Wireless Security.pdf - PDF Archive

Implementing Advanced Wireless Security 537
randomization is a fairly new practice. Another new addition is Cisco’s proprietary
offering (now being used by many third-party vendors), Lightweight Extensible
Authentication Protocol (LEAP).
LEAP is one of approximately 30 different variations of the Extensible Authentication
Protocol (EAP). Other variants include Extensible Authentication Protocol-Message Digest
Algorithm 5 (EAP-MD5), Extensible Authentication Protocol-Transport Layer Security
(EAP-TLS), Extensible Authentication Protocol-Tunneled TLS (EAP-TTLS), and Protected
Extenstible Authentication Protocol (PEAP). EAP allows other security products (such
as LEAP) to be used to provide additional security to Point-to-Point Protocol (PPP) links
through the use of special Application Programming Interfaces (APIs) that are built into
operating systems and, in the case of the Cisco Aironet hardware, hardware device firmware.
LEAP (also known as EAP-Cisco Wireless) uses dynamically generated WEP keys,
802.1x port access controls, and mutual authentication to overcome the problems inherent
in WEP. 802.1x is an access control protocol that operates at the port level between any
authentication method (LEAP in this case) and the rest of the network. 802.1x does
not provide authentication to users; rather, it translates messages from the selected
authentication method into the correct frame format being used on the network. In the
case of our example, the correct frame format is 802.11, but 802.1x can also be used on
802.3 (Ethernet) and 802.5 (Token Ring) networks, to name a few. When you use 802.1x,
the choice of the authentication method and key management method are controlled by
the specific EAP authentication being used (LEAP in this case).
NOTE
RADIUS is defined by Requests for Comments (RFC) 2865. The behavior of
RADIUS with EAP authentication is defined in RFC 2869. RFC can be searched and
viewed online at www.rfc-editor.org . 802.1x is defined by the IEEE in the document
located at http://standards.ieee.org/getieee802/download/802.1X-2001.pdf .
LEAP creates a per-user, per-session dynamic WEP key that is tied to the network logon,
thereby addressing the limitations of static WEP keys. Since authentication is performed
against a back-end RADIUS database, administrative overhead is minimal after initial
installation and configuration.
www.newnespress.com