Protected Extensible Authentication Protocol: Difference between revisions

Revision as of 15:33, 14 November 2013

Revision as of 21:21, 14 November 2013

Line 36:

As with other 802.1X and EAP types, dynamic encryption can be used with PEAP.

A CA certificate must be used at each client to authenticate the server to each client before the client submits authentication credentials. If the CA certificate is not validated, in general it is trivial to introduce a fake Wireless Access Point which then allows gathering [[MS-CHAPv2]] of handshakes <ref name="Man-in-the-Middle in Tunneled Authentication Protocols">{{Citationcite neededweb|datetitle=Man-in-the-Middle in Tunneled Authentication Protocols|url=http://eprint.iacr.org/2002/163.pdf|publisher=Nokia Research Center|accessdate=14 November 2013}}</ref>. On recent hardware those handshakes can be cracked quickly.

== PEAPv1 with EAP-GTC ==