In EAP-TLS, the peer (supplicant) and the authenticator do a TLS handshake. In practice, the authenticator usually relays the EAP mesages to an authentication (RADIUS) server which means that the TLS handshake is actually done between the supplicant and the authorization server.
[ TLS ]<--------------------->[ TLS ]
[ EAP ]<--------------------->[ EAP ]
[ EAPOL ]<->[ EAPOL | RADIUS]<->[ RADIUS ]
[ Wifi ]<->[ Wifi | ... ]<->[ ... ]
Supplicant Authenticator Authentication Server
(Wifi Client) (Wifi AP) (RADIUS server)
The TLS communication between the supplicant and the authorization server works as expected but usually mutual authentication is used:
- server sends its certificate chain
- client validate certificate chain against server name
- client sends its certificate chain
- server validate certificate chain
- further crypto magic happens
Once the TLS handhsake is finished, the TLS session is not used anymore: it is not used to transport encrypted data.
If the handshake succeeds, the RADIUS server send a "RADIUS Access-Accept/EAP-Message/EAP-Success" message to the authenticator.
At the end of the TLS handshake, both the supplicant and the authentication server derive a "TLS master secret". This TLS master secret is used to derive a Master Session Key (MSK), see RFC5216:
In EAP-TLS, the MSK, EMSK, and Initialization Vector (IV) are derived
from the TLS master secret via a one-way function.
This MSK is sent by the authentication server to the authenticator as part of the "RADIUS Access-Accept/EAP-Message/EAP-Success" RADIUS message. As far as I know (?), the MSK is in practice sent using the following RADIUS Attributes, RFC2548:
See the StrongSwan wiki on this topic:
For EAP methods providing an MSK, the RADIUS server must include the key within the MPPE-Send/Receive Keys [...]
See this Security StackExchange answer on this topic.
Enc-RECV-Key = MSK(0,31) = Peer to Authenticator Encryption Key
(MS-MPPE-Recv-Key in [RFC2548]). Also known as the
PMK in [IEEE-802.11].
Enc-SEND-Key = MSK(32,63) = Authenticator to Peer Encryption Key
(MS-MPPE-Send-Key in [RFC2548])
Once the authenticator has the MSK, both supplicant and authenticator can use the MSK has a PSK to secure the communication. In practice, the Wifi Pairwwise Master Key (MPK) is derived from the EAP MSK.