Content deleted Content added
jkk Tags: Reverted Mobile edit Mobile web edit |
m Task 18 (cosmetic): eval 20 templates: hyphenate params (26×); |
||
Line 12:
{{Main|Lightweight Extensible Authentication Protocol}}
The [[Lightweight Extensible Authentication Protocol]] (LEAP) method was developed by [[Cisco Systems]] prior to the [[IEEE]] ratification of the [[802.11i]] security standard.<ref>{{cite magazine|title=Ultimate wireless security guide: An introduction to LEAP authentication|author=George Ou|date=January 11, 2007|url=http://www.techrepublic.com/article/ultimate-wireless-security-guide-an-introduction-to-leap-authentication/|magazine= [[TechRepublic]] |
LEAP uses a modified version of [[MS-CHAP]], an [[authentication]] protocol in which user credentials are not strongly protected and easily compromised; an exploit tool called ASLEAP was released in early 2004 by Joshua Wright.<ref>{{cite web|title=Look Before You LEAP|date=October 1, 2003|author=Dan Jones|url=http://www.unstrung.com/document.asp?doc_id=41185|publisher=Unstrung|
==={{anchor|EAP-TLS}}EAP Transport Layer Security (EAP-TLS)===
EAP Transport Layer Security (EAP-TLS), defined in RFC 5216, is an IETF [[open standard]] that uses the [[Transport Layer Security]] (TLS) protocol, and is well-supported among wireless vendors. EAP-TLS is the original, standard wireless LAN EAP authentication protocol.
EAP-TLS is still considered one of the most secure EAP standards available, although TLS provides strong security only as long as the user understands potential warnings about false credentials, and is universally supported by all manufacturers of wireless LAN hardware and software. Until April 2005, EAP-TLS was the only EAP type vendors needed to certify for a WPA or WPA2 logo.<ref>{{cite web|title=Understanding the updated WPA and WPA2 standards|url=http://blogs.techrepublic.com.com/Ou/?p=67|publisher=techrepublic.com|
Unlike most TLS implementations of [[HTTPS]], such as on the [[World Wide Web]], the majority of implementations of EAP-TLS require mutual authentication using client-side [[X.509]] certificates without giving the option to disable the requirement, even though the standard does not mandate their use.<ref name="opensecurewireless"/><ref name="rfc5216s211"/> Some have identified this as having the potential to dramatically reduce adoption of EAP-TLS and prevent "open" but encrypted access points.<ref name="opensecurewireless">{{cite web|title=Open Secure Wireless |first=Christopher |last=Byrd |date=5 May 2010 |url=http://riosec.com/files/Open-Secure-Wireless.pdf |
The requirement for a client-side certificate, however unpopular it may be, is what gives EAP-TLS its authentication strength and illustrates the classic convenience vs. security trade-off. With a client-side certificate, a compromised password is not enough to break into EAP-TLS enabled systems because the intruder still needs to have the client-side certificate; indeed, a password is not even needed, as it is only used to encrypt the client-side certificate for storage. The highest security available is when the "private keys" of client-side certificate are housed in [[smart card]]s.<ref>{{cite book|url=https://books.google.com/books?id=5x7iLC7fKIAC&pg=PA244|title=Microsoft Exchange Server 2003 Unleashed|author=Rand Morimoto |author2=Kenton Gardinier |author3=Michael Noel |author4=Joe Coca|year=2003|publisher=Sams|isbn=978-0-672-32581-6|page=244}}</ref> This is because there is no way to steal a client-side certificate's corresponding private key from a smart card without stealing the card itself. It is more likely that the physical theft of a smart card would be noticed (and the smart card immediately revoked) than a (typical) password theft would be noticed. In addition, the private key on a smart card is typically encrypted using a PIN that only the owner of the smart card knows, minimizing its utility for a thief even before the card has been reported stolen and revoked.
===EAP-MD5===
EAP-MD5 was the only IETF Standards Track based EAP method when it was first defined in the original RFC for EAP, RFC 2284. It offers minimal security; the [[MD5]] [[hash function]] is vulnerable to [[dictionary attack]]s, and does not support key generation, which makes it unsuitable for use with dynamic WEP, or WPA/WPA2 enterprise. EAP-MD5 differs from other EAP methods in that it only provides authentication of the EAP peer to the EAP server but not mutual authentication. By not providing EAP server authentication, this EAP method is vulnerable to man-in-the-middle attacks.<ref>{{cite web|title = Alternative Encryption Schemes: Targeting the weaknesses in static WEP|url=https://arstechnica.com/articles/paedia/security.ars/4|website = Ars Technica |
===EAP Protected One-Time Password (EAP-POTP)===
EAP Protected One-Time Password (EAP-POTP), which is described in RFC 4793, is an EAP method developed by RSA Laboratories that uses one-time password (OTP) tokens, such as a handheld hardware device or a hardware or software module running on a personal computer, to generate authentication keys. EAP-POTP can be used to provide unilateral or mutual authentication and key material in protocols that use EAP.
The EAP-POTP method provides two-factor user authentication, meaning that a user needs both physical access to a token and knowledge of a [[personal identification number]] (PIN) to perform authentication.<ref>{{cite web|url=http://www.juniper.net/techpubs/software/aaa_802/sbrc/sbrc70/sw-sbrc-admin/html/EAP-027.html |title=EAP-POTP Authentication Protocol |publisher=Juniper.net |
===EAP Pre-Shared Key (EAP-PSK)===
Line 44:
===EAP Tunneled Transport Layer Security (EAP-TTLS)===
EAP Tunneled Transport Layer Security (EAP-TTLS) is an EAP protocol that extends [[Transport Layer Security|TLS]]. It was co-developed by [[Funk Software]] and [[Certicom]] and is widely supported across platforms. Microsoft did not incorporate native support for the EAP-TTLS protocol in [[Windows XP]], [[Windows Vista|Vista]], or [[Windows 7|7]]. Supporting TTLS on these platforms requires third-party Encryption Control Protocol (ECP) certified software. [[Microsoft Windows]] started EAP-TTLS support with [[Windows 8]],<ref>[https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh945104(v=ws.11) Extensible Authentication Protocol (EAP) Settings for Network Access]</ref> support for EAP-TTLS<ref>{{cite web|url=http://forums.wpcentral.com/windows-phone-8/200619-802-1x-eap-ttls-support.html |title=802.1x / EAP TTLS support? – Windows Phone Central Forums |publisher=Forums.wpcentral.com |
The client can, but does not have to be authenticated via a [[certificate authority|CA]]-signed [[public key infrastructure|PKI]] certificate to the server. This greatly simplifies the setup procedure since a certificate is not needed on every client.
Line 63:
===EAP Flexible Authentication via Secure Tunneling (EAP-FAST)===
Flexible Authentication via Secure Tunneling (EAP-FAST; RFC 4851) is a protocol proposal by [[Cisco Systems]] as a replacement for [[Lightweight Extensible Authentication Protocol|LEAP]].<ref>{{cite web|title=Ultimate wireless security guide: A primer on Cisco EAP-FAST authentication|url=http://articles.techrepublic.com.com/5100-1035-6148557.html|archive-url=https://web.archive.org/web/20080324094115/http://articles.techrepublic.com.com/5100-1035-6148557.html|url-status=dead|archive-date=2008-03-24|publisher=techrepublic.com|
EAP-FAST has three phases:<ref>{{cite web|url=http://www.ciscopress.com/articles/article.asp?p=369223&seqNum=5 |title=EAP-FAST > EAP Authentication Protocols for WLANs |publisher=Ciscopress.com |
{| class="wikitable"
| |||