not have the key cannot decrypt received packets. Accordingly, it cannot commu-
nicate, regardless of whether it had to authenticate itself.
WPA-PSK (or WPA-Personal, according to IEEE 802.1x)
WPA-PSK (PSK stands for preshared key) works similarly to the Shared Key
procedure. All participating stations as well as the access point need the same key.
The key is 256 bits in length and is usually entered as a passphrase. This system
does not need a complex key management like WPA-EAP and is more suitable for
private use. Therefore, WPA-PSK is sometimes referred to as WPA “Home”.
WPA-EAP (or WPA-Enterprise, according to IEEE 802.1x)
Actually, WPA-EAP (Extensible Authentication Protocol) is not an authentication
system but a protocol for transporting authentication information. WPA-EAP is
used to protect wireless networks in enterprises. In private networks, it is scarcely
used. For this reason, WPA-EAP is sometimes referred to as WPA “Enterprise”.
WPA-EAP needs a Radius server to authenticate users. EAP offers three different
methods for connecting and authenticating to the server:
• Transport Layer Security (EAP-TLS): TLS authentication relies on the
mutual exchange of certicates for both server and client. First, the server
presents its certicate to the client where it is evaluated. If the certicate is
considered valid, the client in turn presents its certicate to the server. While
TLS is secure, it requires a working certication management infrastructure
in your network. This infrastructure is rarely found in private networks.
• Tunneled Transport Layer Security (EAP-TTSL)
• Protected Extensible Authentication Protocol (EAP-PEAP): Both TTLS
and PEAP are two-stage protocols. In the rst stage, a secure connection
is established and in the second the client authentication data is exchanged.
They require far less certication management overhead than TLS, if any.
24.4 Encryption
There are various encryption methods to ensure that no unauthorized person can read
the data packets that are exchanged in a wireless network or gain access to the network:
434 Reference
