EAP

This page is kind of a mess, because the state of EAP in the industry is kind of a mess.

I started trying to understand the EAP methods from this diagram.

Most of these implementations are bespoke (they do not coexist well). The closest thing to a standard would be TEAP, which doesn’t seem common.

Terms

EAP — Extensible Authentication Protocol

EAPOL — Extensible Authentication Protocol over LANs

TEAP — Tunneled Extensible Authentication Protocol

PEAP — Protected Extensible Authentication Protocol

Inner EAP

EAP methods which should not be sent in clear text, but are still used by the industry.

802.1X

Port based network access control, usually implemented via EAP.

Session-id

• Uniquely identifies an authentication exchange

Why are there so many versions of EAP

There are a few problems:

1. End-to-End PKI is difficult and expensive

   Reference standard EAP is probably EAP-TLS, but it’s difficult and expensive, because end-to-end full certificate PKI is hard.

   Everything needs a x509 certificate:

   • The user’s machine
   • APs
   • WLC
   • Authenticator (the RADIUS, or TACACS+ server) All these certificates need to be refreshed. They can’t be issued indefinitely, and managing certificates is difficult and expensive.

2. Active Directory Exists

   What most organizations want to auth against isn’t another database, but the database they already have, Windows Active Directory.

   The customer can be convinced to buy something like Cisco ISE, or implement FreeRADIUS so long as those products work with Active Directory.

   • EAP-MSCHAPv2

3. Vendor Standards come to market faster

   In the security space, where perception is part of the brand, being first to market matters. Interoperability is a distant second.

   • PEAP
   • LEAP
   • EAP-FAST

4. “Why don’t we just tunnel it”

   Lots of EAP methods tunnel an existing method, over a more secure method. TEAP tries to solve this, but lots of vendor tunnel implementations exist.

   • EAP-TTLS
   • EAP-FAST

5. “I gotta use this hardware I have”

   MFA tokens, and SIM cards are frequently involved in the auth pathway.

   • EAP-GTC
   • EAP-SIM
   • EAP-AKA

6. “I would be nice if the user could just type something in”

   … Becomes local implementations like

   • EAP-pwd

EAP Implementations

EAP Type Progression

EAP is a framework, not one authentication mechanism. The overlap mostly comes from TLS tunneling: PEAP, EAP-FAST, and TEAP all build a protected tunnel first, then run some inner authentication inside it.

graph TD
    eap["EAP framework"]

    eap --> legacy["legacy / direct password methods"]
    legacy --> md5["EAP-MD5"]
    legacy --> leap["LEAP"]

    eap --> cert["certificate-based TLS"]
    cert --> tls["EAP-TLS"]
    tls --> tls13["EAP-TLS 1.3"]

    eap --> tunneled["tunneled TLS methods"]
    tunneled --> peap["PEAP"]
    peap --> peapMschap["PEAP / EAP-MSCHAPv2"]
    peap --> peapGtc["PEAP / EAP-GTC"]
    peap --> peapTls["PEAP / EAP-TLS"]

    tunneled --> fast["EAP-FAST"]
    fast --> fastMschap["EAP-FAST / EAP-MSCHAPv2"]
    fast --> fastGtc["EAP-FAST / EAP-GTC"]
    fast --> fastTls["EAP-FAST / EAP-TLS"]
    fast --> fastChaining["EAP-FAST chaining"]

    tunneled --> teap["TEAP"]
    teap --> teapTls["TEAP / EAP-TLS"]
    teap --> teapMschap["TEAP / EAP-MSCHAPv2"]
    teap --> teapChaining["TEAP chaining"]

    eap --> simBased["SIM / mobile network methods"]
    simBased --> sim["EAP-SIM"]
    simBased --> aka["EAP-AKA / EAP-AKA'"]

    eap --> pwdBased["password-authenticated key exchange"]
    pwdBased --> pwd["EAP-PWD"]

    style md5                   fill:#ddd,color:#aaa,stroke:#ccc
    style leap                  fill:#ddd,color:#aaa,stroke:#ccc
    style sim                   fill:#ddd,color:#aaa,stroke:#ccc
    style aka                   fill:#ddd,color:#aaa,stroke:#ccc
    style pwd                   fill:#ddd,color:#aaa,stroke:#ccc
    style tls                   fill:#1a4a6b,color:#fff,stroke:#1a4a6b
    style tls13                 fill:#1a4a6b,color:#fff,stroke:#1a4a6b
    style peap                  fill:#1a4a6b,color:#fff,stroke:#1a4a6b
    style peapMschap            fill:#1a4a6b,color:#fff,stroke:#1a4a6b
    style peapGtc               fill:#1a4a6b,color:#fff,stroke:#1a4a6b
    style peapTls               fill:#1a4a6b,color:#fff,stroke:#1a4a6b
    style fast                  fill:#1a4a6b,color:#fff,stroke:#1a4a6b
    style fastMschap            fill:#1a4a6b,color:#fff,stroke:#1a4a6b
    style fastGtc               fill:#1a4a6b,color:#fff,stroke:#1a4a6b
    style fastTls               fill:#1a4a6b,color:#fff,stroke:#1a4a6b
    style fastChaining          fill:#1a4a6b,color:#fff,stroke:#1a4a6b
    style teap                  fill:#1a4a6b,color:#fff,stroke:#1a4a6b
    style teapTls               fill:#1a4a6b,color:#fff,stroke:#1a4a6b
    style teapMschap            fill:#1a4a6b,color:#fff,stroke:#1a4a6b
    style teapChaining          fill:#1a4a6b,color:#fff,stroke:#1a4a6b

References

EAP - RFC 3748: Extensible Authentication Protocol | RFC Editor

EAP-FAST - RFC 4851: The Flexible Authentication via Secure Tunneling Extensible Authentication Protocol Method | RFC Editor

EAP-TLS - RFC 5216: The EAP-TLS Authentication Protocol | RFC Editor

TEAP - RFC 9930: Tunnel Extensible Authentication Protocol Version 1 | RFC Editor

RFC 4017: Extensible Authentication Protocol (EAP) Method Requirements for Wireless LANs | RFC Editor

TEAP - HPE Aruba Networking Tech Corner

Authentication protocol - Wikipedia

Extensible Authentication Protocol - Wikipedia

FreeRADIUS Community

Extensible Authentication Protocol (EAP) Registry