0

Is security compromised if every client uses the same client certificate to authenticate with WPA2-EAP-TLS?

In essence, we want to provide an open wifi network, but want to ensure users cannot see each other's traffic. With WPA2-PSK, this appears to be impossible. As users are expected to have our app installed, the option we were thinking of is using WPA-EAP. Since WPA2-EAP-PSK is unsupported by almost every device, we were looking for an alternative. EAP-WPA2-TLS seems to be an option, the question is: Can we deliver every client the same certificate, or do we need to ensure each client has their own certificate? Authentication is not a concern, this is only relevant for data security.

It appears that the PTKs are generated using the certificate, but I'm unable to determine if that is the only source or if other data is used to generate the keys that would still guarantee unique encryption keys.

Improve this question
1
  • What wireless infrastructure do you use? Most major enterprise vendors now have some sort of "private PSK" mechanism that allows different PSKs per device. That may be a better option than 802.1X depending on your use case.
    – YLearn
    Commented Sep 10, 2020 at 18:28

2 Answers 2

Reset to default
1

EAP-TLS derives the link keys from the TLS master secret, in practically the same way as TLS itself would derive the encryption keys. Because the master secret is different for every TLS handshake, the link keys will be different for every EAP authentication as well.

The user certificate, as far as I can tell, is completely irrelevant. The same applies to EAP-TTLS and EAP-PEAP, which do not use client certificates at all.

Improve this answer
1

Since you don't care about authentication, why not use OWE (opportunistic wireless encryption) instead of WPA2? If your hardware supports it, it provides an open network that encrypts each client's traffic. There would be no need to mess with certificates.

Improve this answer
1
  • Our hardware can probably be convinced to support it. I'm more concerned about the client's hardware. I've found sources claiming that OWE is still experimental and entirely unsupported by Apple devices.
    – Xandaros
    Commented Sep 9, 2020 at 13:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .