802.1X
Terry Simons
Formerly of The University of Utah

University of Utah Background
28,000+ student campus
EAP-TTLS
802.1X movement was “grass roots”
Proof of concept
Wireless Whitepaper
RADIUS “Mesh” (More of a star topology)
“Give to get” mentality
Initial Deployment on May 19, 2003
Campus Radiator Site License
Initial Campus Meetinghouse Site License
Mac OS X 10.2.x, Win98se/Me/2k/XP/PPC 2002/2003
Now prefer SecureW2 TTLS WZC Plugin
Chris Hessing is lead developer of Open1x

802.1X Problem Areas
Certificate Validation
Windows Zero Config/GINA
The Supplicant Debacle
EAP Type Selection
Encryption

Certificate Validation
No real CRL Support
Deployment Difficulty
Mitigated in part by “smart installers”
Mac OS X is too “easy to use”
I am a Mac user. :-}
Man in the Middle Attacks
Public Certificate Authorities
Mac OS X becomes vulnerable

Windows Zero Config/GINA
Users expect it, especially in higher ed.
AEGIS and Funk take over WZC/GINA
Users complain loudly
Helpdesk gets swamped
GINA: “What did you do to my computer?!”
Not so bad with current Meetinghouse releases
Migration to SecureW2 fixed both issues.

The Supplicant Debacle
Vendors bundle OEM’d Supplicants
Which quite often do not work properly
IBM Thinkpad/Intel Centrino TTLS Problems
Usually based on Meetinghouse
Same crunchy WZC problems
Same bad aftertaste
Most setup programs are self-extractable
Use a zip utility to extract only the driver

EAP Type Selection
TLS, TTLS, or PEAP
Provisions for keying material
TLS if an existing PKI is in place
Arguably the “most secure” EAP type
TTLS for “strongly encrypted” backends
U of U uses Kerberos
PEAP for Active Directory shops

Encryption
CCMP is the “best” security currently
Doesn’t work with Mac OS X
TKIP is the next best thing.
Watch out for “mixed mode” problems
TKIP “Unicast” and WEP “Multicast” keys
Specifically a problem with Mac OS X
Apple is aware of the problem.
Dynamic WEP for “Legacy” devices
Or use multiple SSIDs and run parallel security models.

Ending Comments
It’s possible to allow multiple EAP types
Works well in Federated environments
Vendor skepticism is encouraged
Helpdesk Feedback Loop

Q&A

Resources
http://wireless.utah.edu/global/support/WirelessWhitepaper-v1.03.pdf
http://wireless.utah.edu/global/support/radius_mesh/RADIUS_Mesh_Long.pdf
http://www.open1x.org/
http://www.open.com.au/radiator/
http://www.securew2.com/