EAP Method Comparison Matrix - RFC 3748 base | For use with 802.1X / WPA2-Enterprise / WPA3-Enterprise10 rows#
| EAP Method | RFC / Spec | Tunnel Protocol | Server Auth | Client Auth | Mutual Auth | Server Cert Required | Client Cert Required | PMKID Support | Known Vulnerabilities / CVEs | Recommended Use |
|---|---|---|---|---|---|---|---|---|---|---|
| EAP-TLS | RFC 5216 RFC 9190 (v1.3) | TLS 1.2 or 1.3 | X.509 Certificate | X.509 Certificate | YES - mutual cert | YES (mandatory) | YES (mandatory) | Yes (RFC 9190) | None known for TLS 1.3 variant. TLS 1.2: BEAST, POODLE (old versions) | BEST for enterprise. Gold standard. Requires PKI for client certs. RFC 9190 (TLS 1.3) reduces handshake to 2 RTT. |
| PEAP v0 (MSCHAPv2) | IETF draft (Microsoft) RFC 2759 (MSCHAPv2) | TLS tunnel (outer) MSCHAPv2 (inner) | X.509 Certificate | Username + Password | Outer only (server cert) | YES (mandatory) | NO | Yes | MSCHAPv2 inner: offline dictionary attack if TLS cert not validated. CVE: MS-CHAPv2 DES weakness. Impersonation if client ignores cert errors. | Common enterprise default. Acceptable if cert validation enforced and strong passwords used. |
| PEAP v1 (EAP-GTC) | Cisco proprietary (IETF draft) | TLS tunnel (outer) EAP-GTC (inner) | X.509 Certificate | Username + OTP/Password | Outer only | YES | NO | Yes | EAP-GTC sends credentials in cleartext inside TLS tunnel. TLS cert validation critical. Prone to misconfiguration. | Used with OTP tokens. Avoid MSCHAPv2 inner where possible. |
| EAP-TTLS | RFC 5281 | TLS tunnel (outer) Any (PAP/CHAP/MSCHAPv2/EAP inner) | X.509 Certificate | Username + Password (inner) | Outer only | YES | NO | Yes | Same MSCHAPv2 risks as PEAP if MSCHAPv2 inner used. PAP inside TLS = credentials visible to TLS terminator. | More flexible than PEAP. PAP inner acceptable only if TLS cert validation is strict. |
| EAP-FAST | RFC 4851 (Cisco) | PAC-based TLS tunnel | PAC or certificate | Username + Password | Mutual (if PAC valid) | Optional (PAC-based) | NO | Yes | PAC provisioning: unauthenticated PAC provisioning (Phase 0) vulnerable to MitM. CVE-2008-1573 (weak PAC encryption). | Use only with mutual PAC provisioning or certificate-based. Being superseded by EAP-TEAP. |
| EAP-TEAP | RFC 7170 (IETF standard) | TLS 1.3 outer tunnel | Certificate or PAC | Certificate or Password | YES (mandatory) | YES (strongly recommended) | Optional | Yes | None known in current spec. Designed to address EAP-FAST weaknesses. Requires proper TLS 1.3 support. | Emerging replacement for EAP-FAST and PEAP. RFC 9190 / WPA3-Enterprise recommended. |
| EAP-SIM | RFC 4186 3GPP TS 33.102 | GSM SIM auth | GSM RAND/SRES | GSM SIM card | Partial (SIM challenge) | NO (carrier network) | SIM card required | Yes | SS7 attacks can compromise RAND/SRES exchange. Cloning attacks on older SIM cards. No perfect forward secrecy. | Mobile carrier Wi-Fi offload (Hotspot 2.0). Not suitable for enterprise security. |
| EAP-AKA | RFC 4187 3GPP TS 33.102 | UMTS/LTE AKA | UMTS/LTE HSS | USIM card | YES (mutual) | NO | USIM card required | Yes | SQN (sequence number) sync failures. IMSI catching (privacy) - mitigated by EAP-AKA'. | Carrier Wi-Fi offload with USIM. Better than EAP-SIM (UMTS AKA vs GSM). |
| EAP-AKA' | RFC 5448 3GPP TS 33.402 | UMTS/LTE AKA + hash | 3GPP HSS | USIM card | YES (mutual + network name binding) | NO | USIM card required | Yes | Network name binding added to prevent cross-network attacks (vs EAP-AKA). Still relies on carrier SS7 infrastructure. | Preferred for 3GPP/Wi-Fi interworking (Hotspot 2.0 Passpoint Release 2+). |
| EAP-PWD | RFC 5931 IEEE 802.11-2020 | None (password-based DH) | Password (Dragonfly) | Password (Dragonfly) | YES - mutual | NO | NO | Yes | CVE-2019-9499 (DragonBlood variant for EAP-PWD - timing side-channel). Fixed: constant-time operations. | Alternative to PSK for password-based mutual auth without certs. Less common than PEAP. |
802.1X Supplicant State Machine - IEEE 802.1X-2020 §8.2 | Key timers and transitions6 rows#
| State | State Name | Entry Actions | Key Timers (seconds) | Exit Conditions | MIB Variables | Notes | - | - | - | - |
|---|---|---|---|---|---|---|---|---|---|---|
| INITIALIZE | Initializing | Reset all variables; set portEnabled=FALSE; clear PMKSA cache | - | Immediate → DISCONNECTED | dot11RSNAStatsCount reset | Entry state on power-on or EAP failure forcing restart | - | - | - | - |
| DISCONNECTED | Link down | portEnabled=FALSE; no EAPOL sent | - | Link up → CONNECTING | - | Waiting for physical layer to indicate link | - | - | - | - |
| CONNECTING | Sending EAPOL-Start | Send EAPOL-Start to AP; wait for EAP-Request/Identity | startPeriod=30 s maxStart=3 attempts | EAP-Request/Identity received → AUTHENTICATING Max starts exceeded → HELD | dot11RSNA1xStartCount | EAPOL-Start: SRC=STA_MAC, DST=01:80:C2:00:00:03 (PAE multicast). Some APs trigger EAP on Assoc without needing Start. | - | - | - | - |
| AUTHENTICATING | EAP exchange in progress | Process EAP messages; forward to higher layer (WPA supplicant / 802.1X backend) | authPeriod=30 s | EAP-Success → AUTHENTICATED EAP-Failure → HELD authPeriod timeout → CONNECTING | dot11RSNAStats4WayHandshakeFailures | Full EAP exchange occurs here. Duration varies: EAP-TLS ~200ms, PEAP ~150ms, SAE ~50ms (WPA3). | - | - | - | - |
| AUTHENTICATED | Port authorized | portEnabled=TRUE; data traffic flows; 4-way handshake proceeds | keyHeld - PMK lifetime dot11RSNAConfigPMKLifetime=43200 s | PMK expires → re-auth (CONNECTING) Link drops → DISCONNECTED EAP-Failure (re-auth) → HELD | dot11RSNAStatsSuccess dot11RSNA4WayHandshake SuccessCount | Full data path open after 4-way handshake completes. PMKSA cached for fast re-auth. | - | - | - | - |
| HELD | Failure back-off | portEnabled=FALSE; wait heldPeriod before retry | heldPeriod=60 s (after EAP-Failure or auth timeout) | heldPeriod expires → CONNECTING | dot11RSNAStatsAuthFailures | Prevents rapid retry loops hammering RADIUS. Visible in supplicant as 'authentication failed, retry in 60s'. | - | - | - | - |
SAE Authentication Detail - IEEE 802.11-2020 §12.4 | Dragonfly: RFC 7664 | H2E: RFC 8492 | DragonBlood: CVE-2019-949413 rows#
| Property | Hunting-and-Pecking (H&P) | Hash-to-Element (H2E) | - | - | - | - | - | - | - | - |
|---|---|---|---|---|---|---|---|---|---|---|
| Standard | IEEE 802.11-2020 §12.4.4.2 | IEEE 802.11-2020 §12.4.4.3 + RFC 8492 | - | - | - | - | - | - | - | - |
| PWE Derivation Method | Iterative: try incrementing counter k=1,2,3… until quadratic residue found in group | Direct: one-shot hash-to-curve using HKDF. No iteration. Always constant-time. | - | - | - | - | - | - | - | - |
| Number of iterations | Variable (1-n). Average ≈ ln(2)/ln(p) ≈ 1-40 depending on password | Always exactly 1. No loop. | - | - | - | - | - | - | - | - |
| Timing side-channel | YES - iteration count leaks information about password (DragonBlood CVE-2019-9494) | NO - constant-time. No timing oracle. | - | - | - | - | - | - | - | - |
| Cache side-channel | YES - branch mispredictions and cache access patterns vary with password (CVE-2019-9494) | NO - no conditional branches on secret data. | - | - | - | - | - | - | - | - |
| Mandatory in WPA3 | Deprecated (was original WPA3). WPA3 v3.0+ mandates H2E. | YES - mandatory since Wi-Fi Alliance WPA3 Specification v3.0 (2022) | - | - | - | - | - | - | - | - |
| Anti-clogging token | Optional. AP may require token to prevent CPU exhaustion DoS. | Optional. Same mechanism. | - | - | - | - | - | - | - | - |
| Hash function | SHA-256 (prime groups) or SHA-384 (ECC P-384) | HKDF-Extract + HKDF-Expand (RFC 5869). SHA-256 or SHA-384 depending on group. | - | - | - | - | - | - | - | - |
| Elliptic Curve Groups | P-256, P-384, P-521, Brainpool, FFDH groups 14/15/16/17/18/19/20 | Same groups. H2E uses hash_to_field → map_to_curve → clear_cofactor. | - | - | - | - | - | - | - | - |
| Frame count per auth | 4 frames: Commit→Commit→Confirm→Confirm (2 round trips) | Same 4 frames. H2E flag signaled in Commit frame status/token field. | - | - | - | - | - | - | - | - |
| Downgrade prevention | None in WPA3 v1 (DragonBlood downgrade attack CVE-2019-9496) | Transition Disable element: AP signals STA to disable H&P fallback permanently after successful H2E auth. | - | - | - | - | - | - | - | - |
| hostapd config | sae_pwe=0 (H&P only) or sae_pwe=2 (both H&P and H2E) | sae_pwe=1 (H2E only, recommended) or sae_pwe=2 (both for transition) | - | - | - | - | - | - | - | - |
| Wireshark identification | Auth frame alg=3, seq=1: status_code=0 (no anti-clogging) - H&P is default | Auth frame seq=1: contains Anti-Clogging Token Container element OR status=76 (H2E indicator) | - | - | - | - | - | - | - | - |