I'm studying how WPA-TKIP works. As I understand, there are two parts to authentication.

  1. Using EAP messages the client authenticates itself to the access point or authorization/RADIUS server. I believe this is using EAP-TLS, is that correct?

  2. Using the four way handshake, the client and access point calculate temporal keys and authenticate each other.

Are these steps correct, and is this the correct order? Also why isn't the second step used first to establish a secure connection before authenticating to the RADIUS server?


It depends on if you're using "Enterprise" or "Pre-Shared Key" (PSK).

If you're using "Enterprise", then one of your options is to use EAP-TLS, but there are other options like PEAP. These are typically the only two you will see in implementation, although there are plenty of others.

With EAP-TLS, check out EAPoL, and this diagram really helps to clear things up.

With PSK, there is the four way handshake that you mentioned.

In summary, you summarized two separate ways of establishing a connection with a WPA-TKIP enabled WAP. Hope this helps.

  • Do you mean that the 4 way handshake does not occur in enterprise mode? – ConditionRacer Nov 3 '13 at 17:09
  • In "Enterprise" you use very different steps to authenticate yourself and encrypt your communications. If you want more details, look here - cisco.com/en/US/tech/tk722/tk809/… – JZeolla Nov 3 '13 at 23:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.