Wireless security is rising, but it's not fully baked yet

BELMONT, CALIF. - In interoperability testing that NetWorld+Interop's iLabs Wireless Security team conducted earlier this month, we found that products supporting 802.1X -- the proposed standard for authentication in wireless networks -- worked well together most of the time, but we identified some problem areas that need attention from standards bodies and vendors alike.

The iLabs team assembled 802.1X supplicants (clients) from four vendors on four operating systems (Windows XP, Windows 2000, Mac OS X and Windows CE); Remote Authentication Dial-In User Service (RADIUS ) authentication servers from seven vendors running on Windows, Linux and HP/UX; and 19 different 802.1X wireless and wired devices including access points, new wireless switches and traditional wired Fast Ethernet switches.

Across the board, we identified hundreds of test cases that worked flawlessly. However, testing uncovered instances where interoperability wasn't so smooth, including complications with Protected Extensible Authentication Protocol (PEAP) and Tunneled Transport Layer Security (TTLS) authentication within 802.1X, setting of wired equivalent privacy (WEP ) keys, and interpretations of the standards.

Vendors achieved excellent Transport Layer Security (TLS ) authentication rates in our lab setting, with only a few test cases failing. TLS, and IETF-sponsored protocol, is the simplest acceptable authentication method for wireless networks, and has been accepted as a standard, therefore it served as a litmus test for basic operation.

But in the real world, things are much different. TLS requires that each end user have a digital certificate, and that's probably not a good assumption for many of today's networks. Conventional wisdom for wireless vendor lies in the belief that most network managers will want to incorporate 802.1X-based security  measures into an existing authentication system, such as username/ password or token-card schemes. Unfortunately, that's not easy to do securely.

PEAP vs. TTLS: A bad competition

Two competing proposals that help to integrate legacy authentication into 802.1X are TTLS, proposed by Funk and Certicom; and PEAP, proposed by RSA Security, Cisco and Microsoft. While neither proposal has advanced to standards status, many vendors have implemented both.

Finding a compatible inner authentication method, such as MS-CHAP-V2 or One Time Password, within PEAP and TTLS is not easy. Because PEAP doesn't allow for a simple username/password mechanism required to authenticate against an existing user database with encrypted passwords, such as Unix or a Lightweight Directory Access Protocol  directory, vendors have tried to shoehorn this into PEAP authentication methods. The results are predictable: Every vendor has a different approach, and that translates to interoperability failures.

TTLS has the opposite problem: There are too many ways to do the same thing. So if you want to authenticate against a Microsoft authentication database with MS-CHAP-V2, there are two ways to do it -- and not every vendor allows for both possibilities.

Because TTLS and PEAP are technically equivalent, having both on the table at this stage of the 802.1X implementation is a major roadblock to interoperability. During the testing, we found different vendors have implemented different drafts. Even Cisco and Microsoft -- the two vendors driving PEAP, have chosen an incompatible set of inner authentication methods, blocking total interoperability. Smaller vendors, such as Meetinghouse Data Communications and Interlink , also are being pushed to implement both standards, further diluting development efforts and complicating implementation and interoperability. While time will improve interoperability, having the IETF decide the TTLS vs. PEAP discussion quickly would help even more.

Users who want to use simple username/ password have another option. Dutch network security firm Alfa & Ariss  has made available a freeware TTLS plug-in, which adds TTLS with Password Authentication Protocol (the simple username/password method) support to Microsoft's built-in Win 2000 and XP 802.1X supplicant. (For a download, go to www.alfa-ariss.com.) We tested this freeware and got it to interoperate with the other products tested.

If you want to use TTLS or PEAP to authenticate wireless users, hold off committing to a final wireless security topology for several months until the IETF chooses a final direction.