Basics
WPA Enterprise uses Extensible Authentication Protocol or EAP.
EAP is a framework for authentication,
which allows a number of different authentication schemes or methods.
Authentication is done using a Remote Authentication Dial-In User Service
or RADIUS server.
The client authenticates using a number of EAP frames,
depending on the agreed upon authentication scheme,
which are relayed by the AP to the RADIUS server.
If authentication is successful,
the result is then used as Pairwise Master Key for the 4-way handshake,
as opposed to PSK, where the passphrase is derived to generate the PMK.
Authentication to a RADIUS server with most common EAP methods,
requires the use of certificates on the server side at the very least.
Some older, now deprecated EAP methods don’t require certificates.
Although a number of authentication schemes are possible,
only some of them are commonly used, due to their security,
and integration with existing operating systems.
It is common to use a username and password to authenticate
which could be tied to domain credentials.
We’ll go over a few EAPs commonly used on Wi-Fi networks.
EAP Transport Layer Security or EAP-TLS is one of the most secure
authentication methods, as it uses certificates on the server side
and client side, instead of a login and password,
so the client and server mutually authenticate each other.
EAP Tunneled Transport Layer Security, as the name suggests, also uses TLS.
As opposed to EAP-TLS, it does not necessarily need client certificates.
It creates a tunnel and then exchanges the credentials using one of the few possible
different inner methods (also called phase 2),
such as Challenge-Handshake Authentication Protocol, (CHAP)
Authentication Protocol,
Microsoft CHAP,
or MS-CHAPv2.
Similarly to EAP-TTLS,
Protected Extensible Authentication Protocol (PEAP),
also creates a TLS tunnel before credentials are exchanged.
Although different methods can be used within PEAP,
MS-CHAPv2 is a commonly used inner method.
PEAP and EAP-TLS mostly differ on how the data is exchanged inside the TLS tunnel.