Hand Held Products 7900 manual Cisco Leap, Relative Merits of Authentication Protocols

Dynamic Session Specific Wireless Encryption Keys

There have been many published reports recently about the lack of security provided by the Wired Equivalent Privacy (WEP) protocol. One of the problems with WEP is that the shared key used by the station and the AP is inherently static. That is, this shared key will only change if it is manually reconfigured on both devices. The Client remedies this by supporting the Transport Layer Security (TLS) protocol. TLS ensures that a new shared key is generated each time a station associates itself with an AP. TLS has proven itself an excellent authentication and encryption protocol in commercial environments. The Client also supports the MD5 and TTLS security protocols.

Additional Advantages of TTLS and PEAP

The Client provides the advantage of Tunneled TLS (TTLS) and PEAP support. These protocols provide the security of TLS with greatly reduced administrative load. Security is enhanced by never passing user ID and password in the clear. No "real" user ID or password is required in Phase 1. After the secure tunnel is established, Phase 2, user credentials are passed in safe, encrypted form. To further enhance security, the WEP keys, which encrypt the data between the wireless card and the AP, may be automatically changed on a per-session basis, limiting the time available to an unauthorized sniffer to crack the keys. By limiting the session time (the reauthentication period), the keys can essentially be made uncrackable.

Administration is eased by greatly reduced certificate requirements in comparison to TLS. In TLS, each client must have a client certificate to pass to the server, and a CA certificate with which to verify a server certificate, while the server must have a client certificate from each user and CA certificates for each possible CA chain and its own server certificate. TTLS and PEAP require only that a single server certificate be created for the server to present to the client, and that the client have a CA certificate to verify the server. Because these are the same for each client on the network, they are easily managed, unlike TLS, where every client certificate is unique. TTLS and PEAP thus provide the security of a TLS channel without the need for managers to distribute and manage client certificates. Lastly, TTLS allows for the use of existing legacy authentication protocols. Administrators may continue to use established authentication databases.

Cisco LEAP

The message exchange used by Cisco LEAP is proprietary. This protocol is not a standard EAP type, but is supported by the Client through a licensing arrangement with Cisco.

Relative Merits of Authentication Protocols

MD5 is the least secure of the EAP protocols as it only does a one-way authentication, and does not support automatic distribution and rotation of WEP keys, increasing the administrative burden of manual WEP key maintenance.

TLS, while the most secure EAP protocol, requires client certificates to be installed on each wireless client. Establishing and maintaining this PKI infrastructure is normally a burden most administrators do not feel is worth the extra level of security gained.

TTLS and PEAP bypassed the certificate issue by tunneling TLS, and thus eliminating the need for a certificate on the client side. PEAP supports only EAP-compliant authentication protocols within the tunnel structure, and is rapidly becoming the most widely supported of the EAP methods. TTLS supports pre-EAP authentication protocols within the tunnel structure, and should be used in those circumstances when pre-EAP interior protocols are desirable.

LEAP is a pre-EAP, Cisco-proprietary protocol, with many of the features of EAP protocols. Cisco controls the ability of other vendors to implement this protocol, so it should be selected for use only when limited vendor choice for client, access-point, and server products is not a concern.

Dolphin® 7900 Series User’s Guide Rev D 9 - 33