Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm studying how WPA-TKIP works. As I understand, there are two parts to authentication.

  1. Using EAP messages the client authenticates itself to the access point or authorization/RADIUS server. I believe this is using EAP-TLS, is that correct?

  2. Using the four way handshake, the client and access point calculate temporal keys and authenticate each other.

Are these steps correct, and is this the correct order? Also why isn't the second step used first to establish a secure connection before authenticating to the RADIUS server?

share|improve this question

It depends on if you're using "Enterprise" or "Pre-Shared Key" (PSK).

If you're using "Enterprise", then one of your options is to use EAP-TLS, but there are other options like PEAP. These are typically the only two you will see in implementation, although there are plenty of others.

With EAP-TLS, check out EAPoL, and this diagram really helps to clear things up.

With PSK, there is the four way handshake that you mentioned.

In summary, you summarized two separate ways of establishing a connection with a WPA-TKIP enabled WAP. Hope this helps.

share|improve this answer
Do you mean that the 4 way handshake does not occur in enterprise mode? – ConditionRacer Nov 3 '13 at 17:09
In "Enterprise" you use very different steps to authenticate yourself and encrypt your communications. If you want more details, look here -… – JZeolla Nov 3 '13 at 23:52

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.