What are the biggest differences between WPA and WPA2 and why is AES so much safer than TKIP?
What’s the difference between WPA and WPA2
ieee 802.11Security
Related Solutions
The short answer: 802.16 is a series of standards for mid-range metro wireless networks, mainly for backhaul or device-to-device communication. 802.11ah instead, is a standard for low-power, low frequencie ap-to-enddevice communication in home automation or intra device communication for industrial machines.
The long answer can be found by reading the standard(s) and/or the wikipedia articles for it ;)
That's a lot of questions, so let's take them one by one.
What exactly is 802.1X Port-Based Authentication?
From Wikipedia :
IEEE 802.1X is an IEEE Standard for port-based Network Access Control (PNAC). It is part of the IEEE 802.1 group of networking protocols. It provides an authentication mechanism to devices wishing to attach to a LAN or WLAN.
In other words, it is a mechanism used in (mostly) switches and wireless access-points to allow or block devices to access the network (or granularly allow access to parts of it).
For example if you have a network port in a meeting room, you can enable 802.1x on the switchport and configure it in such a way that when an employee connects she has access to the entire network but if a guest connects (with a temporary password) he can only reach the Internet and if a passer-by is tempted to try his luck, he cannot access anything at all.
Doesn't it also use RADIUS as it's underlying authentication mechanism?
Yes and no. 802.1x uses Extensible Authentication Protocol (EAP), and the wikipedia article about 802.1x has this nice drawing that shows that for wired 802.1x:
- EAP over LAN (EAPoL) is used between the Supplicant (software on your laptop) and the Authenticator (switch)
- EAP is then usually tunnelled over Radius between the Authenticator and the Authentication Server, but it can also be done over Diameter (the successor to Radius)
For wireless it is similar in the sense that there is also no Radius between the supplicant and the authenticator, only between the authenticator and the auth server (to tunnel the EAP).
Now the Extensible in EAP's name is very true, there are dozens of EAP protocols that you can choose from, some will use passwords, others certificates or both, etc. etc.
What are their differences?
Well, it's a bit like comparing apples and oranges. Dot1x is not really a protocol but more a framework in which protocols like EAPoL and Radius are used.
Simplified (maybe over-simplified?) you could say:
- Radius is typically used as a 'simple' authentication method to control who can login to a router (or other device), or who can connect using a VPN client. Sometimes also for authorization, e.g. to determine the privilege-level when you log in to a router, or to push a dynamic access-list for a vpn user.
- Dot1x is typically used to control access to switchports and wifi.
And if we can somehow compare them, which one is more secure?
I don't believe (but anyone please correct me) that there are scenarios where you can choose between one or the other. It may make miore sense to compare Radius and EAP, to some extent.
Some things to consider:
- EAP is end-to-end while Radius is only used between the Authenticator and the Authentication Server and so you need to make sure that the part between the client and the Authenticator is also secured; e.g. use SSH instead of telnet to log in to your router.
- similarly some (but not all) EAP methods can be used for mutual authentication (between the supplicant and the authentication server!), in the Radius case it depends again on what protocol is used between client and authenticator.
- EAP is as secure as the EAP method you select (e.g. LEAP or EAP-MD5 are weak)
Best Answer
WPA and WPA2 in very simple terms are two different methods for and end device and AP to exchange encryption keys. Depending on your platform, you can support WPA and/or WPA2 with either TKIP or AES.
TKIP and AES are the two methods by which the data is encrypted.
If it helps, think of the difference as pressing a paper towel to a three inch gash on your arm versus getting stitches at the emergency room. One is an immediate solution that mitigates the problem at hand, the other is a better, longer term solution.
WEP was broken (badly) and needed to be fixed. However standards bodies sometimes move much slower than solutions are needed. So WPA/TKIP was provided as a better solution than WEP that could be implemented purely in code/software/drivers.
Basically, TKIP is WEP with a few extra features, provided to the community largely by a major network vendor they had previously developed as proprietary enhancements. While it provided fixes to many of the problems with WEP, it is still based on WEP.
WPA was derived from a draft of the 802.11i amendment from the IEEE. There were some changes from the draft to the finalized version of 802.11i, which is why the 802.11i standard version is called WPA2. Ultimately the differences are relatively trivial in the grand scheme of things.
For encryption, the IEEE selected AES for 802.11i. This was a much stronger encryption than WEP however many existing wireless devices were not capable of handling the demands of AES, often requiring new wireless adapters to be installed/used.
Because of this limitation to AES, it was allowed to run either WPA/WPA2 with TKIP instead of AES until the IEEE finalized 802.11n. 802.11n no longer allowed support for TKIP, so an access point was supposed to disable the HT (high throughput) data rates if it were used and operate like an 802.11a/g device.
Since that time, only WPA/AES or WPA2/AES are supported officially by the 802.11 standards.