No subject

[bogus at does.not.exist.com]

 <BR>
Differences between EAP-TLS and EAP-TTLS<BR>
1) EAP-TTLS is divided into 2 phases: In the first phase: it uses EAP-TLS to set up a tunnel. In this phase the client authenticate the server. The server is unable to authenticate the client because the client usually use anonymous id in the first phase. In the second phase, EA-TTLS uses another authentication method( can be other EAPs or MS-CHAP) in the tunnel. In this phase, the client uses its actual identity. Thew server will authenticate the client. Therefore, mutual authentication is achieved. In contrast, EAP-TLS uses only one phase, which is the TLS handshake phase to complete the mutual authentication. As a result, the identity is exposed in clear text in the first EAP-TLS message. <BR>
 <BR>
2) EAP-TLS requires certs to be used at both client and server sides for mutual authentication. Therefore, key management is slightly more complex than EAP-TTLS. On the other hand, EAP-TTLS has a choice of using cert for the server authentication and other authentication credentials such as certs or passwords for client authentcation. <BR>
 <BR>
3) If you are using EAP-TLS in the tunnel of EAP-TTLS, the authentication process will take slightly longer because EAP-TTLS will perform 2 EAP-TLS. One for setting up the tunnel, and another inside the tunnel. Whereas EAP-TLS will only perform message exchanges of 1 EAP-TLS using lesser number of message exchanges. Of course if the tunnel in EAP-TTLS is not using EAP-TLS, it will be another story. <BR>
 <BR>
Bryan   <BR><BR>> Date: Wed, 13 Aug 2008 08:50:21 +0200<BR>> From: martincschneider at googlemail.com<BR>> To: hostap at lists.shmoo.com<BR>> Subject: Re: EAP-TLS vs. EAP-TTLS<BR>> <BR>> Hello Jouni and others<BR>> <BR>> Thanks for your reply.<BR>> <BR>> > > EAP-TLS is *only* used for mutual authentication based on certificates<BR>> > > between client and server. But it won't establish a TLS tunnel, that can be<BR>> > > used for executing other/additional EAP methods.<BR>> ><BR>> > Yes, or well, to be exact, EAP-TLS is actually completing the TLS<BR>> > handshake and in some sense, the tunnel would be established for<BR>> > application data, it is just not used in practice since EAP-TLS is<BR>> > completed at that point.<BR>> <BR>> Ok, so it is possible, but nobody uses it.<BR>> <BR>> Only for being sure that I got everything right: the correct way is<BR>> executing EAP
 -TTLS (or PEAP or FAST), that will<BR>> <BR>> a.) authenticate Server and optionally Client<BR>> b.) establish a secure tunnel between Client and Server<BR>> <BR>> and<BR>> <BR>> c.) execute -if needed- additional EAP methods secured by the tunnel.<BR>> <BR>> Is this correct?<BR>> <BR>> What I still do not understand is the difference between EAP-TTLS<BR>> (that optionally might authenticate the client using the client cert)<BR>> and EAP-TTLS / EAP-TLS. Is the only difference, that when I perform<BR>> EAP-TLS as "inner" method, username won't be visible in plaintext on<BR>> the wire, since EAP-TLS is executed via the tunnel?<BR>> <BR>> Regards,<BR>> Martin<BR>> _______________________________________________<BR>> HostAP mailing list<BR>> HostAP at lists.shmoo.com<BR>> http://lists.shmoo.com/mailman/listinfo/hostap<BR><BR><br /><hr />Always-on security tools provide safer ways to connect and share anywhere. Find o
 ut more. <a href='http://get.live.com/familysafety/overview' target='_new'>Windows Live</a></body>
</html>
--_c40df985-6eed-4ca1-8cc7-8327b21264b1_--