- [Instructor] There are several methods,
new and old, to authenticate a user,
as they attempt to join a wireless network.
Authentication is simply supplying some form
of credentials to be allowed access to join.
A lot of guest networks have open authentication.
Open auth accepts all connections,
with zero authentication.
All clients that want to connect,
are allowed to do so.
Many of these open auth networks employ hotspots,
that require the user to login via webpage,
to gain true access to the network.
The Extensible Authentication Protocol, EAP,
is a set of functions that authentication
methods utilize to authenticate users.
In essence, it's a framework that different
authentication methods use auth users
as they attempt connection.
802.1X is a system, that runs a piece of software
called a supplicant on a client device,
like a phone or laptop.
When they connect to a network the supplicant
will speak with an authenticator,
which is a network device,
and is kind of along the access point.
The authenticator will then pass credentials
supplied by the supplicant,
to an authentication server.
The authentication server will then
pass back a yes or no to the authenticator.
If the client gets a yes,
it's allowed on the network.
If it gets a no, then it's blocked there.
Again, this utilizes the EAP framework.
Other EAP Protocols are;
Leap, was deprecated long ago with WEP,
Cisco developed EAP-FAST,
Protected EAP, or PEAP, which like EAP-FAST
uses digital certificates for part of
the authentication process.
It also utilizes MSCHAP version 2,
or a hardware token.
EAP-TLS uses certificates on both,
the authentication server, and the client.
This is considered the most secure
authentication method, but,
also the most cumbersome to administer.
Various levels of authentication and encryption,
are offered at configuration time,
through a series of Wi-Fi protected access systems.
WPA was put in to practice in 2003,
as an immediate replacement for the fatally,
flawed wireless equivalency privacy system.
WPA implemented a temporal key
integrity protocol, or TKIP.
This employs a per packet key,
that generates a new 128-bit key
for each packet sent.
WPA also replaces WEP's CRC, with a
message integrity check vie TKIP.
WPA2 began being introduced around
the 2004 to 2006 mark.
It includes mandatory support for CCMP,
which is an AES-based encryption mode,
making it more secure than WPA.
WPA3 was announced as a replacement for WPA2
in January of 2018, though,
its adoption has been slow.
This new standard uses 128-bit
encryption in personal mode,
and 192-bit encryption in enterprise mode.
It also uses forward secrecy.
A more secure initial key exchange,
is achieved vie simultaneous authentication
of equals, as opposed to the standard,
pre-shared key system previously employed.
All reliance on WiFi will only
continue to grow, and our security policies
must keep up with it also.