Questions tagged [peap]
The Protected Extensible Authentication Protocol is a protocol that encapsulates the Extensible Authentication Protocol (EAP) within an encrypted and authenticated Transport Layer Security (TLS) tunnel.
26
questions
0
votes
0
answers
20
views
Vulnerability of EAP-TLS simultaneous with PEAP-EAP-TLS?
I am trying to make sense about the caution wirtten by Microsoft's engineers about EAP's Authentication method configuration settings.
Caution
If a Network Access Server is configured to allow the ...
- 101
0
votes
1
answer
480
views
Are there other types of NT Password (NTLM Hash) besides raw MD4?
According to the freeradius document https://freeradius.org/radiusd/man/rlm_pap.txt I can use NT-Password as the type of storing user's password. However, I have only found the type of generating raw ...
- 101
2
votes
2
answers
937
views
How to generate a MSK from IEEE 802.1X-2010
IEEE 802.1X-2010 states:
"Generate an MSK of at least 64 octets, as required by IETF RFC 3748
[B14] Section 7.10, of which the first 16 or 32 octets are used by
this standard as described in 6.2....
- 21
0
votes
0
answers
105
views
Network administrator in my flat - vulnerabilities? [duplicate]
I'm concerned about my network that I'm currently using. There is an network on my flat with several access points in the building and the network admin is providing access - afaik it's PEAP with 802....
- 1
0
votes
1
answer
289
views
How are keys negotiated in wpa-eap?
Question about PEAP-MSCHAPV2 on RADIUS.
After MSCHAPV2 success keys are extracted from TLS context. Then it sent to AP.
Client failed to connect WiFi (or eapol, etc) with my handmade RADIUS Access-...
- 111
2
votes
2
answers
1k
views
EAP vs TLS authentication
I am having trouble understanding the point of EAP.
EAP is an authentication framework, which defines several TLS based methods and encapsulations like EAP-TLS, EAP-TTLS and PEAP. These all require ...
- 65
0
votes
0
answers
154
views
Connect 3rd party devices to windows server domain
I'm working on radius authentication. Server for this moment and production is windows server 2016.
The authenticator is a hp ProCurve 2610-pwr 24p
supplicants is a windows pc running windows 10 1903
...
- 101
6
votes
2
answers
18k
views
Is it possible for an 802.1x network (PEAP/MSCHAPv2) to have no certificate?
Is it possible for an 802.1x network (PEAP/MSCHAPv2) to have no certificate (CA, user, or otherwise)?
If so, what are the security implications?
The reason I ask is: I'm regularly connecting to a ...
- 1,749
2
votes
0
answers
551
views
Change default EAP type in hostapd [closed]
I'm trying to change the default EAP type in hostapd but I am not able to understand how to do that.
Here's what I've found reading the hostapd.conf file:
> # NAI Realm information
> # One or ...
- 41
1
vote
0
answers
132
views
Tunnel after authentication is complete with EAP-TTLS or PEAP
After authentication is complete with EAP-TLS, EAP-TTLS or PEAP, what happens to the tunnel?
Is it collapsed?
- 31
1
vote
1
answer
1k
views
Rogue EAP (PEAP) access point to obtain hashes
I set up a rogue EAP access point using hostapd-mana. This lets me capture hashes of credentials which can later be cracked by asleap. However, my Android phone doesn't automatically connect to my (...
- 170
1
vote
0
answers
524
views
Guide on how to create certificates and setup an EAP-TLS on debian [closed]
I need to create an EAP-TLS authentication using a freeradius.
Currently I am a working EAp-PEAP setup, it is working fine.
However, I now needs to move to an EAP-TLS. For this I need to create some ...
- 11
1
vote
1
answer
1k
views
Network Security with EAP: PEAP and Phase 2: MSCHAPv2?
I want to connect to my college WiFi but I’m worried about the security (data leakage, hacks, MITM). The configuration I used to connect to my college WiFi is as follows:
EAP: PEAP
Phase 2: MSCHAPv2
...
- 11
0
votes
1
answer
7k
views
Which method of WPA2 enterprise is more secure: TTLS or PEAP [closed]
Say we have two WPA2 enterprise setups using a RADIUS server. If both implementations use MSCHAPV2 and the same credentials. Which of the two would be more secure and how are these two implementations ...
- 11
9
votes
3
answers
3k
views
Protection of eduroam credentials
Recently my educational institution officially switched over from the their own wireless network to eduroam.
If I understand correctly from the FAQ, credential authentication is performed on the ...
- 2,257
4
votes
4
answers
2k
views
How much of a risk to students is an open WiFi network on campus? EDIT: please read in full.
I've been battling bureaucracy at my community college for months on this issue; a few months ago, they changed security on the SSID for students;
It used to use EAP, allowing students to enter their ...
2
votes
2
answers
6k
views
Decoding tunnel bytes in EAP-TLS or EAP-TTLS using Wireshark
I have a few pcaps of traffic for EAP-TTLS conversation, carried by RADIUS. I also have some being carried by EAPoL, but I think the answer to that case might be even less straightforward (though ...
- 335
9
votes
1
answer
4k
views
How does WPA2-Enterprise protect against an evil twin attack?
Original question title: What information do EAP-TLS certificates contain
I recently read a couple of topics on stackoverflow, concerning the verification of Wi-Fi access points:
How Are Wi-Fi ...
- 5,423
5
votes
3
answers
2k
views
How does EAP/PEAP integrate with modern security protocols?
How exactly does Extensible Authentication Protocol (EAP)/Protected EAP integrate into modern security protocols?
What I know (or not know) so far...
It's used by wireless networks utilizing ...
- 12.4k
4
votes
2
answers
8k
views
Certificate validation with 802.1x PEAP
I recently learned about how WPA-PSK works. If I understand correctly, the 4-way handshake enables the protocol to ensure mutual possession of the PMK (and therefor, the PSK) without sending the PMK/...
- 151
0
votes
1
answer
1k
views
EAP-TLS fragmentation implementation
I am trying to build an EAP-TLS client. The handshake I have to deal with involves receipt of fragmented messages from the RADIUS server. As a part of the client reply, I have to construct a ...
0
votes
1
answer
268
views
Is MS-CHAPv2 incompatible with securely stored passwords?
I have a directory service that can speak a number of protocols and is used for user authentication. Currently user credentials are stored using Bcrypt to protect them in case of a compromised ...
- 185
7
votes
1
answer
4k
views
Hotspot with same SSID, how does authorization work?
My university has a wireless network I log into with my username and password. It's using PEAP. My phone and laptop automatically connect to this SSID when they detect the network.
If someone sets up ...
- 274
3
votes
1
answer
2k
views
Is it necessary to use PEAP for L2TP/IPsec?
This is a sister question of Is EAP-MSCHAP v2 secure?.
Based on my understanding, IPsec should have authenticated the server (we're using PKI) and secured the rest of the protocols before the user ...
- 3,946
8
votes
2
answers
11k
views
Is EAP-MSCHAP v2 secure?
I am in a process of enforcing more strict VPN access policy after learning about the attack on PPTP with MSCHAP v2. Basically this I will be disabling the traditional PPP authentication methods and ...
- 3,946
3
votes
2
answers
758
views
Wireless Security: PEAP
I was wondering if there are any known attacks against PEAP used in wireless authentication/authorization?
I'm specifically looking for attacks that would allow:
bypassing the authentication
...
- 54.3k