0

Question about PEAP-MSCHAPV2 on RADIUS.

After MSCHAPV2 success keys are extracted from TLS context. Then it sent to AP.

Client failed to connect WiFi (or eapol, etc) with my handmade RADIUS Access-Accept.

Can you explain full keys negotiation?

Radius source code implementations based on state machines, so code is difficult to understand.

Improve this question
2
  • I can't quite understand what you are asking, but the way MSCHAPv2 generates session keys is well defined in section 3 of RFC 3079. Is that what you are looking for?
    – YLearn
    Commented Feb 18, 2020 at 6:43
  • no, section 4! Tryed implement 3079 section 4.3, but supplicant does not accept my keys because of decision=DECISION_FAIL one step before Access-Accept. Now it works.
    – eri
    Commented Feb 18, 2020 at 9:30

1 Answer 1

Reset to default
0

I find missed step. After Success-Response (from client) on phase2 I need to write empty message. I.e. TLS-ASK packet needed before phase1 Success (from server).

Now it works with linux, android (wpa_supplicant). Not works with iOS...

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .