EAP 101

EAP (Extensible Authentication Protocol) is a general protocol for authentication that supports multiple authentication methods. EAP doesn't specify the type of authentication to use, but rather the authentication steps
EAP consists of 4 packets:
  • EAP Request: Authenticator sends the request packe to the supplicant.
  • EAP Response: The suplicant sends the response packet to the authenticator and uses a sequence number to identify each request.
    • One response could be NAK which means the authentication method is not supported
  • EAP Success: The authenticator sends the success packet to the supplicant after a succesful authentication
  • EAP Failure: The authenticator sends the success packet to the supplicant after a failed authentication

EAP Types

The most common forms of EAP are:
EAP Types
EAP-TLS
PEAP
EAP-FAST
EAP-TTLS
LEAP
Mutual Authentication
YES
YES
YES
YES
YES
Client certificate required
YES
NO
NO
NO
NO
Server certificate required
YES
YES
Optional
YES
NO
Wi-Fi Security
Very High
High
High
High
Medium
Provider
Microsoft
Microsoft, Cisco
Cisco
Funk (Juniper)
Cisco
Rogue AP Detection
No
No
Yes
No
No

EAP-TLS

It is very secure but requires client certificates so a PKI infrastructure should be in place.

PEAP

It requires only server side certificate and it is supported by Cisco and Microsoft. There are 2 implementations: PEAP-GTC (generic implementation) and PEAP-MS-CHAPv2 (works with Microsoft AD)

EAP-FAST

It aims to provide as much security as EAP-TLS but without the need to manage certificates on client or server side.