Protected Extensible Authentication Protocol (PEAP)

PEAP is an EAP extension for Windows CE .NET that enhances the security of the authentication phase. PEAP provides the security framework for mutual authentication between an EAP client and an EAP server. PEAP is not as secure as Transport Level Security (TLS), but has the advantage of being able to use username/password authentication instead of client certificate authentication.

PEAP authentication occurs as a two-part conversation between the EAP client and the EAP server. In the first part of the conversation, TLS is used to establish a secure channel for use in the second part of the authentication. During this process, the server sends the client a certificate, which the client uses to authenticate the server. The client does NOT send a certificate to the server; this would happen in a standard EAP-TLS authentication. Once the client authenticates the server and the secure channel is established, the second part of the PEAP conversation begins. In this second part, a complete EAP conversation occurs within the secure channel, for example EAP-MSCHAPv2 username/password based authentication. PEAP authentication succeeds if both parts of the authentication succeed.

Because PEAP uses TLS, many features of TLS are available for PEAP implementations. The TLS session resumption facility can be used for PEAP conversations. This allows for quick re-authentication while roaming on a wireless network. The TLS channel also provides enhanced security for the authentication process because it helps to protect the client identity and helps prevent attackers from injecting packets into the conversation. However, security issues found in TLS will also be found in PEAP.

Implementation

PEAP is part of the TLS module and uses MS CHAP V2 support; therefore, both the EAPTLS and EAPCHAP modules must be included in a build that supports PEAP.

The option to use PEAP for authentication is set during RAS or 802.1x configuration. When creating a new connection for a Windows CE device, the security settings screen is used to implement PEAP. In the security settings screen, select the use Extensible Authentication Protocol (EAP) check box and select PEAP from the drop-down list.

**Note   **Support for all TLS ciphersuites is not required to use PEAP. The only ciphersuites that must be supported are TLS_RSA_WITH_RC4_128_MD5 and TLS_RSA_WITH_RC4_128_SHA. Additionally, the ciphersuite that is negotiated only relates to the second part of the PEAP conversation.

For more detailed information about PEAP, see the Protected EAP Protocol (PEAP) Internet draft at the Internet Engineering Task Force Web site.

Registry Settings

The following example shows the registry settings for PEAP.

[HKEY_LOCAL_MACHINE\Comm\EAP\Extension\25]
    "FriendlyName"="PEAP"
    "InvokeUserNameDialog"=dword:1
    "ConfigUIPath"="eaptls.dll"
    "Path"="eaptls.dll"
    "InteractiveUIPath"="eaptls.dll"
    "EAPMSCHAPv2Only"=dword:1

See Also

EAP Authentication Protocols | Transport Level Security (TLS) | Extensible Authentication Protocol

 Last updated on Thursday, April 08, 2004

© 1992-2003 Microsoft Corporation. All rights reserved.