Forum

Hi,

We are evaluating PEAP as 802.1X authentication method for both Wired and Wireless network...

As first phase we will apply this authentication to WLANs. I know that PEAP guarantee mutual authentication and encrpytion between the client and the AAA-Server (PHASE I)...

Our problematic is that in the beginning we've to introduce ONLY Phase two of PEAP without the TLS tunnel establishment of Phase I ...
Will the user credentials, which resides on an AD, from the client to the AP, passed in an unencrypted form or encrypted only by MS-CHAPv2 ?

If it's the case then PHASE I should be implemented to avoid worst suprises...

If you're using Microsoft's PEAP-MS-CHAP-v2, then regardless of whether the TLS tunnel is established or not, the username will be passed in the clear.
Additionally, all of your servers will have to have a certificate which means you have to purchase a certificate or maintain your own certificate authority server (yuck).

If you choose to use EAP-FAST, you do not need a certificate server and the username is not passed in clear text like it was with PEAP-MS-CHAP-v2 and LEAP.

Devinator

Hi,

Thanks for the reply...we are using PEAP-MS-CHAP-V2 with a RADIUS Server which delegate the authentication to our LDAP DB

If I've the TLS tunnel between my RADIUS server and the client, all the information are passed encrypted on this tunnel; so basically if the username would be in clear and the password encrypted in MSCHAPv2 I'm almost sure that TLS can guarantee that they are not directly exposed to attacks...

From certificate side it would not be so painful, seeing that only my RADIUS server I've to implement a certificate signed by my CA...

I was wondering that not implementing now PEAP Phase 1 for mutual authentication and TLS tunnel Setup, will increase potential attack seeing username is in clear and password in MS-CHAPv2...isn't it ?

Only Cisco's version of PEAP hides the "real" user name. Microsoft's version of PEAP does not hide the user name.... a BIG weakness.

Also Bill Gates PEAP only authenticates against Active Directory while Cisco PEAP autheicates against any LDAP compliant database.

Bill Gates PEAP uses MsChap version 2 inside the TLS tunnel. Cisco uses EAP-GTC inside the tunnel. Therefore EAP inside of EAP authenication. EAP-GTC(Generic Token Card) can be used with RSA token cards and OTP(One Time Password) database servers. However, the EAP-GTC protocol also works with user name and password authenication that is completly hidden inside the TLS tunnel.

It's a bummer that the acronym BGP is already taken or we could use it for Bill Gates PEAP. ;-)

Devinator

What do you mean exactly by:

"Only Cisco's version of PEAP hides the "real" user name. Microsoft's version of PEAP does not hide the user name.... a BIG weakness. "

Did you mean that whetever or not the TLS session is established using MS-PEAP the user name is sent not hidden on this TLS session ?

Thnx
Omar

Yes....

Cisco PEAP and EAP-TTLS both use an "anonoymous" user name outside the tunnel and the real user name is hidden inside the tunnel. Bill Gates's version of PEAP.... the realuser name is seen outside the tunnel.

If memory serves me correcty, this is one of the things we did as a "test" in the CWAP TTT class in Atlanta. Anyone remember that or am I thinking of something else?