1

Today I'm getting into the details of WPA-Enterprise. Most of what I saw was difference between protocols that use certificates. Most posts say that EAP-TLS is the most secure authentication protocol and that it addresses the Evil Twin attack problem.

Does it really though?

When using a protocol with a server side certificate (EAP-PEAP) the clients may still accept an invalid server certificate. Can be misconfigured client or by user error when manually accepting the certificate.

In case of EAP-TLS (or EAP-TTLS with client certificate enabled) the client needs to have his certificate in order to authenticate to the network as well. But taking into account that the client may trust an untrusted certificate he will still send his certificate to the hacker, right? then the hacker could use the certificate to login into the real network, right?

Am I missing something in EAP-TLS??

Improve this question

1 Answer 1

Reset to default
2

But taking into account that the client may trust an untrusted certificate he will still send his certificate to the hacker, right?

yes, if client ignores invalid server certificate error during connection.

then the hacker could use the certificate to login into the real network, right?

no, because only public part of client certificate is sent to RADIUS. Public certificate without private key (which is not sent to server and never leaves client computer) is useless in terms of hacking/impersonation of legal user.

Improve this answer
1
  • Thanks for your answer, I guess I just lack the knowledge of how certificates work. But as an Evil-Twin one can always accept the client certificate and send back EAP-success messages, correct?
    – Esser420
    May 14, 2017 at 15:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .