7. Wireless Encryption & Authentication Methods

WPA2

– began in 2004

– uses CCMP

CCMP block cipher mode

– Data confidentiality with AES encryption

– Message Integrity Check (MIC) with CBC-MAC

WPA3

– Introduced in 2018
– Uses GCMP

GCMP block cipher mode

– Data confidentiality with AES

– Message Integrity Check (MIC) with

– Galois Message Authentication Code (GMAC)

RADIUS (Remote Authentication Dial-in User Service)

• One of the more common AAA protocols

– Supported on a wide variety of platforms and devices

– Not just for dial-in

• Centralize authentication for users

– Routers, switches, firewalls

– Server authentication

– Remote VPN access

– 802.1X network access

TACACS

– Access-Control System

– Remote authentication protocol

– Created to control access to dial-up lines to ARPANET

TACACS+

– Probably a Cisco device
– More authentication requests and response codes

– Released as an open standard in 1993

Kerberos

• Network authentication protocol

– Authenticate once, trusted by the system

– No need to re-authenticate to everything

– Mutual authentication - the client and the server

– Protect against on-path or replay attacks