Novell LINUX ENTERPRISE DESKTOP 10 SP2 - DEPLOYMENT GUIDE 08-05-2008 Deployment Manual page 583

terprises. In private networks, it is scarcely used. For this reason, WPA-EAP is
sometimes referred to as WPA "Enterprise".
WPA-EAP needs a Radius server to authenticate users. EAP offers three different
methods for connecting and authenticating to the server: TLS (Transport Layer
Security), TTLS (Tunneled Transport Layer Security), and PEAP (Protected Exten-
sible Authentication Protocol). In a nutshell, these options work as follows:
EAP-TLS
TLS authentication relies on the mutual exchange of certificates both for
server and client. First, the server presents its certificate to the client where it
is evaluated. If the certificate is considered valid, the client in turn presents its
certificate to the server. While TLS is secure, it requires a working certification
management infrastructure in your network. This infrastructure is rarely found
in private networks.
EAP-TTLS and PEAP
Both TTLS and PEAP are two-stage protocols. In the first stage, a secure is
established and in the second one the client authentication data is exchanged.
They require far less certification management overhead than TLS, if any.
Encryption
There are various encryption methods to ensure that no unauthorized person can read
the data packets that are exchanged in a wireless network or gain access to the network:
WEP (defined in IEEE 802.11)
This standard makes use of the RC4 encryption algorithm, originally with a key
length of 40 bits, later also with 104 bits. Often, the length is declared as 64 bits
or 128 bits, depending on whether the 24 bits of the initialization vector are included.
However, this standard has some weaknesses. Attacks against the keys generated
by this system may be successful. Nevertheless, it is better to use WEP than not
encrypt the network at all.
TKIP (defined in WPA/IEEE 802.11i)
This key management protocol defined in the WPA standard uses the same encryp-
tion algorithm as WEP, but eliminates its weakness. Because a new key is generated
for every data packet, attacks against these keys are in vain. TKIP is used together
with WPA-PSK.
Wireless Communication 567