In this lesson,
we will learn about WiFi authentication.
WiFi authentication is used to manage
and secure user access to wireless networks.
WiFi authentication concepts include IEEE 802.1X,
the Extensible Authentication Protocol,
and the Simultaneous Authentication of Equals.
802.1X is a network access control protocol
that provides an authentication framework
for devices connecting to a WiFi network.
EAP or the Extensible Authentication Protocol
is a flexible authentication framework
used within the 802.1X protocol
that supports multiple authentication methods
between a client, known as a supplicant,
and the wireless enterprise network.
Finally, SAE, or the Simultaneous Authentication of Equals
is a secure password based key exchange protocol
used in WPA3 authentication
to provide a secure handshake process
resistant to offline dictionary attacks.
Let's learn more about IEEE 802.1X,
the Extensible Authentication Protocol
and the Simultaneous Authentication of Equals.
First we have IEEE 802.1X.
IEEE stands for the Institute of Electrical
and Electronics Engineers.
IEEE 802.1X is a network access control protocol
that provides a framework for authenticating devices
that try to connect to a network, ensuring
that only authorized users are granted access.
This process protects network resources
and keeps unauthorized users out.
802.1X uses an authentication server,
such as a RADIUS
or remote authentication dial in user service server
to verify the identity of devices
trying to connect to the network.
When a device such as a laptop
or smartphone tries to connect to the network,
802.1X initiates an authentication process
that checks whether the user
is allowed to access the network.
If the user's credentials are valid,
they are granted access.
If not, they are denied.
To make this work, 802.1X relies on an important concept.
The Extensible Authentication Protocol or EAP.
EAP is not a single authentication method,
but rather a framework of authentication methods
that support various types of authentication,
such as passwords and digital certificates.
EAP is essential because when a new device,
known as a supplicant, wants to join the network,
it must establish a secure communication channel
to pass its credentials to the network for validation.
EAP provides the structure for these authentication methods,
enabling secure and flexible credential exchanges.
Once EAP sets up a secure communication channel,
the next step involves the router or access point,
also known as the RADIUS client in this process.
Think of the router or access point as a mediator
who helps pass information along the correct path.
After the supplicant's credentials are securely collected
via EAP, the RADIUS client forwards these credentials
to the RADIUS servers securely.
The RADIUS server is the final authority
responsible for validating the user's identity.
So the RADIUS server is like a security control room
that performs a thorough check on the presented credentials.
It uses its database or connects to other directories
like active directory
to validate that the username and password
or certificate are correct.
If the credentials are verified successfully,
the RADIUS server sends an approval message
back to the RADIUS client
granting the supplicant access to the network.
Once the RADIUS client receives this approval
from the server, it informs the network components
allowing the supplicant full access
to the resources they are permitted to use.
This final step ensures that only properly authenticated
devices and users can connect to the network.
This authentication process can occur
both when a supplicant connects wirelessly to a network
or connects to a wired network.
Second, we have the Extensible Authentication Protocol
or EAP, which we've already started to discuss.
As a reminder, EAP is a flexible framework
that supports multiple authentication methods between
a supplicant and a RADIUS client wireless access point.
EAP was developed to replace older, less secure methods
like the Password Authentication Protocol
and the Challenge-Handshake Authentication Protocol
or CHAP, offering more robust
and adaptable authentication solutions for modern networks.
Before diving into EAP, it's important
to understand those older protocols that it replaced.
The Password Authentication Protocol or PAP
is one of the earliest and simplest
methods of authentication.
PAP works by having the client connect to a server
and transmit the username and password in plain text.
The server then checks these credentials
against its database and responds
with either an acceptance or rejection message.
The major flaw of the Password Authentication Protocol
is that it sends credentials in plain text,
making it vulnerable to interception and highly insecure.
So to address Password Authentication Protocol shortcomings,
the Challenge-Handshake Authentication Protocol
or CHAP was developed.
CHAP improves security
by using a challenge and response mechanism.
Instead of sending credentials in plain text.
With CHAP the server sends a random
challenge string to the client.
The client encrypts this challenge string
using a hash function combined with its password
and sends the encrypted response back to the server.
The server then performs the same hash operation
using its stored version of the client's password
and compares the results.
If the results match, authentication is successful.
This method enhances security
by never sending the actual password over the network
while still allowing authentication.
Microsoft introduced a variant of CHAP
called the Microsoft Challenge
Handshake Authentication Protocol or MS-CHAP.
MS-CHAP includes improvements like stronger encryption keys
and mutual authentication capabilities where both the client
and server verify each other's identities.
However, both CHAP and MS-CHAP have been surpassed
by the more flexible and secure
Extensible Authentication Protocol.
But the Extensible Authentication Protocol, or EAP,
is not a standalone protocol,
but rather a framework that supports a wide range
of authentication methods, including passwords
and digital certificates.
It is designed to be highly adaptable,
allowing for various authentication processes
based on the specific security needs of the network.
Here are five commonly used EAP types,
each offering different features and security levels.
The first EAP type is EAP-MD5 CHAP.
This variant uses the CHAP challenge and response process
within the EAP framework
and relies on passwords for authentication.
Although EAP-MD5 CHAP improves slightly
upon the basic Challenge-Handshake Authentication Protocol,
it still depends on simple password-based security,
making it vulnerable to dictionary attacks
if weak passwords are used.
The second EAP type
is EAP-Transport Layer Security, or EAP-TLS.
EAP-TLS is one of the most secure forms of EAP
using digital certificates installed on both the supplicant
and server for authentication, it eliminates the use
of passwords entirely providing robust mutual
authentication through the exchange of digital certificates.
The third EAP type
is Protected Extensible Authentication Protocol or PEAP.
PEAP establishes an encrypted tunnel
between the supplicant and the authentication server.
The server uses a digital certificate to authenticate itself
forming the secure tunnel.
Inside this tunnel, the user can authenticate
using methods like CHAPv2 or one-time passwords.
This layered approach helps protect against attacks
such as sniffing, password guessing, and on-path attacks.
Another variant of EAP
is EAP Tunneled Transport Layer Security, or EAP-TTLS.
EAP-TTLS is similar to PEAP,
the Protected Extensible Authentication Protocol,
but allows for greater flexibility
in choosing the authentication method within the tunnel.
It still requires a server certificate,
but uses passwords for client authentication,
making it less secure than EAP-TLS
while still being a significant improvement
over basic password authentication methods.
The last EAP variant is EAP with Flexible Authentication
via Secure Tunneling or EAP-FAST.
EAP-FAST uses a protected access credential
instead of a certificate to create the secure tunnel,
making it faster and easier to implement.
However, distributing these credentials can be challenging
simply because the credential needs to be issued
in a secure manner.
So EAP-FAST is considered less secure
than EAP-TLS, PEAP or EAP-TTLS.
Overall, for the highest level of security, EAP-TLS
with mutual certificate authentication is recommended.
If implementing digital certificates is too costly
or complex, PEAP or EAP-TTLS offer good alternatives
that still provide good security features.
Third and last, we have
the Simultaneous Authentication of Equals or SAE.
WPA3 or WiFi Protected Access 3 is a WiFi authentication
protocol that includes a feature
called the Simultaneous Authentication of Equals or SAE.
SAE replaces the older four-way handshake
authentication mechanism that was introduced
with the original WPA and WPA2 protocol.
The old handshake relied on the Diffie-Hellman key agreement
to exchange a pre shared key
between the client and access point.
However, this method was vulnerable to interception,
cracking and replay methods.
So with WPA3, these vulnerabilities are addressed
by eliminating the old key exchange process
and replacing it
with the Simultaneous Authentication of Equals.
SAE is a secure password-based authentication method
that relies on forward secrecy to protect its data.
Forward secrecy, also known as perfect forward secrecy,
ensures that even if long-term keys used in key exchanges
are compromised, the session keys generated
during each session remain secure and unique.
This is significant because it prevents an attacker
from decrypting past communications,
even if they later gain access
to the long-term secrets such as private keys.
So SAE is a secure key exchange method
that ensures forward secrecy.
The process starts with mutual authentication
between an access point and a client using passwords.
Unlike traditional public key systems,
SAE does not generate or store long-term keys,
which means each session's security
is independent of any previous secrets.
The next step involves a key exchange
using the Dragonfly algorithm,
which is a password-authenticated key exchange
protocol that is more secure
than traditional methods like Diffie-Hellman.
Dragonfly uses elliptic curve cryptography
to create a shared secret,
which is then used to generate a unique session key.
Once the session key is established,
it is used to encrypt all communication
between the access point and the client.
Each message in the session is encrypted using this key,
ensuring that only the intended recipient
can read the messages.
This process maintains security
even if some of the data is intercepted.
The encryption and decryption of messages
relies solely on the session key,
and each session key is unique to that session.
Importantly, a new session key is generated
for every session which provides forward secrecy.
This means that even if a session key is compromised,
it does not affect the security of past or future sessions.
SAE's continuous key rotation protects all communications,
ensuring that each session remains secure,
independent of the others.
This makes WPA3 far more secure
than previous protocols like WPA2, WPA and WEP,
offering stronger protection
for wireless communications on networks and mobile devices.
So remember, WiFi authentication
uses methods like IEEE 802.1X,
the Extensible Authentication Protocol, or EAP,
and the Simultaneous Authentication of Equals or SAE.
802.1X acts as a gatekeeper, verifying device identities
and controlling network access
through an authentication server like RADIUS.
EAP is a flexible framework within the 802.1X protocol
that supports various authentication methods,
enhancing security by securely exchanging credentials.
Finally, SAE used in WPA3
replaces older, less secure handshake protocols
with a secure password-based key exchange
that ensures forward secrecy.
By frequently generating unique session keys
SAE protects past and future communications
even if the current session key is compromised.
Together, these authentication concepts
enhance WiFi security by providing
robust adaptable authentication.