10

When connecting to an enterprise WPA protected network, I have the option the add an "anonymous identity" (see related screenshot). I don't understand what's the point though.

Who get to see this identity ? What is obfuscated by this anonymous identity ?

enter image description here

6

The anonymous identity is used in EAP so that the authenticator can choose the correct authentication server to process the credentials. For example sending anonymous identities of foo@example to Example's RADIUS server.

See here for more information.

The anonymous identity is sent in the clear. Some client systems have a privacy option for the anonymous identity. In this case rather than foo@example being sent in the client response, only @example is sent, protecting the actual identity of the user. All an eavesdropper can see is that they want to authenticate with Example.

  • 1
    The anonymous identity is used in a number of different EAP mehtods, not simply by PEAP. Specific to this question, the OP posted a screenshot of the configuration for the use of TTLS, not PEAP and TTLS also can make use of an anonymous identity. – YLearn Jan 20 at 18:55
5

What is “anonymous identity” in enterprise WPA?

Nearly all EAP methods in use for 802.1X with WPA/WPA2 wireless authentication utilize an "outer" authentication method simply to establish a TLS tunnel between the client and the authentication server (i.e. a RADIUS server) and an "inner" authentication to provide actual credentials through the secure TLS tunnel.

The "anonymous identity" is used for the outer authentication process and does not need to match the credentials provided in the inner authentication, although if no anonymous identity is provided, the default is to user the inner identity (aka username) for both.

Who get to see this identity ?

This depends. Since the outer authentication is not protected by any sort of encryption anything that can see/process the outer authentication. This list contains some (but not necessarily all) of the things that can possibly see the outer identity:

  • Devices near the client that can "hear" and capture the outer authentication
  • The NAS (device that forwards traffic associated with the authentication between the client and RADIUS server) which is typically the AP or wireless controller
  • The RADIUS server providing authentication (which actually has access to both outer and inner identities)
  • Intermediate RADIUS servers if the first RADIUS server proxies the request to other RADIUS servers
  • Any device forming the network path between NAS and RADIUS server or between RADIUS servers (when authentications are proxied) - if the path extends outside the locally controlled network, this may include devices on the Internet or controlled by some third party
  • Any system that either has access to data on the above or that the above export data to

What is obfuscated by this anonymous identity ?

As already noted, use of the anonymous identity prevents the default action of using the inner identity for the outer identity as well. What exactly is obfuscated will depend on the OS/EAP supplicant and needs of the authentication process in use.

Specifically, you should always be able to obfuscate [at least part of] the username.

For some EAP supplicants, you can substitute both a different username and domain/realm. For others (Window's native EAP supplicant for one), you may only be able to substitute the username.

Any requirements of the authentication process will also determine what can be obfuscated. For example, if the RADIUS server uses the domain/realm in handling the authentication, you may be required to maintain the domain/realm even if your OS allows you to change it. Or, a RADIUS server could use regex matching on the username to determine how to handle the outer authentication (example: usernames containing xxx are handled locally, others are proxied to another RADIUS server), so your anonymous identity would possibly have to maintain at least the part of the username if it needed to match the regex.

3

From documentation (just an example of configuration):

ctrl_interface=DIR=/var/run/wpa_supplicant GROUP=wheel
network={
    ssid="example"
    scan_ssid=1
    key_mgmt=WPA-EAP
    eap=TTLS
    identity="user@example.com"
    anonymous_identity="anonymous@example.com"
    password="foobar"
    ca_cert="/etc/cert/ca.pem"
    phase2="auth=MD5"
}

It is your identity that is hiden because (your REAL identity) is sent only through an encrypted TLS tunnel.

There are three entries:

  • anonymous_identity="fake_identity@something.com"
  • identity="username"
  • password="password"

You can see your anonymous identity represented by the string used in anonymous_identity parameter is sent unencrypted, whereas your real identity (username, password) are sent only encrypted and no one sees them.

  • I still don't get it. So who sees it? An eavesdropper? What's the point of having an anonymous identity instead of leaving it blank then? – Droplet Sep 20 '15 at 12:36
  • So who sees it? Only the server will know it is really you. An eavesdropper? it is a difficult scenario, but feasible. What's the point of having an anonymous identity instead of leaving it blank then? Good question. I have no precise answer for it, but may be the specifications (RFCs) stated that somehow, in general empty strings/inputs are not very welcome. @Hugo – user45139 Sep 20 '15 at 14:02
  • 5
    It's not blank because if the authentication needs to be forwarded to a different RADIUS server - notably this is likely with eduroam - the intermediate servers still need to see where to route it to. They can't see the non-anonymous identity because it's encrypted; the outer ("anonymous") one thus still needs to contain routing info (usually the @realm part of a user@realm ID, with the user included in the inner identity only. – Darael Aug 3 '16 at 13:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.