FIBRAS EN EL CONCRETO

This section provides additional information on the conceptual architecture of EAP for readers seeking a better understanding of how EAP works and how it interacts with other protocols. Readers who do not need this information should skip this section and proceed to Section 6.5.

RFC 3748 provides a framework for EAP using a four-layer conceptual model described in Table 6-5. It is called the EAP multiplexing model because it describes how EAP can handle multiple EAP methods in the same EAP implementation.

Table 6-5. EAP Multiplexing Model

Model Layer Description

Method Layer

Implements the specified EAP method, which performs the actual authentication transaction. During an EAP dialog, an EAP method on the peer communicates with the equivalent EAP method on the authenticator.

Peer/Authenticator Layer

Forwards EAP packets between the EAP layer and the appropriate EAP method. STAs and ASs that mutually authenticate one another serve in both the peer and authenticator roles. APs serve as pass-through authenticators, proxying traffic for both the STA and the AS when they serve in the authenticator role.

EAP Layer

Manages the EAP dialog—receiving and transmitting EAP packets via the lower layer, detecting duplicate packets, retransmitting packets when necessary, and handling communication with the EAP peer or authenticator. EAP packets containing request, success, or failure notices are delivered to the peer layer; EAP packets containing responses to requests are delivered to the authenticator layer. Lower Layer Responsible for encapsulating and transmitting EAP frames between the peer and

the authenticator.

90 _{Checklists and implementation guides for securing various server operating systems are available from NIST’s Security} Configuration Checklists Program for IT Products at http://checklists.nist.gov/.

In a typical IEEE 802.11 RSN configuration, communication flows through the four layers as shown in Figure 6-5. Messages traveling between layers within a device are transported logically within the device’s EAP software implementation. Flows between devices occur over a network using lower-layer protocols. Communication flows occur in both directions, as shown by the arrows in the figure. For example, when the EAP method on the AS generates a request, the EAP method on the STA responds to that request. When the AS receives the response, it replies with either a success or failure message, accompanied by key material in the case of success. The Peer/Authenticator layer on each device determines whether to pass the message through (in the case of an AP) or forward it to the appropriate EAP method (in the case of the STA and AS). The EAP layer packages the messages for the lower layer protocols, which are typically IEEE 802.11 or RADIUS.

Model Layer STA

AP

AS

Method Layer EAP Method EAP Method

Peer/Authenticator Layer EAP Peer/ Authenticator EAP Authenticator EAP Peer/ Authenticator

EAP Layer EAP Layer EAP Layer EAP Layer

Lower Layer IEEE 802.11 Wired network protocols

Figure 6-5. EAP Traffic Flow in IEEE 802.11 RSN

EAP implementations differ considerably for the method and lower layers, but are very similar for the middle two layers. Organizations need to determine how to implement the method and lower layers in their environments, which involves selecting one or more EAP methods (discussed previously in Section 6.2) and establishing the protocols that the AS will use to transport authentication messages. Typical support requirements and configurations for each of the key WLAN components are discussed in Table 6-6. The AP does not need to support EAP methods, but it must support the lower layer communications protocols of both the STA and AS.

An important concept at the lower layer is EAP encapsulation, which describes how EAP packets are transferred between peer and authenticator. The encapsulation method can differ depending on the network environment. The most common form of EAP encapsulation in IP networks is EAP over RADIUS.91 In a typical WLAN configuration, the AS either hosts the AAA database or acts as a “front end to the real user database, which might be Active Directory, LDAP, Kerberos, or numerous other alternatives; the AS uses RADIUS to communicate with STAs and other devices. For this reason, the AS is often called the RADIUS or AAA server.

91 _{For more information on EAP over RADIUS, see RFC 3579, RADIUS Support for EAP, at}

http://www.ietf.org/rfc/rfc3579.txt.

6-17

Table 6-6. EAP Support Requirements for WLAN Components

WLAN Component

Requirement Area

STA AP AS

EAP Method Support

Each peer can support multiple EAP methods, but there must be at least one method in common with the AS for a dialog to occur. Supported EAP methods may be native to an operating system or bundled with third-party WLAN software.

The AP does not support EAP methods. It merely passes EAP messages between the STA and AS. Some APs filter EAP methods that they do not allow, although this violates RFC 3748.

The AS is typically a AAA server that supports RADIUS and one or more EAP methods. It can require that the STA use particular EAP methods to authenticate successfully.

Peer/Authenticator Layer Support EAP Layer Support

The middle layers are implemented in software resident on each of the components of the WLAN solution. Organizations do not have configuration options with respect to the middle layers.

Lower Layer Support

The lower layer between the STA and AP is the EAP over LAN (EAPOL) protocol using IEEE 802.11 for media access control and data link communications.

The lower layer between the AP and the AS is likely to be RADIUS over IP. In cases in which the network between the AP and AS is not an IP network, EAPOL using another IEEE 802-series link layer protocol is the most common approach.

In some implementations, the STA does not have access to IP network services until it successfully authenticates with an AS. When IP services are unavailable, the most common approach is to use EAP over LAN (EAPOL) encapsulation, which enables EAP to be transported in the frames of IEEE 802 link layer protocols. EAPOL is defined in IEEE 802.1X. The WLAN vendor’s EAP implementation typically will determine whether the transport mechanism is EAP over RADIUS or EAPOL.

6.5 Summary

Defined in RFC 3748, EAP is used during the authentication phase of an IEEE 802.11 RSN and provides the authentication framework for IEEE 802.11 RSNs that use IEEE 802.1X port-based access control. EAP can be adapted to new authentication methods as they become available and can operate over a variety of different network and link layer protocols, including IP and IEEE 802-series medium access protocols. For these reasons, EAP is well-suited to providing authentication services for WLANs. EAP defines the stages of an EAP conversation that consists of one or more EAP methods. The EAP methods perform the authentication transaction and generate key material. While the basic rules of the EAP conversation are common to all EAP implementations, the EAP methods can vary from one implementation to another, requiring different levels of user interaction, using different authentication methods, and employing different cipher suites. This flexibility has benefits, but it may also introduce risk. To maintain security, organizations should select EAP methods appropriate to their environment. IANA has defined numerous EAP method types, but not all of these are appropriate for WLAN

applications. For example, RFC 3748 defines three methods—MD5-Challenge, One-Time Password, and Generic Token Card—but none of these can satisfy the necessary security requirements for WLANs.

TLS-based methods such as EAP-TLS, EAP-TTLS, PEAP, and EAP-FAST provide more robust alternatives that can satisfy these requirements. The primary distinction between them is the level of PKI support required. EAP-TLS requires both STAs and ASs to possess valid certificates. EAP-TTLS and PEAP can support configurations with AS certificates only. EAP-FAST can support EAP authentication with certificates or, alternatively, with no certificates, instead using PACs, a type of pre-shared keys. Before organizations select WLAN equipment, they should review their existing identity management infrastructure, authentication requirements, and security policy to determine the EAP method or methods that are most appropriate in their environment, then purchase systems that support the chosen EAP methods.

Many EAP methods are currently defined only in IETF Internet-Drafts and thus are not yet official standards. Organizations are encouraged to obtain the latest available information before making final determinations on their IEEE 802.11 RSN authentication architecture and product procurement.

6-19

This page has been left blank intentionally.