What is the difference between EAP-TLS and AES 256 encryption? Can they be used together? Or are they separate protocols?


What is the difference between EAP-TLS and AES 256 encryption?

They are not just different protocols, they are entirely different concepts.

AES - the Advanced Encryption Standard - is a block cipher algorithm. In AES-256 the 256 denotes the key size (different key sizes also trigger slightly different of AES). AES can be used for the transport encryption used within TLS; i.e. it can be the cipher that actually encrypts the payload. AES is a subset of Rijndael standardized by NIST.

EAP describes a framework for authentication. The authentication mechanisms provided by EAP-TLS can be used within the handshake of TLS to authenticate the client and/or server. Usually it is used to perform both client and server authentication though (compared to web browsers that usually only perform server authentication).

So we aren't comparing apples and oranges here, we're comparing apples and asparagus.

Can they be used together? Or are they separate protocols?

The handshake phase and the actual encryption/decryption phase of TLS are not directly coupled. So yes, if this combination has been implemented by the client and server, you should be able to use both.

However, the EAP-TLS specification only requires the TLS_RSA_WITH_AES_128_CBC_SHA ciphersuite to be available for the use of AES. And that's a SHOULD, not a MUST, so you need to check this as well at the client and the server (although this cipher suite is generally supported). If a ciphersuite with AES_256 is supported it is not a standardized solution.

AES-128 is considered very secure; AES-256 may not make that much a difference with regards to security of the entire system. Note that I don't see an option for forward secrecy (DHE or ECDHE cipher suites) or TLS 1.2 either. That should probably worry you more.


What is the difference between EAP-TLS and AES 256 encryption?

Direct answer No: EAP-TLS protocol is different from AES.

First you need to understand the Extensible Authentication Protocol (EAP) which is an an extension to Point-to-Point protocol (PPP) spoken between the EAP peer and server and used for authentication (it supports multiple authentication methods); whereas EAP-TLS is secure EAP standard.

The Advanced Encryption Standard (AES) is rather a cryptographic protocol availabe in the TLS ciphersuite and thus used by the EAP-TLS protocol (among other cryptographic standards) as in the case of FreeRadius where the EAP session key is encrypted by using Advanced Encryption Standard (AES).

Note that Triple DES was often set by default in old OpenSSL versions is less efficient than AES which is rather the desirable choice (I mention OpenSSL because it is used by FreeRadius with which you may are working with now).

Can they be used together?

Of course. Not only you can but it is advised to use AES-256 (256-bit AES Encryption for SSL and TLS: Maximal Security). Even in previous OpenSSL versions, AES-256 is available in the ciphersuite (I mention you OpenSSL because, as I said, FreeRadius which you may are using relies on OpenSSL and, the second reason, OpenSSL is just an implementation of SSL/TLS standards related to EAP-TLS you asked about).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.