ONT Notes – 802.1x and Encryption on LWAPs
- Traditional WLAN weaknesses
- SSID for security
- Vulnerable to rogue APs
- MAC filtering for security
- WEP
- WEP weaknesses
- Disribution of static keys is not scalable
- WEP keys can be cracked easily
- Vulnerable to dictionary attacks
- No protection against rogue APs
- Benefits of 802.1x
- Centralized authentication through Radius via AAA
- Mutual authentication between client and auth server
- Can use multiple encryption algorithms (AES, WPA, TKIP, WEP)
- Automatic dynamic WEP keys
- Roaming
- Requirements of 802.1x
- EAP-capable client (supplicant)
- 802.1x-capable AP (authenticator)
- EAP-capable auth server
| Feature | Cisco LEAP | EAP-FAST | EAP-TLS | PEAP-GTC | PEAP-MSCHAPv2 |
|---|---|---|---|---|---|
| User authentication DB | AD | AD, LDAP | OTP, LDAP, NDS, AD | OTP, LDAP, NDS, AD | AD |
| Requires server certs | No | No | Yes | Yes | Yes |
| Requires client certs | No | No | Yes | No | No |
| Single sign-on | Yes | Yes | Yes | No | Yes |
| Roaming | Yes | Yes | No | No | No |
| Works with WPA/WPA2 | Yes | Yes | Yes | Yes | Yes |
- WPA
- Features
- Authenticated key management – auths prior to key management
- Unicast and broadcast key management – keys are distributed and stored on the client and the AP
- TKIP and MIC
- Temporal Key Integrity Protocol (TKIP) – per-packet keying
- Message Integrity Checking (MIC) – integrity checking
- Initialization vector (IV) expansion – from 24 bits to 48 bits
- Shortcomings
- Relies on RC4
- Firmware support required in NICs, APs
- Susceptible to DoS attacks
- Dictionary attacks can discover PSKs
- Features
- WPA2
- Features
- 802.1x authentication or PSK
- Key distribution and renewal
- Proactive Key Caching (PKC) – allows roaming
- IDS for rogue APs and attacks
- Shortcomings
- Supplicant must have WPA2-compliance firmware
- AAA server must support EAP
- WPA2 uses more CPU, so a hardware upgrade may be required
- Older devices may not be upgradeable and must be replaced
- Features
| Mode | WPA | WPA2 |
|---|---|---|
| Enterprise | Auth: 802.1x/EAP Encryption: TKIP/MIC |
Auth: 802.1x/EAP Encryption: AES-CCMP |
| Personal |
Auth: PSK Encryption: TKIP/MIC |
Auth: PSK Encryption: AES-CCMP |
Aaron does lots of stuff and, therefore, does nothing well. He's trying, though.
https://masto.ai/@aconaway
https://masto.ai/@aconaway
Latest posts by jac (see all)
- Generating Network Diagrams from Netbox with Pynetbox - August 23, 2023
- Out-of-band Management – Useful Beyond Catastrophe - July 13, 2023
- Overlay Management - July 12, 2023