SSCP Systems Security Certified PractitionerNetwork and Communications SecurityHard
A network security engineer is designing a secure wireless network for a critical operational technology (OT) environment. The design requires mutual authentication between wireless clients and the access points, along with strong encryption that can resist future cryptanalysis. Which EAP method, combined with WPA3, would best fulfill these requirements?
- ALEAP
- BEAP-TLS
- CEAP-MD5
- DPEAP
Show answer & explanationAnswer & explanation
Correct answer: B. EAP-TLS
EAP-TLS (Extensible Authentication Protocol - Transport Layer Security) provides the strongest authentication by using client-side and server-side digital certificates for mutual authentication. Combined with WPA3, which mandates the use of CCMP (AES-GCM) and offers 'Forward Secrecy' through Simultaneous Authentication of Equals (SAE), it meets the requirements for strong encryption and future resistance to cryptanalysis.
Why the other options are wrong
- A. LEAP (Lightweight EAP) is a proprietary Cisco protocol that is known to be vulnerable to dictionary attacks and does not provide mutual authentication or strong encryption, making it unsuitable for critical environments.
- C. EAP-MD5 is highly insecure as it does not support mutual authentication, key generation, or protection against dictionary attacks.
- D. PEAP (Protected EAP) tunnels other EAP methods (like MS-CHAPv2) within a TLS tunnel. While it provides server-side authentication, client-side authentication is often password-based and less secure than certificate-based EAP-TLS.
EAP-TLS with WPA3
A highly secure wireless authentication and encryption combination using client/server certificates for mutual authentication and WPA3's advanced cryptographic features.
- EAP-TLS uses X.509 certificates for both client and server.
- WPA3 mandates CCMP (AES-GCM) for encryption.
- WPA3's SAE (Simultaneous Authentication of Equals) provides forward secrecy.
Memory trick: EAP Methods: MD5 is Messy, LEAP is Leaky, PEAP is Protected, TLS is Top-tier.