client software for wireless networks.

==References==