ZyXEL Communications 100-NH User Manual page 186

Appendix E Wireless LANs
For added security, certificate-based authentications (EAP-TLS, EAP-TTLS and PEAP) use dynamic
keys for data encryption. They are often deployed in corporate environments, but for public
deployment, a simple user name and password pair is more practical. The following table is a
comparison of the features of authentication types.
Table 57 Comparison of EAP Authentication Types
Mutual Authentication
Certificate – Client
Certificate – Server
Dynamic Key Exchange
Credential Integrity
Deployment Difficulty
Client Identity Protection
WPA2
WPA2 (IEEE 802.11i) is a wireless security standard that defines stronger encryption,
authentication and key management.
Key differences between WPA2 and WEP are improved data encryption and user authentication.
If both an AP and the wireless clients support WPA2 and you have an external RADIUS server, use
WPA2 for stronger data encryption. If you don't have an external RADIUS server, you should use
WPA2-PSK (WPA2-Pre-Shared Key) that only requires a single (identical) password entered into
each access point, wireless gateway and wireless client. As long as the passwords match, a wireless
client will be granted access to a WLAN.
Select WEP only when the AP and/or wireless clients do not support WPA2. WEP is less secure than
WPA2.
Encryption
WPA2 uses TKIP when required for compatibility reasons, but offers stronger encryption than TKIP
with Advanced Encryption Standard (AES) in the Counter mode with Cipher block chaining Message
authentication code Protocol (CCMP).
TKIP uses 128-bit keys that are dynamically generated and distributed by the authentication server.
AES (Advanced Encryption Standard) is a block cipher that uses a 256-bit mathematical algorithm
called Rijndael. They both include a per-packet key mixing function, a Message Integrity Check
(MIC) named Michael, an extended initialization vector (IV) with sequencing rules, and a re-keying
mechanism.
WPA2 regularly change and rotate the encryption keys so that the same encryption key is never
used twice.
The RADIUS server distributes a Pairwise Master Key (PMK) key to the AP that then sets up a key
hierarchy and management system, using the PMK to dynamically generate unique data encryption
keys to encrypt every data packet that is wirelessly communicated between the AP and the wireless
clients. This all happens in the background automatically.
186
EAP-MD5 EAP-TLS
No Yes
No Yes
No Yes
No Yes
None Strong
Easy Hard
No No
EAP-TTLS PEAP
Yes Yes
Optional Optional
Yes Yes
Yes Yes
Strong Strong
Moderate Moderate
Yes Yes
NWA1000 Series User's Guide
LEAP
Yes
No
No
Yes
Moderate
Moderate
No