The tag has no usage guidance.

learn more… | top users | synonyms

11
votes
1answer
1k views

MPPE-Send and Receive key derivation from MS-CHAPv2

I am trying to get the MS-MPPE-Send-key and MS-MPPE-Recv-key from the MS-CHAPv2 challenge material. I am able to follow the RFCs 2548 3078 and 3079 to the step of getting the GetNewKeyFromSHA() it is ...
8
votes
3answers
2k views

Encrypt WiFi connection per connected user

One of the questions that comes on quite often is about WiFi encryption. Now imagine that you have multiple users connecting to one AP. With a simple WPA2 protection setup they can still sniff each ...
8
votes
2answers
5k views

WPA2 Enterprise AES encryption key size?

I have recently set up a RADIUS server with EAP for my wireless router, however, I have some questions about the key size and how WPA2 enterprise (AES) works in general. I have read that in ...
7
votes
3answers
2k views

Are RADIUS and TACACS+ Ever Allowed in FIPS 140-2 Compliant Scenarios?

Are RADIUS and TACACS+ Ever Allowed in FIPS 140-2 Compliant Scenarios? I understand that RADIUS uses the MD5 hashing algorithm and I'm pretty sure TACACS+ does too, and I do not believe there is any ...
6
votes
2answers
159 views

Protection of eduroam credentials

Recently my educational institution officially switched over from the their own wireless network to eduroam. If I understand correctly from the FAQ, credential authentication is performed on the ...
5
votes
2answers
1k views

WiFi security using IEEE 802.1X - how secure is it?

My company's set-up involves a single AP (TPlink) that is configured to authenticate clients using RADIUS. All works well, but: on a regular WPA/WPA2 network, once you have the PSK, you are able to ...
4
votes
1answer
2k views

Certificate validation with 802.1x PEAP

I recently learned about how WPA-PSK works. If I understand correctly, the 4-way handshake enables the protocol to ensure mutual possession of the PMK (and therefor, the PSK) without sending the ...
3
votes
4answers
991 views

How to decode traffic on a LAN whose SSL certificates are expired

We have a campus Wi-Fi at my university and we authenticate through a log in page which to me seems like we are using a RADIUS server. Every time the page loads my browser warns me that the ...
3
votes
1answer
5k views

what is the role of RADiUS server and Active Directory to increase the security in wireless networks?

In the CBT Nuggets Video Training, one slide about Wireless networks : i want to know about the role of Radius to increase the security and how? in this project: Deploy Active Directory and ...
2
votes
0answers
147 views

Does EAP-TLS provide a two-factor authentication?

I am currently setting up FreeRADIUS on my pfSense firewall to authenticate WLAN clients (mainly iOS) via EAP-TLS. I have therefor created a user certificate and a user within the FreeRADIUS user ...
2
votes
1answer
446 views

Does WPA2 Enterprise also authenticate clients to the 802.1X protected switch port?

In an 802.1X protected LAN, the switch port is usually set to "Multiple Hosts" mode and the access point is configured as an 802.1X supplicant which authenticates to the switch and "opens" the port. ...
1
vote
1answer
1k views

Can I used Google Authenticator with Radius and VMwareview

We're looking to add 2 factor and one of the options is google authenticator and I was wondering if we can attach that to a radius server attached to our VM infrastructure for remote access. All ...
1
vote
1answer
1k views

Forcing EAP-TLS 1.2 authentication with FreeRadius and OpenSSL

Been working with TLS DHECE certificate based handshake with a FreeRADIUS server and WPA_supplicant - both running OpenSSL 1.0.1j FIPS. Afer watching the Wireshark traffic, I notice that the client ...
1
vote
1answer
603 views

RADIUS proxy chains

RADIUS is a widely deployed remote authentication protocol. I'm looking here at its use in wireless roaming. The RADIUS protocol allows for proxies and chains of proxies: |CLIENT|<->|Access ...
1
vote
0answers
24 views

Help decrypting MS-MPPE-Send-Key/MS-MPPE-Recv-Key

I'm trying to decrypt Ms-MPPE keys received in a Access-Accept message from the Radius server. I'm following RFC2548 in order to do this. Although the keys are of size 32 octets, the one byte length ...
1
vote
0answers
143 views

Can a Radius server mitigate an ARP spoofing attack?

I'm helping my school network administrator to try to find a way to mitigate a current ARP spoofing attack on our wifi network. We detected an unknown host (MAC address seem to change, he is probably ...
1
vote
0answers
56 views

Repeating “Type” field in EAP expanded NAK seems redundant?

I'm reviewing the EAP RFC 3748 and I've gotten to the bit about Expanded NAKs, and the examples given there seem to contradict my understanding of the generalised expanded format discussed later in ...
0
votes
1answer
1k views

FreeRADIUS EAP TLS Authenticate based on client certificate CN

I'd like to run FreeRADIUS for EAP TLS authentication but instead of running my own Certification Authority I'd like to use StartSSL. I've setup EAP TLS with StartCom as the only Trusted Root CA and ...
0
votes
1answer
95 views

Which method of WPA2 enterprise is more secure: TTLS or PEAP [closed]

Say we have two WPA2 enterprise setups using a RADIUS server. If both implementations use MSCHAPV2 and the same credentials. Which of the two would be more secure and how are these two implementations ...
0
votes
1answer
243 views

EAP-TLS fragmentation implementation

I am trying to build an EAP-TLS client. The handshake I have to deal with involves receipt of fragmented messages from the RADIUS server. As a part of the client reply, I have to construct a ...
-1
votes
1answer
29 views

RADIUS use outside of network AAA

I've seen RADIUS used for wireless authentication, but are there any other use cases that RADIUS works well in? Has anyone had experience with using RADIUS for AAA between two applications? I'm ...