EAP - Extensible Autent Prot

EAP - Extensible Autent Prot

1. Gerais

   • EAP can be used for wired and wireless LANs, but is commonly used for wireless LAN networks.
   • Define o transporte e o uso do Identidy credencial
   • Enacapsula username, password, certificates, etc que o cliente está enviando para propósitos de autenticação
   • 802.1x nada mais é que EAP over LAN
   • Autenticação entre Usuario e radius

2. responder antes da escolha do tipo de mecansimo EAP

   • Is there a Certificate Authority PKI infrastructure available within the network?
   • What client platforms are supported within the network?
   • Is there any existing authentication system?
   • Is there a requirement to support multiple EAP mechanisms?

3. common EAP methods used in access control solutions

   • EAP Message Digest 5 (EAP-MD5)
     • open standard, nonproprietary EAP types
     • not support mutual authentication or key generation
     • Não é dos mais seguros
     • EAP-MD5 is common on IP Phones, and it is also possible that some switches will send MAC Authentication Bypass (MAB) requests using EAP-MD5.
   • EAP Transport Level Security (EAP-TLS)
     • open standard, nonproprietary EAP types
     • extension of Point-to-Point Protocol (PPP) to provide authentication within PPP, with TLS providing integrity of negotiation and key exchange
     • It is considered among the most secure EAP Types, since password capture is not an option; the endpoint must still have the private-key.
     • requires mutual authentication, negotiation of encryption methods, and, most important, requires installing certificates on the client supplicant and server.
     • This is very similar to SSL and the way encryption is formed between your web browser and a secure website.
   • EAP Tunneled Transport Level Security (EAP-TTLS)
   • EAP Flexible Authentication via Secure Tunneling (EAP-FAST)
     • developed by Cisco Systems
     • was developed to address the weaknesses of LEAP.
     • EAP-FAST uses the TLS tunnel, thereby providing a strong level of encryption
     • EAP-FAST does not use the PKI infrastructure for user identity (server certificate is optional) to establish the tunnel.
     • is based on strong shared secret keys that are unique on every client. These shared secret keys are called Protected Access Credential (PAC).
     • EAP-FAST is significantly faster because of the PAC architecture that expedites the tunnel establishment.
   • Protected EAP (PEAP)
     • another open standard EAP type that was jointly developed by Cisco Systems, Microsoft Corporation, and RSA Security
     • PEAP will form a potentially encrypted TLS tunnel between the client and server
     • much the same way the SSL tunnel is established between a web browser and a secure website.
     • After the tunnel has been formed, PEAP will use another EAP type as an “inner method” – authenticating the client using EAP within the outer tunnel.
   • Cisco-LEAP
     • Cisco proprietary EAP method.
     • Cisco was a pioneer in introducing EAP support for WLAN devices.
     • is a mutual authentication algorithm that uses a logon password as the shared secret that is known by the client and is used to respond to the challenges between the client and the authentication server. LEAP provides dynamic per-user, per-session encryption keys.
     • Most password-based authentication algorithms are susceptible to dictionary attacks, and the most effective way to safeguard against dictionary attacks is to create a strong password policy.