Questions tagged [wpa2-eap]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
0 answers
8 views

Can an EAP-TLS Server X.509 certificate authenticate an mDNS Avahi/ZeroConf/Bonjour name?

Using an internal CA, can valid X.509 certificates be created for mDNS domain names (as distinct from conventional DNS domain names)? E.g. a hostname like radius.local? Would such a certificate be ...
0 votes
1 answer
38 views

EAP-TLS for securing internal local WLAN?

I'm looking at securing a wi-fi network used in an industrial context. I have a pool of client devices which should automatically connect to an AP (selecting SSIDs which match a specific pattern). ...
0 votes
0 answers
19 views

FreeRadius and Apache Mutual authentication

I set EAP-TLS on my FreeRadius server, and i want to try the certificate-based authentication for a testing. I set up an Apache as a webservice and enabled ssl on it. I could redirect the basic ...
0 votes
1 answer
134 views

Does OpenSSL support EAP-TLS privacy

Does OpenSSL support EAP-TLS privacy? It's an optional feature part of rfc5216, section 2.1.4.
1 vote
1 answer
106 views

How does the supplicant connect to the auth server in EAP TTLS?

I understand that a tls has to be established between the supplicant (end user device) and the auth server but a few things are unclear : How does the supplicant know the ip adress of the auth server ...
  • 29
0 votes
2 answers
332 views

WPA2-EAP-TLS with global client certificate

Is security compromised if every client uses the same client certificate to authenticate with WPA2-EAP-TLS? In essence, we want to provide an open wifi network, but want to ensure users cannot see ...
  • 103
2 votes
1 answer
444 views

Why is my RADIUS Certificate not automatically signed with the root CA Certificate on my iPhone

I have spent the last few days setting up a freeradius server with eap-tls as the only authentication method. I have used this old tutorial for setting up my own CA and generating the certificates and ...
0 votes
1 answer
220 views

How are keys negotiated in wpa-eap?

Question about PEAP-MSCHAPV2 on RADIUS. After MSCHAPV2 success keys are extracted from TLS context. Then it sent to AP. Client failed to connect WiFi (or eapol, etc) with my handmade RADIUS Access-...
  • 111
2 votes
2 answers
757 views

EAP vs TLS authentication

I am having trouble understanding the point of EAP. EAP is an authentication framework, which defines several TLS based methods and encapsulations like EAP-TLS, EAP-TTLS and PEAP. These all require ...
1 vote
2 answers
518 views

Capturing cleartext authentication (EAP-TTLS/PAP) with WPA-2 Enterprise?

I am running an evil twin attack with eaphammer, by default it seems to capture mschapv2 authentication which contains the username and NETNTLM hashes. I have manually created a WiFi connection (on ...
  • 475
2 votes
2 answers
228 views

WPA2 Enterprise: no risks for preconfigured clients when it comes to Rogue APs?

We are using, as default, PEAP and MS-CHAPv2 as inner authentication. I was concerned with security risks when it comes to rogue APs but a colleague told me that there are no risks for preconfigured ...
0 votes
1 answer
562 views

is it possible to evil twin a WPA 2 Wifi using one of EAP methods?

the same as fluxion but without the captive portal just like this video Stealing 802.1x Credentials with Rogue AP & RADIUS server he was able to get the username and the password of an EAP wifi ...
0 votes
1 answer
1k views

How DHCP client can determine that 802.1x Port based authentication has been completed and its time to trigger DHCP discover

I have a Supplicant running on 1 Linux box attached with a Free radius server on other linux box with cisco catalyst switch (with 802.1x Port based access) in between. Now I have been able to ...
2 votes
0 answers
571 views

WPA2-Enterprise / EAP-TLS user identity

I'm currently in process of testing EAP-TLS before deploying it in production. My test setup consists of: Supplicants: Android 6, Debian Buster with WICD-GTK. Authenticator: Mikrotik RouterOS 6.43 (...
1 vote
1 answer
98 views

How WPA supplicant can determine whether switch supports authentication or not?

If a client(supplicant) configure to perform EAP-TLS authentication connects with a switch which doesn't requires authentication. How can supplicant determine that authentication is not required and ...
0 votes
1 answer
483 views

How does Authenticator gets the PMK which is used to calculate PTK?

I am trying to setup a Supplicant- authenticator and AAA server to perform EAPOL mechanism. I am able to successfully completed the EAP authentication procedure but 4-way handshake was not initiated ...
2 votes
1 answer
111 views

Does EAP exist as an independent authentication protocol, or just as a framework?

Does EAP exist as an authentication protocol itself, or will it only be found implemented as one of its methods (EAP-TLS, EAP-TTLS, etc)? If EAP is only a framework, what additional detail do its ...
  • 425
26 votes
1 answer
7k views

What is stronger - WPA2 Enterprise with 2048 bit key, or Personal with 63 character passphrase?

Which of the two following has a stronger cryptographic strength in withstanding brute-force attacks? WPA/WPA2 Enterprise using 2048-bit RSA public-key WPA/WPA2 Personal using 63-character ...
  • 261
0 votes
2 answers
752 views

How to prevent users sharing WPA RADIUS keys?

My office LAN does not have a Windows Active Directory. The Wifi use WPA with a pre-shared key, which means that everyone in the world knows what the key is. I was thinking of implementing a RADIUS ...
1 vote
1 answer
321 views

How dangerous is it to trust an “Example Server Certificate”?

When connecting to the Wi-Fi of my university, which authenticates clients via “EAP-PEAP (MSCHAPv2)”, I got the following prompt: I had no choice but to trust this certificate, because otherwise I ...
  • 761
0 votes
1 answer
469 views

Hotspot SSL issues, MtTM like exceptions

I have doubt about how to implement hotspot for my startup. Idea is to have implemented WPA2-Enterprise with remote radius server and splash page. This implementation came after the reason of ease of ...
1 vote
1 answer
977 views

Evil Twin Attacks against WPA-TLS

Today I'm getting into the details of WPA-Enterprise. Most of what I saw was difference between protocols that use certificates. Most posts say that EAP-TLS is the most secure authentication protocol ...
  • 143
0 votes
1 answer
1k views

What are the roles of PSK and GTK in a WPA setting?

I understand that PTK is ultimately the key that is used to encrypt traffic between a device and the WAP after the 4WHS and that the PMK is directly related to the 'passphrase' of the wireless network....
2 votes
1 answer
2k views

Access-Challenge EAP Request

From my understanding, after the Access-Request, the authentication server (RADIUS) sends a reply (encapsulated in the Access-Challenge packet) to the authenticator (AP). The Access-Challenge packet ...
1 vote
0 answers
149 views

Manipulate EAP negotiation

The EAP method to use is suggested from the client to the server during the EAP negotiation. I'm trying to make the EAP negotiation ends on one specific EAP method (inner authentication included) of ...
1 vote
0 answers
159 views

Force/Suggest the client to use one specific EAP method

I would like to suggest to the client which one EAP method and inner authentication to use. I'm using hostapd to create the AP. I've tried by removing some methods in the hostapd.eap_user but I ...
2 votes
0 answers
507 views

Change default EAP type in hostapd [closed]

I'm trying to change the default EAP type in hostapd but I am not able to understand how to do that. Here's what I've found reading the hostapd.conf file: > # NAI Realm information > # One or ...
7 votes
2 answers
4k views

WPA2 Enterprise EAP-TLS Key Exchange

I'm in the process of implementing 802.1x WPA2 Enterprise Authentication using FreeRadius and EAP-TLS (Mutual TLS Cert Based Auth). I am keen to understand how to actual protocols work together and ...
4 votes
3 answers
5k views

Restrict Microsoft Network Policy Server (NPS) to only trust client certificates from a given CA?

I'm working on an install of a Microsoft Network Policy Sever (NPS) / RADIUS server for controlling access to corporate Wi-Fi using 802.1x / WPA2-Enterprise - using client certificates for ...
  • 171
2 votes
0 answers
418 views

WPA2 EAP-TTLS with PAP: Does the authentication server know the password?

There's a wireless network that I sometimes need to connect to that uses WPA2 with EAP-TTLS and PAP as "inner" protocol. I've been sent a certificate file (presumably for the TTLS to work) and given ...
3 votes
1 answer
3k views

WPA2-EAP and Captive Portal

Is it possible to use Captive Portal for WiFi and WPA2-EAP at the same time? Is there any EAP supporting Captive Portal? For example - user connects to WiFi, goes to Captive Portal over unsecure ...
0 votes
1 answer
142 views

WPA2-Enterprise certs vs HTTPS certs

I was trying to download the certificate for a WPA2-Enterpise network I was connecting to. However, when I clicked on the link to install it, the browser said the cert was already installed as a CA. ...
  • 737
8 votes
1 answer
397 views

How to provide user friendly WiFi access to gym members with WPA2 Enterprise?

Background A friend of mine is the owner of a medium sized gym. He wants to provide WiFi to his customers and asked me to come up with a concept and eventually also deploy it. As a computer scientist ...
2 votes
2 answers
250 views

What auth info is locally revealed with eduroam WPA-Enterprise 802.1X?

If you authenticated with your eduroam credentials at a participating institution, your home institution is the one doing the authentication of the credentials, and the host institution is only ...
  • 1,884
1 vote
0 answers
467 views

Guide on how to create certificates and setup an EAP-TLS on debian [closed]

I need to create an EAP-TLS authentication using a freeradius. Currently I am a working EAp-PEAP setup, it is working fine. However, I now needs to move to an EAP-TLS. For this I need to create some ...
  • 11
2 votes
2 answers
3k views

WPA with PSK and with Radius Server

In case of WPA2 using the Radius server, every client gets its own username and password. But what is the case in the WPA2 using a PSK without the authenticating server. In this case also we have a 4 ...
4 votes
3 answers
1k views

Segregating a Printer in my Enterprise Network

I have a EAP-TLS network at home which I've managed for some time now. I just got a new Brother HL-5470 printer so I can finally print things at home, which is really nice. The only problem is that ...
  • 6,715