Table of Contents
Advertisement
•
Authentication. EAP over 802.1X is used for authentication. Mutual authentication is gained
by choosing an EAP type supporting this feature and is required by WPA. 802.1X port access
control prevents full access to the network until authentication completes. 802.1X
EAPOL-Key packets are used by WPA to distribute per-session keys to those stations
successfully authenticated.
The supplicant in the station uses the authentication and cipher suite information contained in
the information elements to decide which authentication method and cipher suite to use. For
example, if the access point is using the pre-shared key method then the supplicant need not
authenticate using full-blown 802.1X. Rather, the supplicant must simply prove to the access
point that it is in possession of the pre-shared key. If the supplicant detects that the service set
does not contain a WPA information element then it knows it must use pre-WPA 802.1X
authentication and key management in order to access the network.
•
Key management. WPA features a robust key generation/management system that integrates
the authentication and data privacy functions. Keys are generated after successful
authentication and through a subsequent 4-way handshake between the station and Access
Point (AP).
•
Data Privacy (Encryption). Temporal Key Integrity Protocol (TKIP) is used to wrap WEP in
sophisticated cryptographic and security techniques to overcome most of its weaknesses.
•
Data integrity. TKIP includes a message integrity code (MIC) at the end of each plaintext
message to ensure messages are not being spoofed.
WPA Authentication: Enterprise-level User
Authentication via 802.1x/EAP and RADIUS
Wireless LAN
WPA
enabled
wireless
client with
"supplicant"
Figure B-1: WPA Overview
Wireless Networking Basics
User Manual for the NETGEAR 54 Mbps Wireless PC Card WG511 v2
WPA enabled
Access Point
using
pre-shared key
or
Ports Opened
802.1x
Authenticated
June 2005
Wired Network with Optional
802.1x Port Based Network
Access Control
TCP/IP
Ports Closed
Until
RADIUS Server
Authentication
TCP/IP
After
Certificate
Authority
Login
(for
example
Win Server,
VeriSign)
B-11
Advertisement
Table of Contents
