ZyXEL Communications NBG6515 User Manual page 212

authentication, EAP-TTLS supports EAP methods and legacy authentication methods such as PAP, CHAP,
MS-CHAP and MS-CHAP v2.
PEAP (Pro te c te d EAP)
Like EAP-TTLS, server-side certificate authentication is used to establish a secure connection, then use
simple username and password methods through the secured connection to authenticate the clients,
thus hiding client identity. However, PEAP only supports EAP methods, such as EAP-MD5, EAP-MSCHAPv2
and EAP-GTC (EAP-Generic Token Card), for client authentication. EAP-GTC is implemented only by
Cisco.
L EAP
LEAP (Lightweight Extensible Authentication Protocol) is a Cisco implementation of IEEE 802.1x.
Dyna m ic WEP Ke y Exc ha ng e
The AP maps a unique key that is generated with the RADIUS server. This key expires when the WiFi
connection times out, disconnects or reauthentication times out. A new WEP key is generated each
time reauthentication is performed.
If this feature is enabled, it is not necessary to configure a default encryption key in the WiFi security
configuration screen. You may still configure and store keys, but they will not be used while dynamic
WEP is enabled.
Note: EAP-MD5 cannot be used with Dynamic WEP Key Exchange
For added security, certificate-based authentications (EAP-TLS, EAP-TTLS and PEAP) use dynamic keys for
data encryption. They are often deployed in corporate environments, but for public deployment, a
simple user name and password pair is more practical. The following table is a comparison of the
features of authentication types.
Table 91 Comparison of EAP Authentication Types
Mutual Authentication
Certificate – Client
Certificate – Server
Dynamic Key Exchange
Credential Integrity
Deployment Difficulty
Client Identity Protection
Enc ryptio n
The RADIUS server distributes a Pairwise Master Key (PMK) key to the AP that then sets up a key hierarchy
and management system, using the PMK to dynamically generate unique data encryption keys to
encrypt every data packet that is wirelessly communicated between the AP and the WiFi clients. This all
happens in the background automatically.
WPA(2)-PSK uses a simple common password, instead of user-specific credentials. The common-
password approach makes WPA(2)-PSK susceptible to brute-force password-guessing attacks but it's still
Appendix C Wireless LANs
EAP- MD5 EAP- T L S
No Yes
No Yes
No Yes
No Yes
None Strong
Easy Hard
No No
NBG6515 User's Guide
212
EAP- T T L S PEAP
Yes Yes
Optional Optional
Yes Yes
Yes Yes
Strong Strong
Moderate Moderate
Yes Yes
L EAP
Yes
No
No
Yes
Moderate
Moderate
No