802.1x, Encryption and Authentication - EAP-TLS

Extensible Authentication Protocol - Transport Layer Security (EAP-TLS), TLS the replacement for SSL protocol, using PKI.

Requirements of TLS
1. Client must have a certificate so the network can authenticate it
2. AAA server needs a certificate so the client can authenticate it
3. Certificate Authority (CA) must provide certificates to the client and server

+ Windows single sign-on
+ Supported on Windows platform

Wireless client connects to AP using open authentication, AP only permits AES from client until authenticated by AAA server. Client sends EAPOL start frame to server, AP returns request/identify to client. Client sends it's NAI address to the AP which forwards it to the AAA server, client/server perform mutual authentication using certificate exchange, RADIUS server sends session key in success packet.

RADIUS server and client negotiate session encryption, based on client using WEP or 802.11i. Keys then used for the session. EAPOL logoff packet send from client at end of session, AP returns to only accepting AES.